Edit tour

Windows Analysis Report
https://u1931584.ct.sendgrid.net/ls/click?upn=u001.0E02-2FzIG11vXmfBwdT167PQOcAxKKwdHOFrr9Q707zuCmae7OGpEH0sjgTwVKZOKGOIXhaZab42uYJDjXq-2BvDmBrB-2BitjeHEOm417wfwEN5DyKmWjx8GiK0vS0qP2-2FkZEXzCjOD1ATi51VFipfhQLxfE8-2FFtDYLE86HSpQBMyyH0F22Zm-2FfU1z5fJcYtwUM-2FxFJS_p4A4YQt8epDIK9HlKea9sedvYl6q0W66qnzBrc

Overview

General Information

Sample URL:	https://u1931584.ct.sendgrid.net/ls/click?upn=u001.0E02-2FzIG11vXmfBwdT167PQOcAxKKwdHOFrr9Q707zuCmae7OGpEH0sjgTwVKZOKGOIXhaZab42uYJDjXq-2BvDmBrB-2BitjeHEOm417wfwEN5DyKmWjx8GiK0vS0qP2-2FkZEXzCjOD1ATi51
Analysis ID:	1538996
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

Downloads suspicious files via Chrome

Allocates memory with a write watch (potentially for evading sandboxes)

Creates a process in suspended mode (likely to inject code)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTML body with high number of embedded SVGs detected

May sleep (evasive loops) to hinder dynamic analysis

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3916 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3620 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1984,i,17366287729370669979,6165770494908461818,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

unarchiver.exe (PID: 6848 cmdline: "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Submission Proposal.pdf.zip" MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 3452 cmdline: "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\gxrvoq3c.c3c" "C:\Users\user\Downloads\Submission Proposal.pdf.zip" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 5264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5640 cmdline: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\gxrvoq3c.c3c\Submission Proposal.pdf" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 7068 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\gxrvoq3c.c3c\Submission Proposal.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6304 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6504 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2068 --field-trial-handle=1580,i,8949217225099387246,9342843988186091837,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 6292 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://u1931584.ct.sendgrid.net/ls/click?upn=u001.0E02-2FzIG11vXmfBwdT167PQOcAxKKwdHOFrr9Q707zuCmae7OGpEH0sjgTwVKZOKGOIXhaZab42uYJDjXq-2BvDmBrB-2BitjeHEOm417wfwEN5DyKmWjx8GiK0vS0qP2-2FkZEXzCjOD1ATi51VFipfhQLxfE8-2FFtDYLE86HSpQBMyyH0F22Zm-2FfU1z5fJcYtwUM-2FxFJS_p4A4YQt8epDIK9HlKea9sedvYl6q0W66qnzBrcHOUCWErG8eYzfGVOB9NWJFyY4eLd2APu7Ps5E6ldV9YAcohj-2Fi086o8cWXXfFLnAGl6fjIOJQY5-2FQ-2F0-2BiCUTBMFYjbe292XkQmYU7w5w0oMitE-2Fn5R5dV1nHfTciU6eLmPx0ie-2BBr7HxuQc0d5wlQhWiwGZYXHSECUpMfsZuL3vCwzBA-3D-3D" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7304 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://rdi5cditblgwvqdacqlhomd2xnwm7evojwwetg5vpgo5rnk4btoq.ar-io.dev/iNHRDRMKzWrAYBQWdzB6u2zPkq5NrEmbtXmd2LVcDN0" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3368 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=2056,i,9991034077987844039,10875721668343843587,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: https://docs.b360.autodesk.com/shares/71eed6cd-6f17-43e1-9baf-76250ffcdf51/recipients/69a7f40d-d879-4336-899e-8d70b1c53626

HTTP Parser: Total embedded SVG size: 1864390

Source: https://docs.b360.autodesk.com/assets/dm-vendors-f10bd27d5e5fc5831931.js

HTTP Parser: /*! for license information please see dm-vendors-f10bd27d5e5fc5831931.js.license.txt */(self.webpackchunk_adsk_docs_ui_web=self.webpackchunk_adsk_docs_ui_web||[]).push([[3041],{726981:(e,t,r)=>{"use strict";r(911983);var n=o(r(40115));function o(e){return e&&e.__esmodule?e:{default:e}}n.default._babelpolyfill&&"undefined"!=typeof console&&console.warn&&console.warn("@babel/polyfill is loaded more than once on this page. this is probably not desirable/intended and may have consequences if different versions of the polyfills are applied sequentially. if you do need to load the polyfill more than once, use @babel/polyfill/noconflict instead to bypass the warning."),n.default._babelpolyfill=!0},911983:(e,t,r)=>{"use strict";r(916266),r(310990),r(470911),r(314160),r(106197),r(296728),r(654039),r(793568),r(978051),r(38250),r(515434),r(354952),r(796337),r(535666)},315897:(e,t,r)=>{"use strict";t.__esmodule=!0;var n=r(667294),o=d(n),i,a=d(r(45697)),s,u=d(r(847815)),c,l=d(r(725506));function d(e){return e&&e.__esmod...

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 20MB later: 41MB

Source: chromecache_381.2.dr, chromecache_382.2.dr	String found in binary or memory: http://127.0.0.1:3000/p/a/t_(asd)/h?q=abc123#dfdf
Source: 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: chromecache_401.2.dr	String found in binary or memory: http://help.autodesk.com/view/BIM360D/CHS/
Source: chromecache_401.2.dr	String found in binary or memory: http://help.autodesk.com/view/BIM360D/CHT/
Source: chromecache_401.2.dr	String found in binary or memory: http://help.autodesk.com/view/BIM360D/CSY/
Source: chromecache_401.2.dr	String found in binary or memory: http://help.autodesk.com/view/BIM360D/DAN/
Source: chromecache_401.2.dr	String found in binary or memory: http://help.autodesk.com/view/BIM360D/DEU/
Source: chromecache_401.2.dr	String found in binary or memory: http://help.autodesk.com/view/BIM360D/ENU/
Source: chromecache_401.2.dr	String found in binary or memory: http://help.autodesk.com/view/BIM360D/ESP/
Source: chromecache_401.2.dr	String found in binary or memory: http://help.autodesk.com/view/BIM360D/FRA/
Source: chromecache_401.2.dr	String found in binary or memory: http://help.autodesk.com/view/BIM360D/FRC/
Source: chromecache_401.2.dr	String found in binary or memory: http://help.autodesk.com/view/BIM360D/ITA/
Source: chromecache_401.2.dr	String found in binary or memory: http://help.autodesk.com/view/BIM360D/JPN/
Source: chromecache_401.2.dr	String found in binary or memory: http://help.autodesk.com/view/BIM360D/NLD/
Source: chromecache_401.2.dr	String found in binary or memory: http://help.autodesk.com/view/BIM360D/NOR/
Source: chromecache_401.2.dr	String found in binary or memory: http://help.autodesk.com/view/BIM360D/PTB/
Source: chromecache_401.2.dr	String found in binary or memory: http://help.autodesk.com/view/BIM360D/RUS/
Source: chromecache_401.2.dr	String found in binary or memory: http://help.autodesk.com/view/BIM360D/SWE/
Source: chromecache_381.2.dr, chromecache_382.2.dr	String found in binary or memory: http://sub.domain.co.uk:3000
Source: chromecache_390.2.dr	String found in binary or memory: https://aps.autodesk.com/en/docs/oauth/v2/developers_guide/error_handling/
Source: chromecache_372.2.dr, chromecache_377.2.dr	String found in binary or memory: https://developer.api.autodesk.com//dm/v2/shared-link-token
Source: chromecache_381.2.dr, chromecache_366.2.dr, chromecache_412.2.dr, chromecache_382.2.dr	String found in binary or memory: https://github.com/zloirock/core-js
Source: chromecache_366.2.dr, chromecache_412.2.dr	String found in binary or memory: https://github.com/zloirock/core-js/blob/v3.27.1/LICENSE
Source: chromecache_381.2.dr, chromecache_382.2.dr	String found in binary or memory: https://github.com/zloirock/core-js/blob/v3.27.2/LICENSE
Source: chromecache_402.2.dr, chromecache_385.2.dr	String found in binary or memory: https://help.autodesk.com/view/BIM360D/FRC/
Source: chromecache_402.2.dr, chromecache_385.2.dr	String found in binary or memory: https://help.autodesk.com/view/RVT/2020/CHS/
Source: chromecache_402.2.dr, chromecache_385.2.dr	String found in binary or memory: https://help.autodesk.com/view/RVT/2020/DEU/
Source: chromecache_385.2.dr	String found in binary or memory: https://help.autodesk.com/view/RVT/2020/ENU/
Source: chromecache_402.2.dr, chromecache_385.2.dr	String found in binary or memory: https://help.autodesk.com/view/RVT/2020/ESP/
Source: chromecache_385.2.dr	String found in binary or memory: https://help.autodesk.com/view/RVT/2020/FRA/
Source: chromecache_402.2.dr, chromecache_385.2.dr	String found in binary or memory: https://help.autodesk.com/view/RVT/2020/JPN/
Source: chromecache_402.2.dr, chromecache_385.2.dr	String found in binary or memory: https://help.autodesk.com/view/RVT/2020/PTB/
Source: chromecache_401.2.dr	String found in binary or memory: https://knowledge.autodesk.com/contact-support/using-my-product/troubleshooting?p=BIM%20360&l=BIM360
Source: chromecache_401.2.dr	String found in binary or memory: https://knowledge.autodesk.com/de/contact-support/using-my-product/troubleshooting?p=BIM%20360&l=BIM
Source: chromecache_401.2.dr	String found in binary or memory: https://knowledge.autodesk.com/es/contact-support/using-my-product/troubleshooting?p=BIM%20360&l=BIM
Source: chromecache_401.2.dr	String found in binary or memory: https://knowledge.autodesk.com/fr/contact-support/using-my-product/troubleshooting?p=BIM%20360&l=BIM
Source: chromecache_401.2.dr	String found in binary or memory: https://knowledge.autodesk.com/ja/contact-support/using-my-product/troubleshooting?p=BIM%20360&l=BIM
Source: chromecache_401.2.dr	String found in binary or memory: https://knowledge.autodesk.com/pt-br/contact-support/using-my-product/troubleshooting?p=BIM%20360&l=
Source: chromecache_401.2.dr	String found in binary or memory: https://knowledge.autodesk.com/ru/contact-support?startHelpBranch=post-purchase/using-software&p=BIM
Source: chromecache_401.2.dr	String found in binary or memory: https://knowledge.autodesk.com/zh-hans/contact-support/using-my-product/troubleshooting?p=BIM%20360&
Source: 7za.exe, 00000008.00000003.1969914958.00000000014F0000.00000004.00000800.00020000.00000000.sdmp, Submission Proposal.pdf.8.dr	String found in binary or memory: https://rdi5cditblgwvqdacqlhomd2xnwm7evojwwetg5vpgo5rnk4btoq.ar-io.dev/iNHRDRMKzWrAYBQWdzB6u2zPkq5Nr
Source: chromecache_372.2.dr, chromecache_377.2.dr	String found in binary or memory: https://share.docs.b360.autodesk.com
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-br
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-de
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-es
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-fr
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-it
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-jp
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-kr
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-nl
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-ru
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-zh-hans
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-zh-hant
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/terms-of-use/br/general-terms
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/terms-of-use/cn/general-terms
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/terms-of-use/de/general-terms
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/terms-of-use/en/general-terms
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/terms-of-use/es/general-terms
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/terms-of-use/fr/general-terms
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/terms-of-use/it/general-terms
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/terms-of-use/jp/general-terms
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/terms-of-use/nl/general-terms
Source: chromecache_401.2.dr	String found in binary or memory: https://www.autodesk.com/company/terms-of-use/ru/general-terms

System Summary

Downloads suspicious files via Chrome

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File dump: C:\Users\user\Downloads\Submission Proposal.pdf.zip (copy)

Jump to dropped file

Source: classification engine

Classification label: mal48.win@73/131@0/16

Source: Submission Proposal.pdf.8.dr	Initial sample: https://rdi5cditblgwvqdacqlhomd2xnwm7evojwwetg5vpgo5rnk4btoq.ar-io.dev/inhrdrmkzwraybqwdzb6u2zpkq5nrembtxmd2lvcdn0
Source: Submission Proposal.pdf.8.dr	Initial sample: https://rdi5cditblgwvqdacqlhomd2xnwm7evojwwetg5vpgo5rnk4btoq.ar-io.dev/iNHRDRMKzWrAYBQWdzB6u2zPkq5NrEmbtXmd2LVcDN0

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\73005f67-d117-4314-8100-656bbec3fa42.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5264:120:WilError_03

Source: C:\Windows\SysWOW64\unarchiver.exe

File created: C:\Users\user\AppData\Local\Temp\unarchiver.log

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1984,i,17366287729370669979,6165770494908461818,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://u1931584.ct.sendgrid.net/ls/click?upn=u001.0E02-2FzIG11vXmfBwdT167PQOcAxKKwdHOFrr9Q707zuCmae7OGpEH0sjgTwVKZOKGOIXhaZab42uYJDjXq-2BvDmBrB-2BitjeHEOm417wfwEN5DyKmWjx8GiK0vS0qP2-2FkZEXzCjOD1ATi51VFipfhQLxfE8-2FFtDYLE86HSpQBMyyH0F22Zm-2FfU1z5fJcYtwUM-2FxFJS_p4A4YQt8epDIK9HlKea9sedvYl6q0W66qnzBrcHOUCWErG8eYzfGVOB9NWJFyY4eLd2APu7Ps5E6ldV9YAcohj-2Fi086o8cWXXfFLnAGl6fjIOJQY5-2FQ-2F0-2BiCUTBMFYjbe292XkQmYU7w5w0oMitE-2Fn5R5dV1nHfTciU6eLmPx0ie-2BBr7HxuQc0d5wlQhWiwGZYXHSECUpMfsZuL3vCwzBA-3D-3D"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Submission Proposal.pdf.zip"
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\gxrvoq3c.c3c" "C:\Users\user\Downloads\Submission Proposal.pdf.zip"
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\gxrvoq3c.c3c\Submission Proposal.pdf"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\gxrvoq3c.c3c\Submission Proposal.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2068 --field-trial-handle=1580,i,8949217225099387246,9342843988186091837,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://rdi5cditblgwvqdacqlhomd2xnwm7evojwwetg5vpgo5rnk4btoq.ar-io.dev/iNHRDRMKzWrAYBQWdzB6u2zPkq5NrEmbtXmd2LVcDN0"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=2056,i,9991034077987844039,10875721668343843587,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1984,i,17366287729370669979,6165770494908461818,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Submission Proposal.pdf.zip"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\gxrvoq3c.c3c" "C:\Users\user\Downloads\Submission Proposal.pdf.zip"	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\gxrvoq3c.c3c\Submission Proposal.pdf"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\gxrvoq3c.c3c\Submission Proposal.pdf"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2068 --field-trial-handle=1580,i,8949217225099387246,9342843988186091837,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=2056,i,9991034077987844039,10875721668343843587,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	Section loaded: 7z.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\crash_reporter.cfg

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: https://docs.b360.autodesk.com/shares/71eed6cd-6f17-43e1-9baf-76250ffcdf51/recipients/69a7f40d-d879-4336-899e-8d70b1c53626

LLM: Page contains button: 'Download' Source: '1.2.pages.csv'

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 3060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 3060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 5060000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Window / User API: threadDelayed 598			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Window / User API: threadDelayed 9399			Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 1004	Thread sleep count: 598 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 1004	Thread sleep time: -299000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 1004	Thread sleep count: 9399 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 1004	Thread sleep time: -4699500s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 7_2_011AB1D6 GetSystemInfo,

7_2_011AB1D6

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\gxrvoq3c.c3c" "C:\Users\user\Downloads\Submission Proposal.pdf.zip"	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\gxrvoq3c.c3c\Submission Proposal.pdf"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\gxrvoq3c.c3c\Submission Proposal.pdf"	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Spearphishing Link	Windows Management Instrumentation	1 Browser Extensions	11 Process Injection	1 Masquerading	OS Credential Dumping	2 Virtualization/Sandbox Evasion	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 DLL Side-Loading	2 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Extra Window Memory Injection	1 Disable or Modify Tools	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Name	Malicious	Antivirus Detection	Reputation
https://docs.b360.autodesk.com/shares/71eed6cd-6f17-43e1-9baf-76250ffcdf51/recipients/69a7f40d-d879-4336-899e-8d70b1c53626	true		unknown
https://rdi5cditblgwvqdacqlhomd2xnwm7evojwwetg5vpgo5rnk4btoq.ar-io.dev/iNHRDRMKzWrAYBQWdzB6u2zPkq5NrEmbtXmd2LVcDN0	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.autodesk.com/company/terms-of-use/jp/general-terms	chromecache_401.2.dr	false	unknown
http://help.autodesk.com/view/BIM360D/FRC/	chromecache_401.2.dr	false	unknown
https://knowledge.autodesk.com/ru/contact-support?startHelpBranch=post-purchase/using-software&p=BIM	chromecache_401.2.dr	false	unknown
http://help.autodesk.com/view/BIM360D/ESP/	chromecache_401.2.dr	false	unknown
https://knowledge.autodesk.com/pt-br/contact-support/using-my-product/troubleshooting?p=BIM%20360&l=	chromecache_401.2.dr	false	unknown
https://help.autodesk.com/view/RVT/2020/JPN/	chromecache_402.2.dr, chromecache_385.2.dr	false	unknown
https://help.autodesk.com/view/RVT/2020/CHS/	chromecache_402.2.dr, chromecache_385.2.dr	false	unknown
https://github.com/zloirock/core-js	chromecache_381.2.dr, chromecache_366.2.dr, chromecache_412.2.dr, chromecache_382.2.dr	false	unknown
https://help.autodesk.com/view/RVT/2020/ENU/	chromecache_385.2.dr	false	unknown
http://help.autodesk.com/view/BIM360D/CHT/	chromecache_401.2.dr	false	unknown
https://www.autodesk.com/company/terms-of-use/fr/general-terms	chromecache_401.2.dr	false	unknown
https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-kr	chromecache_401.2.dr	false	unknown
https://aps.autodesk.com/en/docs/oauth/v2/developers_guide/error_handling/	chromecache_390.2.dr	false	unknown
https://knowledge.autodesk.com/fr/contact-support/using-my-product/troubleshooting?p=BIM%20360&l=BIM	chromecache_401.2.dr	false	unknown
https://help.autodesk.com/view/RVT/2020/ESP/	chromecache_402.2.dr, chromecache_385.2.dr	false	unknown
https://www.autodesk.com/company/terms-of-use/br/general-terms	chromecache_401.2.dr	false	unknown
http://help.autodesk.com/view/BIM360D/ITA/	chromecache_401.2.dr	false	unknown
https://www.autodesk.com/company/terms-of-use/ru/general-terms	chromecache_401.2.dr	false	unknown
https://rdi5cditblgwvqdacqlhomd2xnwm7evojwwetg5vpgo5rnk4btoq.ar-io.dev/iNHRDRMKzWrAYBQWdzB6u2zPkq5Nr	7za.exe, 00000008.00000003.1969914958.00000000014F0000.00000004.00000800.00020000.00000000.sdmp, Submission Proposal.pdf.8.dr	false	unknown
https://www.autodesk.com/company/terms-of-use/cn/general-terms	chromecache_401.2.dr	false	unknown
https://github.com/zloirock/core-js/blob/v3.27.1/LICENSE	chromecache_366.2.dr, chromecache_412.2.dr	false	unknown
https://knowledge.autodesk.com/zh-hans/contact-support/using-my-product/troubleshooting?p=BIM%20360&	chromecache_401.2.dr	false	unknown
https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-zh-hans	chromecache_401.2.dr	false	unknown
https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-ru	chromecache_401.2.dr	false	unknown
https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-nl	chromecache_401.2.dr	false	unknown
https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-zh-hant	chromecache_401.2.dr	false	unknown
http://help.autodesk.com/view/BIM360D/SWE/	chromecache_401.2.dr	false	unknown
http://help.autodesk.com/view/BIM360D/JPN/	chromecache_401.2.dr	false	unknown
https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-fr	chromecache_401.2.dr	false	unknown
http://help.autodesk.com/view/BIM360D/CHS/	chromecache_401.2.dr	false	unknown
https://www.autodesk.com/company/terms-of-use/es/general-terms	chromecache_401.2.dr	false	unknown
https://www.autodesk.com/company/terms-of-use/de/general-terms	chromecache_401.2.dr	false	unknown
https://www.autodesk.com/company/terms-of-use/en/general-terms	chromecache_401.2.dr	false	unknown
http://help.autodesk.com/view/BIM360D/DAN/	chromecache_401.2.dr	false	unknown
https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-jp	chromecache_401.2.dr	false	unknown
https://developer.api.autodesk.com//dm/v2/shared-link-token	chromecache_372.2.dr, chromecache_377.2.dr	false	unknown
https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement	chromecache_401.2.dr	false	unknown
https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-br	chromecache_401.2.dr	false	unknown
http://help.autodesk.com/view/BIM360D/CSY/	chromecache_401.2.dr	false	unknown
http://help.autodesk.com/view/BIM360D/ENU/	chromecache_401.2.dr	false	unknown
https://help.autodesk.com/view/RVT/2020/PTB/	chromecache_402.2.dr, chromecache_385.2.dr	false	unknown
https://knowledge.autodesk.com/ja/contact-support/using-my-product/troubleshooting?p=BIM%20360&l=BIM	chromecache_401.2.dr	false	unknown
http://help.autodesk.com/view/BIM360D/FRA/	chromecache_401.2.dr	false	unknown
https://knowledge.autodesk.com/es/contact-support/using-my-product/troubleshooting?p=BIM%20360&l=BIM	chromecache_401.2.dr	false	unknown
https://help.autodesk.com/view/BIM360D/FRC/	chromecache_402.2.dr, chromecache_385.2.dr	false	unknown
http://127.0.0.1:3000/p/a/t_(asd)/h?q=abc123#dfdf	chromecache_381.2.dr, chromecache_382.2.dr	false	unknown
https://help.autodesk.com/view/RVT/2020/DEU/	chromecache_402.2.dr, chromecache_385.2.dr	false	unknown
https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-it	chromecache_401.2.dr	false	unknown
http://sub.domain.co.uk:3000	chromecache_381.2.dr, chromecache_382.2.dr	false	unknown
https://www.autodesk.com/company/terms-of-use/it/general-terms	chromecache_401.2.dr	false	unknown
http://help.autodesk.com/view/BIM360D/RUS/	chromecache_401.2.dr	false	unknown
https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-es	chromecache_401.2.dr	false	unknown
https://www.autodesk.com/company/terms-of-use/nl/general-terms	chromecache_401.2.dr	false	unknown
http://help.autodesk.com/view/BIM360D/DEU/	chromecache_401.2.dr	false	unknown
http://help.autodesk.com/view/BIM360D/PTB/	chromecache_401.2.dr	false	unknown
https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement-de	chromecache_401.2.dr	false	unknown
https://knowledge.autodesk.com/de/contact-support/using-my-product/troubleshooting?p=BIM%20360&l=BIM	chromecache_401.2.dr	false	unknown
http://help.autodesk.com/view/BIM360D/NLD/	chromecache_401.2.dr	false	unknown
https://share.docs.b360.autodesk.com	chromecache_372.2.dr, chromecache_377.2.dr	false	unknown
https://github.com/zloirock/core-js/blob/v3.27.2/LICENSE	chromecache_381.2.dr, chromecache_382.2.dr	false	unknown
https://help.autodesk.com/view/RVT/2020/FRA/	chromecache_385.2.dr	false	unknown
http://help.autodesk.com/view/BIM360D/NOR/	chromecache_401.2.dr	false	unknown
https://knowledge.autodesk.com/contact-support/using-my-product/troubleshooting?p=BIM%20360&l=BIM360	chromecache_401.2.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.32.121.68	unknown	United States	16509	AMAZON-02US	false
18.245.46.84	unknown	United States	16509	AMAZON-02US	false
167.89.118.126	unknown	United States	11377	SENDGRIDUS	false
162.247.243.39	unknown	United States	13335	CLOUDFLARENETUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.185.132	unknown	United States	15169	GOOGLEUS	false
13.32.121.62	unknown	United States	16509	AMAZON-02US	false
216.58.206.68	unknown	United States	15169	GOOGLEUS	false
54.85.147.116	unknown	United States	14618	AMAZON-AESUS	false
76.223.31.44	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.32.121.38	unknown	United States	16509	AMAZON-02US	false
162.247.243.29	unknown	United States	13335	CLOUDFLARENETUS	false
34.160.78.217	unknown	United States	2686	ATGS-MMD-ASUS	false
104.126.112.182	unknown	United States	16625	AKAMAI-ASUS	false
65.9.66.7	unknown	United States	16509	AMAZON-02US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538996
Start date and time:	2024-10-22 01:07:55 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://u1931584.ct.sendgrid.net/ls/click?upn=u001.0E02-2FzIG11vXmfBwdT167PQOcAxKKwdHOFrr9Q707zuCmae7OGpEH0sjgTwVKZOKGOIXhaZab42uYJDjXq-2BvDmBrB-2BitjeHEOm417wfwEN5DyKmWjx8GiK0vS0qP2-2FkZEXzCjOD1ATi51VFipfhQLxfE8-2FFtDYLE86HSpQBMyyH0F22Zm-2FfU1z5fJcYtwUM-2FxFJS_p4A4YQt8epDIK9HlKea9sedvYl6q0W66qnzBrcHOUCWErG8eYzfGVOB9NWJFyY4eLd2APu7Ps5E6ldV9YAcohj-2Fi086o8cWXXfFLnAGl6fjIOJQY5-2FQ-2F0-2BiCUTBMFYjbe292XkQmYU7w5w0oMitE-2Fn5R5dV1nHfTciU6eLmPx0ie-2BBr7HxuQc0d5wlQhWiwGZYXHSECUpMfsZuL3vCwzBA-3D-3D
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@73/131@0/16
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 44 Number of non-executed functions: 0
Cookbook Comments:	Found PDF document Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.5.84, 216.58.212.163, 142.250.184.238, 34.104.35.123, 151.101.2.217, 151.101.66.217, 151.101.194.217, 151.101.130.217, 217.20.57.18, 184.28.88.176, 18.207.85.246, 54.144.73.197, 34.193.227.236, 107.22.247.231, 2.19.126.143, 2.19.126.149, 172.64.41.3, 162.159.61.3, 2.23.197.184, 199.232.214.172, 192.229.221.95, 216.58.206.67, 23.40.179.192, 23.40.179.206, 192.168.2.4, 172.217.16.195, 64.233.184.84, 142.250.186.35, 216.58.206.42, 142.250.185.170, 142.250.186.138, 172.217.23.106, 172.217.18.106, 142.250.186.74, 142.250.186.106, 142.250.184.202, 142.250.185.106, 172.217.18.10, 172.217.16.138, 216.58.206.74, 142.250.186.42, 142.250.185.138, 142.250.186.170, 172.217.16.202, 142.250.184.234, 142.250.181.234, 216.58.212.138, 142.250.185.234, 142.250.185.202, 142.250.74.202, 142.250.185.74, 142.250.181.227, 142.250.185.110, 52.182.143.210
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, chromewebstore.googleapis.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, clientservices.googleapis.com, acroipm2.adobe.com, clients2.google.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, update.googleapis.com, c3.shared.global.fastly.net, wu-b-net.trafficmanager.net, onedscolprdcus10.centralus.cloudapp.azure.com, crl.root-x1.letsencrypt.org.edgekey.net, optimizationguide-pa.googleapis.com, clients1.google.com, self-events-data.trafficmanager.net, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, clients.l.google.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://u1931584.ct.sendgrid.net/ls/click?upn=u001.0E02-2FzIG11vXmfBwdT167PQOcAxKKwdHOFrr9Q707zuCmae7OGpEH0sjgTwVKZOKGOIXhaZab42uYJDjXq-2BvDmBrB-2BitjeHEOm417wfwEN5DyKmWjx8GiK0vS0qP2-2FkZEXzCjOD1ATi51VFipfhQLxfE8-2FFtDYLE86HSpQBMyyH0F22Zm-2FfU1z5fJcYtwUM-2FxFJS_p4A4YQt8epDIK9HlKea9sedvYl6q0W66qnzBrcHOUCWErG8eYzfGVOB9NWJFyY4eLd2APu7Ps5E6ldV9YAcohj-2Fi086o8cWXXfFLnAGl6fjIOJQY5-2FQ-2F0-2BiCUTBMFYjbe292XkQmYU7w5w0oMitE-2Fn5R5dV1nHfTciU6eLmPx0ie-2BBr7HxuQc0d5wlQhWiwGZYXHSECUpMfsZuL3vCwzBA-3D-3D

Simulations

Behavior and APIs

Time	Type	Description
19:09:30	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
19:09:48	API Interceptor	2171436x Sleep call for process: unarchiver.exe modified

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.189338625699938
Encrypted:	false
SSDEEP:	6:AM+q2Pwkn2nKuAl9OmbnIFUt8XZZmw+EvqMVkwOwkn2nKuAl9OmbjLJ:p+vYfHAahFUt8J/+AV5JfHAaSJ
MD5:	F501C338DED39748A606C7321B67D31A
SHA1:	F96B5CFCA53DE3EBF8E2AD87A6192B91A426093F
SHA-256:	D2E1249EE3A3B7EAB9097D9ADCD397E72B3FC8F4C4ED7923CDFD9D1FEB5D9626
SHA-512:	6B61957F48EF9F5DC2D2EF7D6678052498BCE21A9B1C8E20AB1F3B9FE26C9DC0537ADEEE126A1E3A3BA38FD6AE08962BAC2EB1F414CC3AE4172561874E6BD66B
Malicious:	false
Reputation:	low
Preview:	2024/10/21-19:09:17.232 18ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/21-19:09:17.233 18ac Recovering log #3.2024/10/21-19:09:17.234 18ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.189338625699938
Encrypted:	false
SSDEEP:	6:AM+q2Pwkn2nKuAl9OmbnIFUt8XZZmw+EvqMVkwOwkn2nKuAl9OmbjLJ:p+vYfHAahFUt8J/+AV5JfHAaSJ
MD5:	F501C338DED39748A606C7321B67D31A
SHA1:	F96B5CFCA53DE3EBF8E2AD87A6192B91A426093F
SHA-256:	D2E1249EE3A3B7EAB9097D9ADCD397E72B3FC8F4C4ED7923CDFD9D1FEB5D9626
SHA-512:	6B61957F48EF9F5DC2D2EF7D6678052498BCE21A9B1C8E20AB1F3B9FE26C9DC0537ADEEE126A1E3A3BA38FD6AE08962BAC2EB1F414CC3AE4172561874E6BD66B
Malicious:	false
Reputation:	low
Preview:	2024/10/21-19:09:17.232 18ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/21-19:09:17.233 18ac Recovering log #3.2024/10/21-19:09:17.234 18ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.208651810798447
Encrypted:	false
SSDEEP:	6:BlV+q2Pwkn2nKuAl9Ombzo2jMGIFUt82XudQGFmWZmw+2XudQGFNVkwOwkn2nKuA:Bj+vYfHAa8uFUt82+dJmW/+2+dJNV5JI
MD5:	F3A5EC7FA765A2C52C24A4059F105463
SHA1:	62A4E5FC702E9297F9588F62FF9A5D46953953CD
SHA-256:	330F7C43BD84FDDD2FCD56412C4EF9A38FB76091757B0E0912C880DA91D104EA
SHA-512:	60E3A41D7C7FD655645CE28FD0F6B858E50E9656D5CA0E3F9E07076D32CF05B58EEAF80808E92CB0B8B0166DEC50846047866104164522FC4CD2CD6209042FBC
Malicious:	false
Reputation:	low
Preview:	2024/10/21-19:09:17.261 185c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/21-19:09:17.262 185c Recovering log #3.2024/10/21-19:09:17.262 185c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.208651810798447
Encrypted:	false
SSDEEP:	6:BlV+q2Pwkn2nKuAl9Ombzo2jMGIFUt82XudQGFmWZmw+2XudQGFNVkwOwkn2nKuA:Bj+vYfHAa8uFUt82+dJmW/+2+dJNV5JI
MD5:	F3A5EC7FA765A2C52C24A4059F105463
SHA1:	62A4E5FC702E9297F9588F62FF9A5D46953953CD
SHA-256:	330F7C43BD84FDDD2FCD56412C4EF9A38FB76091757B0E0912C880DA91D104EA
SHA-512:	60E3A41D7C7FD655645CE28FD0F6B858E50E9656D5CA0E3F9E07076D32CF05B58EEAF80808E92CB0B8B0166DEC50846047866104164522FC4CD2CD6209042FBC
Malicious:	false
Reputation:	low
Preview:	2024/10/21-19:09:17.261 185c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/21-19:09:17.262 185c Recovering log #3.2024/10/21-19:09:17.262 185c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.962636147346127
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZ4hsBdOg2HQcaq3QYiubInP7E4T3y:Y2sRdsObdMHb3QYhbG7nby
MD5:	36D03BE1810563413A98C7FC701157D9
SHA1:	5034811A3D2FAF16714A705DCDD2FBDA642647AE
SHA-256:	E305E63A79EBE6A2DF18863B75BA67694159BD406854B3C61A7148B9351BC84C
SHA-512:	375CB8B6D63040627F189667A6C4C75A995A732ECBB9285628F38BD67005C6B92BD9D9AB7008C78329BC08F0FC5880ED1B0BE6ECF128F0E1B1FC35F790955226
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374112169892694","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":101130},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c9126686-f8c2-4a9d-8061-46a77609076d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.962636147346127
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZ4hsBdOg2HQcaq3QYiubInP7E4T3y:Y2sRdsObdMHb3QYhbG7nby
MD5:	36D03BE1810563413A98C7FC701157D9
SHA1:	5034811A3D2FAF16714A705DCDD2FBDA642647AE
SHA-256:	E305E63A79EBE6A2DF18863B75BA67694159BD406854B3C61A7148B9351BC84C
SHA-512:	375CB8B6D63040627F189667A6C4C75A995A732ECBB9285628F38BD67005C6B92BD9D9AB7008C78329BC08F0FC5880ED1B0BE6ECF128F0E1B1FC35F790955226
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374112169892694","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":101130},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4730
Entropy (8bit):	5.258927498723048
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7XxddPddzZ:etJCV4FiN/jTN/2r8Mta02fEhgO73goz
MD5:	E38D56E7ACD7BE9E4420FCAB18A9991B
SHA1:	E1E2B966EE8D2F10C9A7B09FFC70AC467D0D1EF7
SHA-256:	A0981DFBEB1B250FC395CA8DABB5D749483A22B012D43F103DFDD581910F6545
SHA-512:	F2BD0B727FBE568E19BC4A491DFA2134E78670CBDEE9A129CCEB26D5C846FD7F48988BE5BEF38ACAB0F6A935BCAE2C525E7518C4A0C05166A26923D77DC67C87
Malicious:	false
Reputation:	low
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.242280152522226
Encrypted:	false
SSDEEP:	6:nJ0+q2Pwkn2nKuAl9OmbzNMxIFUt8EzmWZmw+EHY3VkwOwkn2nKuAl9OmbzNMFLJ:S+vYfHAa8jFUt8PW/+8Y3V5JfHAa84J
MD5:	4176063593D8228EEADFFF93E29CCCEB
SHA1:	BA636DEAB59EAB820B6BA59A92499DF4490278C7
SHA-256:	A44215323B32485CF2C226938460890FBA0459CFEA6C7BE6DE42C9010495BF04
SHA-512:	B1B1F5F2149E81329DCD50B4D599C9DFC77ABD7C29D88CE1944F4773F9C3C4C93F9DF0F96694B0E20EDDB3932D51756B5092D6D3BCACDAAEBAEE8CB3BE2230C2
Malicious:	false
Reputation:	low
Preview:	2024/10/21-19:09:17.466 185c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/21-19:09:17.467 185c Recovering log #3.2024/10/21-19:09:17.468 185c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.242280152522226
Encrypted:	false
SSDEEP:	6:nJ0+q2Pwkn2nKuAl9OmbzNMxIFUt8EzmWZmw+EHY3VkwOwkn2nKuAl9OmbzNMFLJ:S+vYfHAa8jFUt8PW/+8Y3V5JfHAa84J
MD5:	4176063593D8228EEADFFF93E29CCCEB
SHA1:	BA636DEAB59EAB820B6BA59A92499DF4490278C7
SHA-256:	A44215323B32485CF2C226938460890FBA0459CFEA6C7BE6DE42C9010495BF04
SHA-512:	B1B1F5F2149E81329DCD50B4D599C9DFC77ABD7C29D88CE1944F4773F9C3C4C93F9DF0F96694B0E20EDDB3932D51756B5092D6D3BCACDAAEBAEE8CB3BE2230C2
Malicious:	false
Reputation:	low
Preview:	2024/10/21-19:09:17.466 185c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/21-19:09:17.467 185c Recovering log #3.2024/10/21-19:09:17.468 185c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444933508522821
Encrypted:	false
SSDEEP:	384:SeRci5toiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:lPs3OazzU89UTTgUL
MD5:	A7010A252CD578B7674AD4D2EE401BC2
SHA1:	1C252AED27244B8FA6D16327E153877E071412D8
SHA-256:	7711A601C0C4DF47F95C6054DFE9EE3AF8AC701D36493483CBCE91C532F9597A
SHA-512:	89149AFCD325FD73A0D1AFA3ABE696C38B85778D788E7C9A3A6E3DFAF844979B8D8A08A55183B837A87AD3BB4EF91E04AAA1E470275C3451E4C8C293C6D9EDAE
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2122014567321275
Encrypted:	false
SSDEEP:	24:7+trznuwKoRqLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9s:7MHnCgqvmFTIF3XmHjBoGGR+jMz+Lhm
MD5:	3DC9FCF9CF6EAC6FFE6A03AA2A0E59AC
SHA1:	658F9D482890B918B9D28CD53CD9A97A68D5AB98
SHA-256:	164AC482FAAD6C8802A4A53339D8D784C8B62D6F6A697E05F42903426CB39BC6
SHA-512:	BF7E15C30477FA83C5ECD85638B8D6B70B8760D3DD903D6A288778F08AF47BB608AAE0601570AE90E50299C8A498F2F4FF2EE1D1D4A604029D7CF5794EE0A676
Malicious:	false
Reputation:	low
Preview:	.... .c.....sB..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Reputation:	low
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	low
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7673182398396405
Encrypted:	false
SSDEEP:	3:kkFklCqNvfllXlE/HT8k8elrtNNX8RolJuRdxLlGB9lQRYwpDdt:kKb2QT8Ul3NMa8RdWBwRd
MD5:	CEF4A69BECA987D16CB332D7BABFF7B2
SHA1:	055EEB7C86B93DFC41808C4FAE5E1340E239C5E5
SHA-256:	AD3A771B494244274BFE9BC815899D7AF77866DFEB49CFDF29959887353F95CE
SHA-512:	C6006A6E1D88ABBC9B3E94D66173819E2702C3E2E233035BBEDDCE6385F2B4350F2FFAB42D2EF490D650F11607E844578C78999FBAACA34D776A87C0C8255F92
Malicious:	false
Reputation:	low
Preview:	p...... ........q+jH.$..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242104774174968
Encrypted:	false
SSDEEP:	6:kKrd9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:zEDImsLNkPlE99SNxAhUe/3
MD5:	62EE5E8A8E47CC51C34C4221A5ACCF15
SHA1:	E4893EC2ACCD4CF1E3F920338DDBB8EB386149C1
SHA-256:	4C7557CDAAAFE4D8612EA7273132B7CF08FB3FA0100302B82C9036999A91BC2D
SHA-512:	59DB201D779EB4158F32BC94D78AF17D17448990FAE65190D2238E5340184F0801F1A5B6EC98D2F077F0A6C04A7B77A3EED45CB86CB99E71B36A4F1B8E72A278
Malicious:	false
Reputation:	low
Preview:	p...... ........sL.Z.$..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	244540
Entropy (8bit):	3.3415042960460593
Encrypted:	false
SSDEEP:	1536:vKPCPiyzDtrh1cK3XEivK7VK/3AYvYwggErRo+RQn:yPClJ/3AYvYwgrFo+RQn
MD5:	758B42992DDFC41CB5E57069C621B54A
SHA1:	D0C28AF6CF1BD2208DA97DEDE57F6C78CEC98DCD
SHA-256:	55DF75758DD6CA825ED2DC9380EDC8469351191308C34CACFC44205197ABD25D
SHA-512:	437918372167A402005A728DCBBEF7B3A9580B794AD6A948A435C9D57C1672ACC1B7376E2A09113B66600EF5049D23625174256565BC639125A2F2BD07928926
Malicious:	false
Reputation:	low
Preview:	Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.381161201025099
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyIBDg49VoZcg1vRcR0YNXoAvJM3g98kUwPeUkwRe9:YvXKXy34EZc0v84GMbLUkee9
MD5:	A0EF01A2FEDA0F02E0A54AD3626885A1
SHA1:	3A6E4A6EAAB270E99EFFD40EF6ABEEB89E19516D
SHA-256:	811690916763CD91630ABCA73F5CBFCABECCD499A579B4CD3F543909933AE05D
SHA-512:	A286433E8D4A6045A8DCC61787635DCEFE2DD3855FDBD853F55ECE1EFEA144C9277E87AE3930616D05B2F89413498977D80A29717068FECA9D526B5709E8A08C
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"72d7325b-39f4-4a47-8315-b77d97064f34","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729731832988,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.333903918478569
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyIBDg49VoZcg1vRcR0YNXoAvJfBoTfXpnrPeUkwRe9:YvXKXy34EZc0v84GWTfXcUkee9
MD5:	2FF79474C8CE825FFC164E53FCF5B5C4
SHA1:	EFDC1C5B3D2DF05F60F2EA9C13ACC7AF040D5AF9
SHA-256:	3941A0EAAEED46CAE5B7E08D74A5211EC89A52356564AEE39D83CB4EB0CE1D88
SHA-512:	1131F4BB8E641F740BDEDFBD689F84E40D9707CED4DCB5ED3D0FA83AA59DCF0919C9C923665C880596BFC7A380E27F93F5649B169D67D481079E3BDACC497E73
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"72d7325b-39f4-4a47-8315-b77d97064f34","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729731832988,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.312794771089326
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyIBDg49VoZcg1vRcR0YNXoAvJfBD2G6UpnrPeUkwRe9:YvXKXy34EZc0v84GR22cUkee9
MD5:	E2AEB8994314F50CA7BD40BBF7436D34
SHA1:	6008798E451CAECD2FDBAB674C1BDE44D2DF597D
SHA-256:	B2A94F946609C52E4D4ACC3DC4A5E499E531C96B121C429453F234FAACDD63AD
SHA-512:	62BF693B1130A0EDEFA81F9A8858FEDA357E93C36C878E2BEF3C1C968FE58807AE3A4B4CB4A122E4FE90F71AA6D8E5F0E1A971C66DC6B383FB3E1EDB44D4DFA5
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"72d7325b-39f4-4a47-8315-b77d97064f34","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729731832988,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.368796191946853
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyIBDg49VoZcg1vRcR0YNXoAvJfPmwrPeUkwRe9:YvXKXy34EZc0v84GH56Ukee9
MD5:	318FE5002FE156FE8B68A3A79CE41F67
SHA1:	8472F6C4A7A6F8E3F59AB41477BCD42BF04B0E29
SHA-256:	820A23FBC4782882988E7BDB0006F747DDE620B41C17F5298C38774967057138
SHA-512:	81A8EFAFF81D95AE0F0E856784D616679CEA2497F810DECA5C980EFD8A5E5487DDA2D81AAEB3E11BED7F8AD59F532563345332C12A0D45E2883DEE4832E6FE99
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"72d7325b-39f4-4a47-8315-b77d97064f34","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729731832988,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1055
Entropy (8bit):	5.668997182087782
Encrypted:	false
SSDEEP:	24:Yv6Xy3Lzv8VpLgEscLf7nnl0RCmK8czOCCSD:YvH3UVhgGzaAh8cv/D
MD5:	2DD9B918C2C9B1AD831041F7AB862A28
SHA1:	3DDA8FD593A1D32E616B9C748B211DDF4455C44A
SHA-256:	53AC85FE483765CC2141ED077ED40CEB00DB0073F1FD7A5856266EE45F0B269D
SHA-512:	C7CA5A7F39E041D1DB61291C81507DEC8DD6A2415040B3B8C1A7EB4D2AF837FFF374D57356176676696FD97C3312227C95BCA4DDAA28BA0F88198EC0F0018617
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"72d7325b-39f4-4a47-8315-b77d97064f34","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729731832988,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"92038_285529ActionBlock_1","campaignId":92038,"containerId":"1","controlGroupId":"","treatmentId":"eb1a4bce-8215-46f1-b44c-154b21a85d60","variationId":"285529"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNhdElkIjpudWxsfQ==","dataType":"application\/json","encodingScheme":tr

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.660909670507695
Encrypted:	false
SSDEEP:	24:Yv6Xy3Lzv85VLgEF0c7sbnl0RCmK8czOCYHflEpwiVu:YvH3U5Fg6sGAh8cvYHWpwD
MD5:	037E816A2E7DB390A971F1E0526C07DC
SHA1:	7E4D0C7F3F3FBA9AF4171AD8CEA6BF899DB045B8
SHA-256:	9393427C9E3708A553FE52D3FA5C03265F63EB2558C1E42A4064CDBA75BE4458
SHA-512:	790AFF4ED903E4FF15ACB28FFFDB0FC218B174C90758813121431883162154291ED2F1BB4268C9A9107A697D08C071E3D3D9898BB60B33BA681D7844CD399974
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"72d7325b-39f4-4a47-8315-b77d97064f34","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729731832988,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.322071955300091
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyIBDg49VoZcg1vRcR0YNXoAvJfQ1rPeUkwRe9:YvXKXy34EZc0v84GY16Ukee9
MD5:	4253697142DA64F6DC462E623287D28F
SHA1:	6B0FC3D033F8B70B2D954E52B5F079F75ED71492
SHA-256:	AB43F400431BE5CDB423C99053B34E91A4882142773CEDBB3B79D93BA1DC5A67
SHA-512:	435777CD15E6D0510B3B0031D72EC36147DDCFB7B58835B30EEED0F27897A04A486EE5C75414791DF18FFD371E76D68D8C4AB3DF54F773F9B6F22DA59E35C364
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"72d7325b-39f4-4a47-8315-b77d97064f34","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729731832988,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1038
Entropy (8bit):	5.654175636569614
Encrypted:	false
SSDEEP:	24:Yv6Xy3Lzv8o2LgEF7cciAXs0nl0RCmK8czOCAPtciBu:YvH3Uoogc8hAh8cvAs
MD5:	9A7BC8F87E1D32BE6873A12F7C829DE3
SHA1:	DFD738C21234F9D9C5F9483AFD7916EB6AFB82BD
SHA-256:	EEB8D321CF117DD76ED946EF77061E09AEC999041B0D05FF7796D80D654ED852
SHA-512:	3466363454BC551AB903791A16E927D4BE049855D9BFA3D12B5F73CA27B6E9A83A3936C7BC032C979F56B37F482664D5671D2EC7CFF19D454C820430585DC7D8
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"72d7325b-39f4-4a47-8315-b77d97064f34","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729731832988,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_1","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"49d2f713-7aa9-44db-aa50-0a7a22add459","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVkaXQgdGV4dCwgaW1hZ2VzLCBwYWdlcywgYW5kIG1vcmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1744

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	5.706399534628608
Encrypted:	false
SSDEEP:	24:Yv6Xy3Lzv8gKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5u:YvH3UgEgqprtrS5OZjSlwTmAfSKQ
MD5:	9FB32D08F398802DCA199A95593B69EE
SHA1:	66A297F0912A1E799F34D1D51205AB3C6B30A54F
SHA-256:	BE822D17AF2C845F63C207E372DA1CFAFA0C5ADA2BDD39ABC6095B7C8236E9B1
SHA-512:	3E18B008330649D9559C9841B1BFC4848163D582BD7D9DD29A82212BB687A904D99C5716AF6C07264944DED7CF36B7CE671C8B693E0A7F95EBDC2298C5D2EC36
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"72d7325b-39f4-4a47-8315-b77d97064f34","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729731832988,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.323906981003794
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyIBDg49VoZcg1vRcR0YNXoAvJfYdPeUkwRe9:YvXKXy34EZc0v84Gg8Ukee9
MD5:	7278111A770666ECB33AE82D2F078FD1
SHA1:	0B532EC921B9EE1C2ECBB3AF562EA64FD979C9A8
SHA-256:	2D83818B40B58DFF3D33D7BA40702A724B353839242B57D924E8D513B259C281
SHA-512:	4E72D918FFE8C439ED96CC0B79E9869B2B82C65852C796456FDC2C5F3479A05B4CA7FC36F5E76555CFAA942A1F4B16773C45F8DD0DF7A08CBA51A5453850C556
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"72d7325b-39f4-4a47-8315-b77d97064f34","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729731832988,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	5.780633166334242
Encrypted:	false
SSDEEP:	24:Yv6Xy3Lzv8vrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNW:YvH3UvHgDv3W2aYQfgB5OUupHrQ9FJQ
MD5:	8821EA1D9F8783C2DE3BE5C51C6FB8FA
SHA1:	76F63E99C9BFCF0CF525D9B209FE41BFE77E817C
SHA-256:	34A133756F835065314A336BB01990F36A1056C7BD33A2620D9AC57FEFCD4894
SHA-512:	F07230D4C011C0FF93FE48F6C928A8D21889429B83EDE217F1A29F27D6608C1B0D557FCC604F6F56566C7176ADF3CEF190178D1319F00EA9D477912076EB24F4
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"72d7325b-39f4-4a47-8315-b77d97064f34","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729731832988,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.307289769529865
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyIBDg49VoZcg1vRcR0YNXoAvJfbPtdPeUkwRe9:YvXKXy34EZc0v84GDV8Ukee9
MD5:	A8615DFD46DED76D8CFD4CA258C118FE
SHA1:	9656303D506AE01C0DCC2A416D2D65F3D3E6E7AD
SHA-256:	2255F5BDB5325FF3DFDB4747CCE6737E7BE3279F804BF0C2B882517667687167
SHA-512:	CDE51A25064CA341DF12AA8D186801C96ED584EC50B71EB141C847F9A17265C18FDD74D84AB9E15C4105A1D2045BE0BE3322EB591CD447ED000F3BDF5C6D7625
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"72d7325b-39f4-4a47-8315-b77d97064f34","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729731832988,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.311957749873548
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyIBDg49VoZcg1vRcR0YNXoAvJf21rPeUkwRe9:YvXKXy34EZc0v84G+16Ukee9
MD5:	9860C170A81F3BD6BF30B24F672169C1
SHA1:	BD591009829428C18E762D6E799CD5C2D3B995E3
SHA-256:	61073C01E700FDDF0042F83B3187141B2C7742584251FEFF1983C5FC547B3C84
SHA-512:	3F1238BBF441AC9455B45D350C3B239E82BF6FFDE4734FCA5AA0348C08994558107418606619F2ED134E07DCBB2A36F804E8251F336C1160BF76BCB8E69C091B
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"72d7325b-39f4-4a47-8315-b77d97064f34","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729731832988,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	5.640454746220933
Encrypted:	false
SSDEEP:	24:Yv6Xy3Lzv8NamXayLgE7cMCBNaqnl0RCmK8czOC/BSD:YvH3UhBgACBOAh8cvMD
MD5:	1E67B14949938E2F0992BDD790229404
SHA1:	644A305481205903FE461B2DE981A415234E4EA9
SHA-256:	DF09BA7E247A33AE0E35E5998497CA03257531490C04EC8C3B8EF77C29C79C93
SHA-512:	D1B87564B4B345CFABBBEB869FBE70DBD23031B6A5C3EC63AC0CA6E09220D1414FAB37D318FA49B3CB4498146D03E7AB5732E8F2F57F37E23A40F955F0AAB3FD
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"72d7325b-39f4-4a47-8315-b77d97064f34","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729731832988,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"92038_285529ActionBlock_0","campaignId":92038,"containerId":"1","controlGroupId":"","treatmentId":"6291f52b-6cb0-4d31-bc46-37ce85e9eb25","variationId":"285529"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1751323379000,"s

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.287385269896428
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyIBDg49VoZcg1vRcR0YNXoAvJfshHHrPeUkwRe9:YvXKXy34EZc0v84GUUUkee9
MD5:	4FF9F114B90AE369FA8F91AF6610381A
SHA1:	2D30313754FAEEB4D0545DB04E8ABB38AE6AF69E
SHA-256:	F57ADB106AE4B7693636860B477DC08021DAB6A3AA45D6B0D6DAD9B0A1D12AD0
SHA-512:	CF012436C14DF25E59C4621EE02EB5AC69C53B08185CB3ED80AE84345C517A248616F329E18995487109CC5482885694663E6CA0A79B2AEC9D5572D333A7C942
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"72d7325b-39f4-4a47-8315-b77d97064f34","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729731832988,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.378989064114684
Encrypted:	false
SSDEEP:	12:YvXKXy34EZc0v84GTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWy:Yv6Xy3Lzv8e168CgEXX5kcIfANhD
MD5:	D5021E35AAA0C5E16A2184C9D161F0CD
SHA1:	14BC9261569B73FB85CC6ADA95A922290F64FA46
SHA-256:	9C6665B940C9ADCC6A441D2978E2BB9BF92BA55B59415FDD7CC4EB7F99EAF5A6
SHA-512:	E5138895FD1AB41AF4292B0E2B7ABAFA0DEB940D99800EBF4304942A8E35963C94B4EB83AE65B606939E75F021A2C75FD9FB6446A20DF84D55A1CA56876F657A
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"72d7325b-39f4-4a47-8315-b77d97064f34","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1729731832988,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1729552163019}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Reputation:	low
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2818
Entropy (8bit):	5.128786579507928
Encrypted:	false
SSDEEP:	48:Yl0BPvLAqdiXS17rV+6aTX+y412z9NIIb:rBPkGiXS1rV+bRjaq
MD5:	9BBDF9BFCFFF99C2733BD19EAA97CFFC
SHA1:	DDB82352F5ACBC4C66C13E0652DA61AF7E6475F2
SHA-256:	6C1A7DA2612843A4D8B5D47EDD59B09D67F28E0BA7BF0A5D5D81858B37176992
SHA-512:	2C3201E8C6585B719A76E21C368E681B67A4EA37691EBC1CDBEB8A777A61EBAD7DECAA5B421F711AB7B13254808F1DCFCBD658B68BC041D84F10C49865BF976D
Malicious:	false
Reputation:	low
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"cd3263aa0d84f9408d6e1b95fcba21d0","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1729552162000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"4cfce4bce577f8c8a02d25c8a5121b15","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1729552162000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"de60eb1c92e55fd770157e0b1e200c0a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1026,"ts":1729552162000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"6b60de6ee44a50ac53f016730d99c741","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1055,"ts":1729552162000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"bb55e5b401160d608b6381ce11865328","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1038,"ts":1729552162000},{"id":"Edit_InApp_Aug2020","info":{"dg":"48ab2a335d574f7c6b523e295139764c","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.188392200728579
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUURTMSvR9H9vxFGiDIAEkGVvpNTy:lNVmswUUUUUUUUJM+FGSItJy
MD5:	8CA89B512537967BE84F13DF7A26F6E5
SHA1:	66DF03B893A1EB57D1C4E0746821E53BDA965A1B
SHA-256:	CDFE58EF14FE3F4BD159247C90F5ED5470B18AC282B1D2BF9D6FD99740870A2A
SHA-512:	40CA899480FA78EEC1E673366E6AFFCB1DB551BC65450EE2A07C247EF95F4213768486B44BCD9D13A913BE40BFA3E40BF1AE434BB62ADC1B0CC2E5EA2D3CE977
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6053589903099774
Encrypted:	false
SSDEEP:	48:7MvKUUUUUUUUUURTevR9H9vxFGiDIAEkGVvnqFl2GL7msg:75UUUUUUUUUUJiFGSItdKVmsg
MD5:	53AABB0D68FCF0D029B3ECB73C9DEFF5
SHA1:	399B08E93D45A49A5D63A9C7BC9B50BBCE94E49F
SHA-256:	5175CA189E9376184AC8A1ED397A62A21DEB5AA5D203640F0013AB8706BD37D3
SHA-512:	806F2CAC9BBEE55DDC03E4581D76F5F7B30CBE5FA12770702F56B3607BFC967444BB861CA055A249799A18492EAE4D8E637E9DE459A8E9E405DAEA5628417953
Malicious:	false
Reputation:	low
Preview:	.... .c.....4.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI519e1.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.501595078528367
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8Pqf5:Qw946cPbiOxDlbYnuRKl
MD5:	5DCD767A5AD9EC0294DC25E2CF86879E
SHA1:	40C2918A9743EF5118EB1F68AB5E8E3BD181EDA3
SHA-256:	12338A54496F73066C2049BDFED1BECCBC5709D0C6C5A81D2A52391F792361E0
SHA-512:	BEDF9220B9DB7A29809896586C66F8043204D2E5BF489347F5D918A3A9F1D53219B3BA2DAA6788E6BAAFEE31B19B4EA2950E183E7D83165E4CE69921FBCE6311
Malicious:	false
Reputation:	low
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.1./.1.0./.2.0.2.4. . .1.9.:.0.9.:.2.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91nkm1bs_172w55e_5bw.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Reputation:	low
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9q9i6f6_172w55l_5bw.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PDF document, version 1.6, 0 pages
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.071506848354838
Encrypted:	false
SSDEEP:	6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOJO+OEuLCSyAAO:IngVMre9T0HQIDmy9g06JX5O+OrLlX
MD5:	4238D4690DEEF75E7C2FD30B422BDBB8
SHA1:	C5C78E82B972C5E1FC88BFF96D5E367D21E138D8
SHA-256:	7DC0B45EF85FDDA63F5A89BA4B53EB52BF36B71241F97DD3412C1410B0CEF5C2
SHA-512:	EF823AE5FD5BBA9A086C73773AAAC7EF78777A1F7DA58429C528B304C26C5CBC404F0BC01FF309C59CD0025CDA2F9C2D579DD34BA32B38DF9BD06CC0AD13134A
Malicious:	false
Reputation:	low
Preview:	%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<5B12DB1836A90B44A7149C396F34A573><5B12DB1836A90B44A7149C396F34A573>]>>..startxref..127..%%EOF..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9zjkomv_172w55j_5bw.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Reputation:	low
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-21 19-09-19-578.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Reputation:	low
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.351600735934314
Encrypted:	false
SSDEEP:	384:D4uNG4nxfyqjMqIbx9pHDWgi27nURtcWOW+WvWzWwW0WWWAWIW2WMW1idbZKod3U:tnjJtLb+Kt5zdlTx+0n/Phd2meF/M
MD5:	DD41FD1B39A2D8E2BD09936FC5436B5D
SHA1:	B8C30F7DCDEB2C06A7A70C9CCADFDB15E0083191
SHA-256:	EFE6C2152E2E8AEF35536166B31EBF79C397679AE41F7CF2879BE7965215ACC8
SHA-512:	8487B1CA397E1C40809A5FA18FC2EE51BD2D8CCE8DF7F3D97299A22106896A16E71C33A211A7D2975BED2F398D0993537E2C1FEB7EF35FCEE7B40B061F3B48E4
Malicious:	false
Reputation:	low
Preview:	SessionID=f1436728-3640-44ab-9650-e05230ce738c.1729552159608 Timestamp=2024-10-21T19:09:19:608-0400 ThreadID=7164 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=f1436728-3640-44ab-9650-e05230ce738c.1729552159608 Timestamp=2024-10-21T19:09:19:626-0400 ThreadID=7164 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=f1436728-3640-44ab-9650-e05230ce738c.1729552159608 Timestamp=2024-10-21T19:09:19:626-0400 ThreadID=7164 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=f1436728-3640-44ab-9650-e05230ce738c.1729552159608 Timestamp=2024-10-21T19:09:19:626-0400 ThreadID=7164 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=f1436728-3640-44ab-9650-e05230ce738c.1729552159608 Timestamp=2024-10-21T19:09:19:626-0400 ThreadID=7164 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.389131453064271
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rX:qNN5qJ85kwCkUpQU5r1I3A
MD5:	5076E5C6F3CF22A9FDE66E536D9C9249
SHA1:	A45BE49305FCC64028CE04FE5438125F03A96D51
SHA-256:	C1AEC4877427560C0088FC09EB639D150619C5796E7CD5D1B1146B4B6798F079
SHA-512:	5A0B5F726C40E4EB0FD7EA5261A73122C344550B0090B68163B62A76521D05D5785BB26282E2F0FAA226B787F1A3CAC084725F2404E53ADCC796E09C8E037720
Malicious:	false
Reputation:	low
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5cad8153-0225-4d95-99e3-feaca8ea2c21.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLcGZtwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLcGZtwZGk3mlind9i4ufFXpAXkru
MD5:	A46246FAEAB95D87F5B4FE236C2B3D3E
SHA1:	7F018DB9238A63FEAD8D11A92297E7366058A75A
SHA-256:	7E822FECC47177C5A7F4C250E7D53509D104DE68B0D0CE9445877B508400988E
SHA-512:	8AAB79958BF39F014FBA7F69287FE0C357746E63FA3482DE3231BDF4A97B964A0815DAF7BFE9751C55BA6BE618E0A964CEB23FC30B4FA9DFEB284F42EBA897BF
Malicious:	false
Reputation:	low
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\77823a65-3094-41f2-848e-2537d70f0003.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Reputation:	low
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a29c6355-0e50-409f-be70-c4ef83962d6c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Reputation:	low
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\af96d35d-88b1-45fe-9ad5-d10a432d31ce.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Reputation:	low
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\gxrvoq3c.c3c\Submission Proposal.pdf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PDF document, version 1.4, 1 pages
Category:	dropped
Size (bytes):	21663
Entropy (8bit):	7.681441025281266
Encrypted:	false
SSDEEP:	384:WFOSNMQ3KX32r+QyaNIK01nB8D6PhYC42+8uF6QgA0h:W0AMQ6n2r+Na6hzn+8nQgvh
MD5:	D8E0BAAA2AE5DD572C7053372B2A79C1
SHA1:	5DF65CFC89ED9AACCCE4B0ECA1D1786D5EFE2285
SHA-256:	9F3FD5899153C3F2F63BE4EA8DBF359BDF1CD345278299548FAF0B2C36B30A66
SHA-512:	F97DADD6BDA5A3499B565848EBA535C06FD51BDE77E188897C6777A67439CFAA50F677AB5F92CF8F8811460AD0DBC3335666F279D82F49B1CC39437408608885
Malicious:	false
Reputation:	low
Preview:	%PDF-1.4.%.....1 0 obj.<<./Type /Catalog./Version /1.4./Pages 2 0 R./StructTreeRoot 3 0 R./MarkInfo 4 0 R./Lang (en)./ViewerPreferences 5 0 R.>>.endobj.6 0 obj.<<./Title (Submission Proposal)./Creator (Canva)./Producer (Canva)./CreationDate (D:20241016065448+00'00')./ModDate (D:20241016065448+00'00')./Keywords (DAGTtvVuHso,BAGTthtWx1A)./Author (T Muller).>>.endobj.2 0 obj.<<./Type /Pages./Kids [7 0 R]./Count 1.>>.endobj.3 0 obj.<<./Type /StructTreeRoot./K [8 0 R]./ParentTree 9 0 R./ParentTreeNextKey 8.>>.endobj.4 0 obj.<<./Marked true./Suspects false.>>.endobj.5 0 obj.<<./Type /ViewerPreferences./DisplayDocTitle true.>>.endobj.7 0 obj.<<./Type /Page./Resources <<./ProcSet [/PDF /Text /ImageB /ImageC /ImageI]./ExtGState 10 0 R./XObject <<./X5 11 0 R.>>./Font 12 0 R.>>./MediaBox [0.0 7.920007 1440.0 817.92]./Annots [13 0 R]./Contents [14 0 R 15 0 R 16 0 R]./StructParents 0./Parent 2 0 R./Tabs /S./BleedBox [0.0 7.920007 1440.0 817.92]./TrimBox [0.0 7.920007 1440.0 817.92]./CropBox [0.0 7.

C:\Users\user\AppData\Local\Temp\unarchiver.log

Download File

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	5.141545563898717
Encrypted:	false
SSDEEP:	24:MUSqqi2qF3SdfkmUSyiJcSyiJjWIPUSyiJcSyiJUwKSyiJfpSyiJcSyiJFTAi2qp:TSqbF3SNkmUSyGcSyGbcSyGcSyGpKSyj
MD5:	FB3BC82F162B3675DA42E09C1D781485
SHA1:	F9686126DFB81413BC0CBB94E752A3EA280DAF8D
SHA-256:	92F090DE83188F172902B64B40DB9443225A38C0870567ECE55E2087FE947E57
SHA-512:	21915218D33817EA794D0CA9D35F906419BB3C49659D7B5DCF253B4DA874A6564915218776E082E6FB093330708D1124A456AA1308996A5E05FDBC8C03036DBE
Malicious:	false
Reputation:	low
Preview:	10/21/2024 7:09 PM: Unpack: C:\Users\user\Downloads\Submission Proposal.pdf.zip..10/21/2024 7:09 PM: Tmp dir: C:\Users\user\AppData\Local\Temp\gxrvoq3c.c3c..10/21/2024 7:09 PM: Received from standard out: ..10/21/2024 7:09 PM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..10/21/2024 7:09 PM: Received from standard out: ..10/21/2024 7:09 PM: Received from standard out: Scanning the drive for archives:..10/21/2024 7:09 PM: Received from standard out: 1 file, 18560 bytes (19 KiB)..10/21/2024 7:09 PM: Received from standard out: ..10/21/2024 7:09 PM: Received from standard out: Extracting archive: C:\Users\user\Downloads\Submission Proposal.pdf.zip..10/21/2024 7:09 PM: Received from standard out: --..10/21/2024 7:09 PM: Received from standard out: Path = C:\Users\user\Downloads\Submission Proposal.pdf.zip..10/21/2024 7:09 PM: Received from standard out: Type = zip..10/21/2024 7:09 PM: Received from standard out: Physical Size = 18560.

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.66829583405449
Encrypted:	false
SSDEEP:	3:So6FwHn:So6FwHn
MD5:	DD4A3BD8B9FF61628346391EA9987E1D
SHA1:	474076C122CACAAF112469FC62976BB69187AA2B
SHA-256:	7C22C759CA704106556BBC4FC10B7F53404CA1F8B40F01038D3F7C4B8183F486
SHA-512:	FDAF3D9F8072ED7DE9B2528376C10E3C3FDBEA74347710A4795BECF23C6577B3582B2E89D3C04EF0523C98FE0A46F2AF3629490701A20B848C63BA7B26579491
Malicious:	false
Reputation:	low
Preview:	<</Settings [/c <<>>].>>

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Reputation:	low
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Reputation:	low
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Users\user\Downloads\73005f67-d117-4314-8100-656bbec3fa42.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	8988
Entropy (8bit):	7.969347006328581
Encrypted:	false
SSDEEP:	192:QWKet2q1yYAqpeOpc4e5yB87X6zB+OVTI3AaQF0jIed5qRdA+gllFPR+jbWpT:QW/V1rbeYc5Qmgg6w9yxe2pgll5kjbWR
MD5:	DA786024187750057219B76970A66C35
SHA1:	6C824ADEC20721DE08F4AE365F00B9EEBD7EB0C9
SHA-256:	BB858A3EBFBBAA41B2A885516F0A8113D04CB01B312DE5CE3097232FD680B107
SHA-512:	AA10AA543B1E1AB80BF8CBE59FE08918FB51AFB05F8895EB9DD7F45CE96B3A7DA172C3D20C67F73C0B145662C00A8914BD2CB5AC037BF4D3F8451C3C2D6E5FB0
Malicious:	false
Reputation:	low
Preview:	PK........H9PY................Submission Proposal.pdf.w\T..6J...d.@....0...9g. ..0da.Q$..T...........%H.......A.>.s.~.s.{..W.....z....h~]EeQ0.J..x<K.....6N.RR.b...h.....rqw .3F{za...b..b.(.....#.'.3.zz.b.=.h}ww,@.W....Y.........rs......xa.hO]O.=...f....Is..9...\...`..h.....+........^(..+.O4.....R@...p..>;o[.o-?Ip..QX..EI......p...."..@...8:-w..D....u.......b}..U..E.....&~`9...7..\ C........ojA...O q.18..s.,q..{.a......e....0G.1\..C.g.@....l.F.aqZ...1.....jh;..9.gXo/..-..`.r.B.6...q.bRr1E....._........'...bA....r..<w....9m..X....S.b.8..bj.8J.?...<.p.+.aU...F..~in.c.S.'/S.........1...[.m.A....A@......@ ......#..-.)....q.....a,7,.......~=....../.x.@.Z...c.....\L........zb\.3..n..g}..`.~3....4%..+N.....8.qz...q....w..H.7F..W.9B8..f..v..n.F.B.. ._.....C.......Y~....HE.....^..}W.D.9`.q6.......r..6.-?..\..cwN*.#.SEc....(.......([4.)....Q^....s..h....../d.qj.=..]=.....9......]p.+.m..~../,n.r.".{.n...Dk.e.(.H..._'.._8......7.=IE..."..6>"Q.VU.:.....W{oC......

C:\Users\user\Downloads\Submission Proposal.pdf.zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	18560
Entropy (8bit):	7.982812539877458
Encrypted:	false
SSDEEP:	384:QW/V1rbeYc5Qmgg6w9yxe2pgll5kjbWpj0c7rDO1RNlqOeVhb77v5In3uSx:tV1/ewmCtMj5kPg0Wq1RNlbefb77vda
MD5:	F0B5205BC70899CA9C5A0CF69BC13F01
SHA1:	6EFA3FA37864E79E612C0ACAED2EFF6ABF9791D3
SHA-256:	E888895EE890EFBFE03731D41CD7B577351C44D8D4D78CBDDAC338A274676AF5
SHA-512:	F3D8BDB21D55216F73DB5692EE809926ACBDDE77FE6DCA8CD12526BABF913AAAC7C3B68E6335E6CB74F02EDF991D31BC8F1781222DFC293CD4063DDEE54CC9C2
Malicious:	true
Reputation:	low
Preview:	PK........H9PY................Submission Proposal.pdf.w\T..6J...d.@....0...9g. ..0da.Q$..T...........%H.......A.>.s.~.s.{..W.....z....h~]EeQ0.J..x<K.....6N.RR.b...h.....rqw .3F{za...b..b.(.....#.'.3.zz.b.=.h}ww,@.W....Y.........rs......xa.hO]O.=...f....Is..9...\...`..h.....+........^(..+.O4.....R@...p..>;o[.o-?Ip..QX..EI......p...."..@...8:-w..D....u.......b}..U..E.....&~`9...7..\ C........ojA...O q.18..s.,q..{.a......e....0G.1\..C.g.@....l.F.aqZ...1.....jh;..9.gXo/..-..`.r.B.6...q.bRr1E....._........'...bA....r..<w....9m..X....S.b.8..bj.8J.?...<.p.+.aU...F..~in.c.S.'/S.........1...[.m.A....A@......@ ......#..-.)....q.....a,7,.......~=....../.x.@.Z...c.....\L........zb\.3..n..g}..`.~3....4%..+N.....8.qz...q....w..H.7F..W.9B8..f..v..n.F.B.. ._.....C.......Y~....HE.....^..}W.D.9`.q6.......r..6.-?..\..cwN*.#.SEc....(.......([4.)....Q^....s..h....../d.qj.=..]=.....9......]p.+.m..~../,n.r.".{.n...Dk.e.(.H..._'.._8......7.=IE..."..6>"Q.VU.:.....W{oC......

C:\Users\user\Downloads\Submission Proposal.pdf.zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	18560
Entropy (8bit):	7.982812539877458
Encrypted:	false
SSDEEP:	384:QW/V1rbeYc5Qmgg6w9yxe2pgll5kjbWpj0c7rDO1RNlqOeVhb77v5In3uSx:tV1/ewmCtMj5kPg0Wq1RNlbefb77vda
MD5:	F0B5205BC70899CA9C5A0CF69BC13F01
SHA1:	6EFA3FA37864E79E612C0ACAED2EFF6ABF9791D3
SHA-256:	E888895EE890EFBFE03731D41CD7B577351C44D8D4D78CBDDAC338A274676AF5
SHA-512:	F3D8BDB21D55216F73DB5692EE809926ACBDDE77FE6DCA8CD12526BABF913AAAC7C3B68E6335E6CB74F02EDF991D31BC8F1781222DFC293CD4063DDEE54CC9C2
Malicious:	false
Reputation:	low
Preview:	PK........H9PY................Submission Proposal.pdf.w\T..6J...d.@....0...9g. ..0da.Q$..T...........%H.......A.>.s.~.s.{..W.....z....h~]EeQ0.J..x<K.....6N.RR.b...h.....rqw .3F{za...b..b.(.....#.'.3.zz.b.=.h}ww,@.W....Y.........rs......xa.hO]O.=...f....Is..9...\...`..h.....+........^(..+.O4.....R@...p..>;o[.o-?Ip..QX..EI......p...."..@...8:-w..D....u.......b}..U..E.....&~`9...7..\ C........ojA...O q.18..s.,q..{.a......e....0G.1\..C.g.@....l.F.aqZ...1.....jh;..9.gXo/..-..`.r.B.6...q.bRr1E....._........'...bA....r..<w....9m..X....S.b.8..bj.8J.?...<.p.+.aU...F..~in.c.S.'/S.........1...[.m.A....A@......@ ......#..-.)....q.....a,7,.......~=....../.x.@.Z...c.....\L........zb\.3..n..g}..`.~3....4%..+N.....8.qz...q....w..H.7F..W.9B8..f..v..n.F.B.. ._.....C.......Y~....HE.....^..}W.D.9`.q6.......r..6.-?..\..cwN*.#.SEc....(.......([4.)....Q^....s..h....../d.qj.=..]=.....9......]p.+.m..~../,n.r.".{.n...Dk.e.(.H..._'.._8......7.=IE..."..6>"Q.VU.:.....W{oC......

Chrome Cache Entry: 364

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65454)
Category:	downloaded
Size (bytes):	2531319
Entropy (8bit):	5.536923939972988
Encrypted:	false
SSDEEP:	49152:SYJEisu0CbOEazWm8o5wCumBLw3GEPy0TIsMrK8oNgKlb:uCnx
MD5:	69DC703A4D25B284EA4EB26B4B1AAD2F
SHA1:	4C5E0525C36F012AC29E8C0AEB3D5534046623FD
SHA-256:	0F317F65C20574033E465E473E6F2039BB848A41DEA14AAB04B0AC5C296F345C
SHA-512:	B1D7FC0809CFF24CD31D59769304796B09D18998474F3187ADD6BF913B730768B90B342D9BC4F355066804A8511A54AAC8AFE9C79A619A5E86151921F3D6A21A
Malicious:	false
Reputation:	low
URL:	https://docs.b360.autodesk.com/assets/357-fc7d97ad82b8ac739e96.js
Preview:	/! For license information please see 357-fc7d97ad82b8ac739e96.js.LICENSE.txt /.(self.webpackChunk_adsk_docs_ui_web=self.webpackChunk_adsk_docs_ui_web\|\|[]).push([[357],{772910:function(e,t,r){"use strict";var n=this&&this.__importDefault\|\|function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.default=t.namingConvention=void 0;var i=n(r(379541));t.namingConvention=i.default;var o={namingConvention:i.default};t.default=o},456808:function(e,t,r){"use strict";var n=this&&this.__createBinding\|\|(Object.create?function(e,t,r,n){void 0===n&&(n=r),Object.defineProperty(e,n,{enumerable:!0,get:function(){return t[r]}})}:function(e,t,r,n){void 0===n&&(n=r),e[n]=t[r]}),i=this&&this.__setModuleDefault\|\|(Object.create?function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}:function(e,t){e.default=t}),o=this&&this.__importStar\|\|function(e){if(e&&e.__esModule)return e;var t={};if(null!=e)for(var r in e)"default"!==r&&Object.prototype.has

Chrome Cache Entry: 365

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1250304
Entropy (8bit):	5.683327945340971
Encrypted:	false
SSDEEP:	24576:KmV+4lZjn4vDeQoCwIF1thCmVgE8NFzV6dNZZqIZkQIxVvGko1H8bIt:KmV+4lZjn4vDeMwIF1thCmVgE8NFzVH+
MD5:	B55A2B8FA75E33DC84DC15602506C8EA
SHA1:	7A83D7DC2CB873A67ACF65178052F4CB8319393D
SHA-256:	A52DBDE8616F7017AC6BEDE8A1130F9BBBF9BDD772AA52EBE4E3A4EC083DA515
SHA-512:	FD509F513C773F135385B23B4CAF20FF61E4B5E9B5442F6F97C81809FCF0F2298739E8816F0F46B375873B9E17AD1FB47B5297C88241F947DD20640CEFAAA121
Malicious:	false
Reputation:	low
URL:	https://docs.b360.autodesk.com/assets/dm-libs-ca441b231fcfa9b4b828.js
Preview:	(self.webpackChunk_adsk_docs_ui_web=self.webpackChunk_adsk_docs_ui_web\|\|[]).push([[4433],{711066:(e,t,r)=>{"use strict";r.d(t,{Mh:()=>Zr,wh:()=>O.Z,sg:()=>z,M4:()=>Ce,As:()=>b.default,ZP:()=>Yr});var o=r(667294),n=r(45697),a=r.n(n),l=r(693967),i=r.n(l),c=r(130845),s=r(491826),p=r(850308),f=r.n(p),u=r(23279),d=r.n(u),h=r(227361),v=r.n(h),m=r(875472),y=r.n(m),g=r(399370),b=r(233540),O=r(189988),w=r(426966),j=r(685644),x=r(761894),P=r(198057),_=r(649742);function A(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,o)}return r}function E(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?A(Object(r),!0).forEach((function(t){C(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):A(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnProper

Chrome Cache Entry: 366

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65453)
Category:	downloaded
Size (bytes):	4715221
Entropy (8bit):	5.824936249582252
Encrypted:	false
SSDEEP:	49152:tqtlBxGGTYwFjHkUk6tqQOpiwxvJoaUUkyClsYsHZmMOW6q7:tZWYwM62VH
MD5:	514077BF2048BF2F28A265871929CC5F
SHA1:	E467EE8718C134F20ABEF3EB53914DA2F4A50F7C
SHA-256:	6251C1819DC06246994EBCE4D486C193B3EBD5A584A167A2797F573B5151E438
SHA-512:	7BBB10790BB8768650BD468B33579D89A248198CAA7FAB50E99AA3DEA8A5DAEC80D7A39C8ED6D257B84B1CBCE7A73AA4B09ECE5D456669DB8E25C70CCF8C45F4
Malicious:	false
Reputation:	low
URL:	https://docs.b360.autodesk.com/assets/7506-1eb47107a1f9881e5c19.js
Preview:	/! For license information please see 7506-1eb47107a1f9881e5c19.js.LICENSE.txt /.(self.webpackChunk_adsk_docs_ui_web=self.webpackChunk_adsk_docs_ui_web\|\|[]).push([[7506],{882869:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.getOxygenId=t.parseJwt=void 0;var n=function(e){var t,n=e.split(".")[1].replace(/-/g,"+").replace(/_/g,"/"),r=decodeURIComponent(atob(n).split("").map((function(e){return"%"+("00"+e.charCodeAt(0).toString(16)).slice(-2)})).join(""));return JSON.parse(r)};t.parseJwt=n;var r=function(e){return(0,t.parseJwt)(e).userid};t.getOxygenId=r},987493:(e,t,n)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.fetchCompanies=void 0;var r=n(690159),a=n(227935),i=n(470427),o=n(571987),s=function(e){var t=e.projectId,n=e.offset,s=e.limit,u=(0,i.default)({offset:n,limit:s});return(0,o.fetchWithTokenAndRegion)("".concat((0,r.getEnvValue)(a.ENV_CONFIG_KEYS.ADMIN_API),"/v1/projects/").concat(t,"/companies").concat(u))};t.fetchCompanies=s},6901

Chrome Cache Entry: 367

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (722)
Category:	downloaded
Size (bytes):	779
Entropy (8bit):	5.1601144232543446
Encrypted:	false
SSDEEP:	12:JgVhEB1EEQZG8Ju36TL6YsWYAO0ssG8ORFOYZGmMGW9GKyR6:JmhEB1EEQZTJu3631YAj+FOPyU
MD5:	750073A1D9943349EA455029645AE4A9
SHA1:	0C97CD1FB8EC50C97FF3E16EFA0EE127F65F8EA2
SHA-256:	33866FFE144FFE98FE2BBDA4D6EE8FDD56440227AC61BDBEE7F0075C788EBAB7
SHA-512:	1D4C203933350B8B2B635D24A4446105F2CF3D1847A4E72A76907C60FE856959A6DDCA3463CD5E1BFEAD0E0B9E05DC7F2906C94701BB06C97839664B274B3A94
Malicious:	false
Reputation:	low
URL:	https://docs.b360.autodesk.com/assets/main-e50f3e2a4beff8d1c5ea.css?9d19d8ebaa1765a8ab82
Preview:	.B360A{background-color:transparent;color:#0696d7;text-decoration:none}.B360A:focus,.B360A:hover{color:#38abdf;text-decoration:none}.B360A:focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}.B360A:active,.B360A:hover{outline:0}.SvgIcon{overflow:hidden;vertical-align:middle}.SvgIcon--store-icon{pointer-events:none}.ErrorBoundary{align-items:center;background-color:#edf0f2;display:flex;flex-direction:column;height:100%;min-height:100vh;min-width:100vw;width:100%}.ErrorBoundary__logo-container{height:35px;margin:45px auto 0;width:250px}.ErrorBoundary__error-image{height:300px;width:930px}.ErrorBoundary__error{text-align:center}.ErrorBoundary__error-title{color:#819099;font-size:18px;margin-top:30px}./# sourceMappingURL=main-e50f3e2a4beff8d1c5ea.css.map/

Chrome Cache Entry: 368

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

Chrome Cache Entry: 369

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

Chrome Cache Entry: 370

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	79
Entropy (8bit):	3.9951663126378123
Encrypted:	false
SSDEEP:	3:U3KTDW3MiLLUHcjVXlVBT7J:H6NLgHWXZT7J
MD5:	97B958FA75E225CEA6FA3F3E399010D0
SHA1:	4DDFF887AB1D6FFC1678A717F1327E6C0900B9F8
SHA-256:	0C909725B0EA7DA9994F16E47A4142783410C5AA25CDD7770F85DC61EB8A170C
SHA-512:	C8130E21AF2E53D9B3615EAF54714A1160C0D2D80629F4EC19108F307226FA62ED9A45D415041C649A9E2BC2631AF87DD0FC88792051B82096904D3A44166882
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':0,'err':1,'ins':1,'spa':1,'sr':0,'srs':0,'st':1,'sts':0})

Chrome Cache Entry: 371

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 43680, version 2.13172
Category:	downloaded
Size (bytes):	43680
Entropy (8bit):	7.995263678415545
Encrypted:	true
SSDEEP:	768:IYd4khfHXmf/zDS3+blARXgtrQh3U/M9BThr3RVTb3JP:I87HXQM+blAZMrokU9TlVTtP
MD5:	D1B4F2343D3C4BFBFA9D6B30E118ED38
SHA1:	00AEF462A79F7562D46956D0629A04ECEB9E9D3C
SHA-256:	1EE3EAFC17180DCBAF642D862DEA9B3F6AA70280FD99FE770EB96C8D832F01B1
SHA-512:	3ACEDB98801708CDEF864500511A78E0CC4E997FB09B99B39AFDCF0FB088A066C864780EA9C5D252CB6A37CD2D2D501C1BE65986116442268A31A2F8E02D419B
Malicious:	false
Reputation:	low
URL:	https://fonts.autodesk.com/ArtifaktElement/WOFF2/Artifakt%20Element%20Book.woff2
Preview:	wOF2...............8...:..3t.....................v...P..v.`..J..B........,..r.6.$..t..>.. ..W..d..1[....U......&.ck..N^.U.;.^'s.9zn.....;{.....YD9m.......,dl........Z..YY....qp.....:S@.a..wU...!....C...b.S.:....r./..8R9..9A..p...p.'9{.O"zW.........._..>.j..........?...c.V.NZ...=.@d....(s..dz....f..F\|....^y.g2.b.v......:.>6.s.+.....=.D-.Z..nq..rn.so.<...i..J..E.y.G.o.[.i.b....>! j..[..dbz..V../.:5.V*...a..?.^@......XL.4..........D.6.v.ft.M.(...ja.......A....D.....$...^...a%/.#m...q{...a..Ezi.Cr.c..At..d.<X..p.><?.?....r0..G.6.,....f..H......1...EX...?.....Q.....M$...!........f5....jb.y....jr..{.n.....=...C.... 7.W...~.Al..#,f.(.F.D.x................T.G..vW.A..c........yF...bC..:...-U..rU..[......B..(.....d".-B$.8.5................o.....#y.$\|B..B.P1k.f.,......m.tmn3..m.o..Z@H..w^.:\|.............v7.4.&..h..(...$.?....k_$... .B....)..#...#JB...;T...h.k.4..1.e>.\|S.^l..&.w.Zm..)7e...hB....Y.l~%..a.j.FnO.e.O)....7..E.$H[\......i.f2...\...V8P.P.0+W.p.$

Chrome Cache Entry: 372

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	713
Entropy (8bit):	5.215318646234331
Encrypted:	false
SSDEEP:	12:YvHIaRMOMIuLIvOz0xoUTvWNaqcmLrWHWULrWHMlcvJpINT3PETLn:YvHJaOqLIodUTvWUqckrWFrWslEINbA
MD5:	339735251D505F902E5B195323FE8687
SHA1:	E74916075A9C240CCBBCC7E002C6CD2EE541F4BD
SHA-256:	645300AA15AC64882D49F14BEDA05DBB89F3A53459111979F961CD8180F8C0DC
SHA-512:	E8E8C61D66B2110C79A51B8B5BED432D5FECA348D8D53941FBDA3A7095BC3344D75A6D7ACE85A137DB2B7ED48AC97FFE4E46283DF4F7B1349F596A6FD7D0BF30
Malicious:	false
Reputation:	low
URL:	https://developer.api.autodesk.com/dm/v1/shares/71eed6cd-6f17-43e1-9baf-76250ffcdf51/recipients/69a7f40d-d879-4336-899e-8d70b1c53626
Preview:	{"env":"production","region":"US","share_id":"71eed6cd-6f17-43e1-9baf-76250ffcdf51","recipient_id":"69a7f40d-d879-4336-899e-8d70b1c53626","proxy_host":"https://share.docs.b360.autodesk.com","token_url":"https://developer.api.autodesk.com//dm/v2/shared-link-token","malware_enabled":false,"fdx_enabled":true,"resource":{"type":"document","name":"Submission Proposal.pdf","urn":"urn:adsk.wipprod:fs.file:vf.SFXoxwY4Tzy6hs2WpA5i6g?version=1","versionUrn":"urn:adsk.wipprod:fs.file:vf.SFXoxwY4Tzy6hs2WpA5i6g?version=1","extension":"pdf","version":1,"is_document":false,"setName":"","malwareDetected":null,"mimeType":null},"expiration_date":"2024-10-31T03:59:59.999Z","space_id":"d6885cf1-c634-4c5f-abba-7b1cf3a0c7a5"}

Chrome Cache Entry: 373

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	9
Entropy (8bit):	2.94770277922009
Encrypted:	false
SSDEEP:	3:OFB:OFB
MD5:	9E076F5885F5CC16A4B5AEB8DE4ADFF5
SHA1:	475C848673A3F79FA778F01C2BD5A721D4C41707
SHA-256:	E3EBAA16DD9D9B9FC107C42183FB6CF9D22927E1AF03DBBDFA0CCC38E4E4AC31
SHA-512:	4D384838C78C74F56DE20DE3FE125B9FE4D40B7C9FB5D767B647F05AEDE6BF63431F4F08AC464E188E77B227BECC3AB4BA86272F30B53D91B15003D814E06D2E
Malicious:	false
Reputation:	low
URL:	https://rdi5cditblgwvqdacqlhomd2xnwm7evojwwetg5vpgo5rnk4btoq.ar-io.dev/iNHRDRMKzWrAYBQWdzB6u2zPkq5NrEmbtXmd2LVcDN0
Preview:	Not found

Chrome Cache Entry: 374

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	6.197000713814572
Encrypted:	false
SSDEEP:	96:biPz4SCMjyUHzosxnyA8A98vhqZ2IHuNeCu:biPzBCMjyUzosx3HulIHuE
MD5:	BFA05F797605A4803743B4CACFCD98A7
SHA1:	12C1B024999157A65FC68F51382B0FD4B26C8D1B
SHA-256:	A9622A00A9670C5D09AF7D753A91FFF2BDA33E68B61A4D52C379F6E3C070543B
SHA-512:	4E925B889BB841C523A556786AAB17CA725532C614F83E1B3C08E05F17E464D6D7F09D68EFBE647F5E894B1CBA7C0D49C2383BB89B4424E340E0A6408E995140
Malicious:	false
Reputation:	low
Preview:	............ .h...&... .... .........(....... ..... .........#...#............c...^...k(..y7.\|9..{8..z5..v-.l..`..U...Q.+.X...T...........`..._...^..f$..s2..u4..t3..s3..t3..u1..n"..[..T.].^...X.......a...a...]..^...g'..p1..q2..o0..l...l...q2..r..^..[.D.[...`...b...c ..\..]...a"..l..x8..w8..s3.f(..f(..m/..n$..`...o+..d...b...d#..]..\...a ..l-..H.a....{5D.e..]...b"..o+..g...g...g...b...e$..^..\...`...j..B..y/..w&.\..U...Z...n(..l%..j#..j#..b...e$.._..[..._...g'.r1{.t1o.i ..Y..~R...^...q+.n)A.n)..o+..b...d"..`..[..._...c%..g..j-..o0..v3..u,..u/.r0H.l..q/......b...c!..a..\...^...b#..e(..e)..e)..f..t5..J..U%.R..........b...b...b..^...^...c#.e)n.e)w.e).e)..d(..w8..V...\|..[......b...a...d!.a..._...l+.....l/..e)#.e(.d(..j-..T..h..`......c ..b...g$.h$..`...p/...v..r/..`...a .a!..i..Z..l..f......f#..e!..i&.q-..e#..l+.h#..Z.m.[...[...[...}9..h..m..j......h%..g$..k(.s0..u3..k+..b...V...U...X...t+..`..nl.l..n......j'..h%..m.t1..}:...>..t

Chrome Cache Entry: 375

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	387597
Entropy (8bit):	5.065663466228814
Encrypted:	false
SSDEEP:	6144:uDsjhmEolPKvzwnDLZ0De2Xcgpusvi+LzUIxTgSdkm5XpkAotTjEWXqbN:uDsjhmEolPKvzwnDLZ0De2Xcgpusvi+R
MD5:	6543058D8DFFBB10E2953C6E95B4D8E6
SHA1:	4B659820A0443358D0FF4998CF8DDEF27E9AD4C5
SHA-256:	05D77ED7EA2C69E826CB321CC7A21B2E0F9DA20C1F58699E09056D7592D16E87
SHA-512:	3F2595AE627CE1FE6483C314168127F557ED45D48B8B8232BF2D1E09E943A5EE8CFC82FD54FE7F89FB4190ED62ACE3B77976216B02D73C36354FBCB81DD4552B
Malicious:	false
Reputation:	low
URL:	https://docs.b360.autodesk.com/assets/dm-matrix-c3d7fe993828ac6aaef6.css
Preview:	.Button--cancel,.Button--danger,.Button--default,.Button--primary{min-width:120px}.Button{background-image:none;border:1px solid transparent;border-radius:4px;border-radius:2px;cursor:pointer;display:inline-block;font-size:13px;font-weight:400;height:35px;line-height:1.5384615385;margin-bottom:0;padding:8px 13px;text-align:center;touch-action:manipulation;-webkit-user-select:none;-moz-user-select:none;user-select:none;vertical-align:middle;white-space:nowrap}.Button.active.focus,.Button.active:focus,.Button.focus,.Button:active.focus,.Button:active:focus,.Button:focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}.Button.focus,.Button:focus,.Button:hover{color:#0696d7;text-decoration:none}.Button.active,.Button:active{background-image:none;box-shadow:inset 0 3px 5px rgba(0,0,0,.125);outline:0}.Button.disabled,.Button[disabled],fieldset[disabled] .Button{box-shadow:none;cursor:auto;filter:alpha(opacity=65);opacity:.65}.Button.disabled,.Button.disabled:focus,.Button.disab

Chrome Cache Entry: 376

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47236)
Category:	downloaded
Size (bytes):	47296
Entropy (8bit):	5.109641231586508
Encrypted:	false
SSDEEP:	384:Mcforcz9dcGA8v5osCpJeVocUJj0PFaULUXnakrp:McfoggGA8v5os/aoPFaJ
MD5:	3F8F1AACD4B415A867C78F9BFCEF9FB6
SHA1:	BDCB44AA337323E60042784FD532A36984F66858
SHA-256:	BB7E2FEC06BE06D9709DF0CA6E535B299A31F306B6E285FA25B6EEEEC55B2E5F
SHA-512:	1078D5B2DF6C3314EE69D83B31B73A8747D5E3E9A2132E14A75FDBFEB627D5385161C5F5132F2E77A4C7DC393E51A88BF382149057618570E78DFE55D32FAD7F
Malicious:	false
Reputation:	low
URL:	https://docs.b360.autodesk.com/assets/dm-libs-437123d63b5bf891bed4.css
Preview:	.PermissionSelect .SelectBox__control{border:1px solid transparent;height:45px}.PermissionSelect .SelectBox__control:hover{background-color:#f7f9fa;border:1px solid #dae1e6}.PermissionSelect .SelectBox__control:hover .SelectBox__toggle{visibility:visible}.PermissionSelect .SelectBox__placeholder{bottom:unset;position:unset;top:unset;transform:unset}.PermissionSelect .SelectBox__toggle{visibility:hidden}.PermissionSelect .SelectBox__menu{max-width:unset;width:240px}.PermissionSelect__option--grouped{padding-left:20px}.PermissionSelect__option-header{background-color:#edf0f2;color:#222;font-weight:600;padding:4px 10px}.PermissionSelect__menu-overlay:after{background:#fff;content:"";height:2px;left:1px;position:absolute;right:1px;top:-2px;z-index:102}.PermissionSelect__menu-overlay.SelectBox__menu-overlay--flipped:after{bottom:-2px;top:auto}.PermissionSelect__menu-overlay .SelectBox__menu{max-width:unset;position:relative;width:240px}.PermissionSelect--use-overlay .SelectBox__control:afte

Chrome Cache Entry: 377

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	713
Entropy (8bit):	5.215318646234331
Encrypted:	false
SSDEEP:	12:YvHIaRMOMIuLIvOz0xoUTvWNaqcmLrWHWULrWHMlcvJpINT3PETLn:YvHJaOqLIodUTvWUqckrWFrWslEINbA
MD5:	339735251D505F902E5B195323FE8687
SHA1:	E74916075A9C240CCBBCC7E002C6CD2EE541F4BD
SHA-256:	645300AA15AC64882D49F14BEDA05DBB89F3A53459111979F961CD8180F8C0DC
SHA-512:	E8E8C61D66B2110C79A51B8B5BED432D5FECA348D8D53941FBDA3A7095BC3344D75A6D7ACE85A137DB2B7ED48AC97FFE4E46283DF4F7B1349F596A6FD7D0BF30
Malicious:	false
Reputation:	low
Preview:	{"env":"production","region":"US","share_id":"71eed6cd-6f17-43e1-9baf-76250ffcdf51","recipient_id":"69a7f40d-d879-4336-899e-8d70b1c53626","proxy_host":"https://share.docs.b360.autodesk.com","token_url":"https://developer.api.autodesk.com//dm/v2/shared-link-token","malware_enabled":false,"fdx_enabled":true,"resource":{"type":"document","name":"Submission Proposal.pdf","urn":"urn:adsk.wipprod:fs.file:vf.SFXoxwY4Tzy6hs2WpA5i6g?version=1","versionUrn":"urn:adsk.wipprod:fs.file:vf.SFXoxwY4Tzy6hs2WpA5i6g?version=1","extension":"pdf","version":1,"is_document":false,"setName":"","malwareDetected":null,"mimeType":null},"expiration_date":"2024-10-31T03:59:59.999Z","space_id":"d6885cf1-c634-4c5f-abba-7b1cf3a0c7a5"}

Chrome Cache Entry: 378

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	dropped
Size (bytes):	5575550
Entropy (8bit):	5.8263119530816425
Encrypted:	false
SSDEEP:	49152:yO+VwzAmt2UCej18sJJMBj032fVXjdYFclbcftYLzlb0tvcn861v:MfVXjdYFclbcftYLzlb08v
MD5:	4EF22E3527E14D4903332784620A5198
SHA1:	E171FB5C3DC806F37D90B9AA7DF6C8564652F115
SHA-256:	8D4EF8DA014C076CBD14D97A1AC03A5BF104AC6A8198301E8663145B4F54AB41
SHA-512:	AFB1EC8C2D90F044C9D98336FA97BD97CE4136F43802ED93EC9F57411D446DEE80A515022F64A6D1D964B52F97D5625487C241ADCC3526551B34D280DFCECEF5
Malicious:	false
Reputation:	low
Preview:	/! For license information please see dm-app-cfa2330a9b060922fc99.js.LICENSE.txt /.(self.webpackChunk_adsk_docs_ui_web=self.webpackChunk_adsk_docs_ui_web\|\|[]).push([[4507],{471595:(e,t,r)=>{var n={"./cs.json":854571,"./da.json":450410,"./de.json":494335,"./en-GB.json":709690,"./en.json":314508,"./es.json":338538,"./fr-CA.json":639253,"./fr.json":598195,"./it.json":507583,"./ja.json":738123,"./ko.json":464955,"./nl.json":63866,"./no.json":596281,"./pl.json":875889,"./pt-BR.json":627523,"./ru.json":345663,"./sv.json":614599,"./zh-Hans.json":207199,"./zh-Hant-HK.json":790332,"./zh-Hant.json":493768};function o(e){var t=i(e);return r(t)}function i(e){if(!r.o(n,e)){var t=new Error("Cannot find module '"+e+"'");throw t.code="MODULE_NOT_FOUND",t}return n[e]}o.keys=function e(){return Object.keys(n)},o.resolve=i,e.exports=o,o.id=471595},92243:(e,t,r)=>{var n={"./cs.json":86837,"./da.json":210600,"./de.json":565813,"./en-GB.json":707617,"./en.json":344295,"./es.json":97821,"./fr-CA.json":6539

Chrome Cache Entry: 379

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3455)
Category:	dropped
Size (bytes):	3515
Entropy (8bit):	5.560720603798609
Encrypted:	false
SSDEEP:	96:6Vp2YnIjYzzwJ5hn2a6C1qBjW/OU5LtXeU55RMIpnIvy:dFPWa11oMIvy
MD5:	6BA789DFCBB8BA9F17D47A224C94E4B8
SHA1:	BD574687B8DBF751507697AEA4D010166ACFD79A
SHA-256:	09AECE171E3357BAF344EA07C0A7C590A9570CF66EA81A5602300049C311FCB4
SHA-512:	7ED86BE2534B107A985B70BE26ADF8AB0BE846BC8D0B7E85137B4110BDDD588AC23134239716487C3E6C380CF0C66FC9E4B24BCCAEC9942D4137A92416739DDB
Malicious:	false
Reputation:	low
Preview:	(self.webpackChunk_adsk_docs_ui_web=self.webpackChunk_adsk_docs_ui_web\|\|[]).push([[8146],{972916:(e,r,n)=>{var o={"./clock.svg":791204};function t(e){var r=a(e);return n(r)}function a(e){if(!n.o(o,e)){var r=new Error("Cannot find module '"+e+"'");throw r.code="MODULE_NOT_FOUND",r}return o[e]}t.keys=function e(){return Object.keys(o)},t.resolve=a,e.exports=t,t.id=972916},793114:(e,r,n)=>{var o={"./cs/common.yml":307870,"./cs/error.yml":590967,"./da/common.yml":787291,"./da/error.yml":190155,"./de/common.yml":533448,"./de/error.yml":276239,"./en-GB/common.yml":435731,"./en-GB/error.yml":38634,"./en/common.yml":224193,"./en/error.yml":82396,"./es/common.yml":622694,"./es/error.yml":832400,"./fr-CA/common.yml":735936,"./fr-CA/error.yml":596591,"./fr/common.yml":182317,"./fr/error.yml":787324,"./ja/common.yml":796085,"./ja/error.yml":968360,"./nl/common.yml":593068,"./nl/error.yml":591381,"./no/common.yml":369747,"./no/error.yml":316,"./pl/common.yml":966946,"./pl/error.yml":244174,"./pt-BR

Chrome Cache Entry: 380

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	5430
Entropy (8bit):	6.197000713814572
Encrypted:	false
SSDEEP:	96:biPz4SCMjyUHzosxnyA8A98vhqZ2IHuNeCu:biPzBCMjyUzosx3HulIHuE
MD5:	BFA05F797605A4803743B4CACFCD98A7
SHA1:	12C1B024999157A65FC68F51382B0FD4B26C8D1B
SHA-256:	A9622A00A9670C5D09AF7D753A91FFF2BDA33E68B61A4D52C379F6E3C070543B
SHA-512:	4E925B889BB841C523A556786AAB17CA725532C614F83E1B3C08E05F17E464D6D7F09D68EFBE647F5E894B1CBA7C0D49C2383BB89B4424E340E0A6408E995140
Malicious:	false
Reputation:	low
URL:	https://docs.b360.autodesk.com/assets/favicon.ico?9d19d8ebaa1765a8ab82
Preview:	............ .h...&... .... .........(....... ..... .........#...#............c...^...k(..y7.\|9..{8..z5..v-.l..`..U...Q.+.X...T...........`..._...^..f$..s2..u4..t3..s3..t3..u1..n"..[..T.].^...X.......a...a...]..^...g'..p1..q2..o0..l...l...q2..r..^..[.D.[...`...b...c ..\..]...a"..l..x8..w8..s3.f(..f(..m/..n$..`...o+..d...b...d#..]..\...a ..l-..H.a....{5D.e..]...b"..o+..g...g...g...b...e$..^..\...`...j..B..y/..w&.\..U...Z...n(..l%..j#..j#..b...e$.._..[..._...g'.r1{.t1o.i ..Y..~R...^...q+.n)A.n)..o+..b...d"..`..[..._...c%..g..j-..o0..v3..u,..u/.r0H.l..q/......b...c!..a..\...^...b#..e(..e)..e)..f..t5..J..U%.R..........b...b...b..^...^...c#.e)n.e)w.e).e)..d(..w8..V...\|..[......b...a...d!.a..._...l+.....l/..e)#.e(.d(..j-..T..h..`......c ..b...g$.h$..`...p/...v..r/..`...a .a!..i..Z..l..f......f#..e!..i&.q-..e#..l+.h#..Z.m.[...[...[...}9..h..m..j......h%..g$..k(.s0..u3..k+..b...V...U...X...t+..`..nl.l..n......j'..h%..m.t1..}:...>..t

Chrome Cache Entry: 381

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	2834522
Entropy (8bit):	5.660022811813772
Encrypted:	false
SSDEEP:	49152:R4jC/p8CFWnx7K5qdT2UARTPt3HXePKfkemmPFozxOn7R5z0LF8V3:R4Fxt7+SKf3PMW
MD5:	A8BC2D496465B05081C22AAE45695F8D
SHA1:	C5DD8A22877859BDF3E959F50F91A02203654582
SHA-256:	9957ECC070FB0BFF6D08AEE274A277286B1A3BF4E340BA1813BE9C2F659A8D63
SHA-512:	10E5A99D7D8AFF119D76C865811C9FFF29F606DE49B00F20159CF7E021D0BE46FB92C39A6EC5A59A80AEA9ECF0DAC319D337CFC8EDDFFEFB7E412C4E7E8557CE
Malicious:	false
Reputation:	low
Preview:	/! For license information please see dm-vendors-f10bd27d5e5fc5831931.js.LICENSE.txt /.(self.webpackChunk_adsk_docs_ui_web=self.webpackChunk_adsk_docs_ui_web\|\|[]).push([[3041],{726981:(e,t,r)=>{"use strict";r(911983);var n=o(r(40115));function o(e){return e&&e.__esModule?e:{default:e}}n.default._babelPolyfill&&"undefined"!=typeof console&&console.warn&&console.warn("@babel/polyfill is loaded more than once on this page. This is probably not desirable/intended and may have consequences if different versions of the polyfills are applied sequentially. If you do need to load the polyfill more than once, use @babel/polyfill/noConflict instead to bypass the warning."),n.default._babelPolyfill=!0},911983:(e,t,r)=>{"use strict";r(916266),r(310990),r(470911),r(314160),r(106197),r(296728),r(654039),r(793568),r(978051),r(38250),r(515434),r(354952),r(796337),r(535666)},315897:(e,t,r)=>{"use strict";t.__esModule=!0;var n=r(667294),o=d(n),i,a=d(r(45697)),s,u=d(r(847815)),c,l=d(r(725506));function

Chrome Cache Entry: 382

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	2834522
Entropy (8bit):	5.660022811813772
Encrypted:	false
SSDEEP:	49152:R4jC/p8CFWnx7K5qdT2UARTPt3HXePKfkemmPFozxOn7R5z0LF8V3:R4Fxt7+SKf3PMW
MD5:	A8BC2D496465B05081C22AAE45695F8D
SHA1:	C5DD8A22877859BDF3E959F50F91A02203654582
SHA-256:	9957ECC070FB0BFF6D08AEE274A277286B1A3BF4E340BA1813BE9C2F659A8D63
SHA-512:	10E5A99D7D8AFF119D76C865811C9FFF29F606DE49B00F20159CF7E021D0BE46FB92C39A6EC5A59A80AEA9ECF0DAC319D337CFC8EDDFFEFB7E412C4E7E8557CE
Malicious:	false
Reputation:	low
URL:	https://docs.b360.autodesk.com/assets/dm-vendors-f10bd27d5e5fc5831931.js
Preview:	/! For license information please see dm-vendors-f10bd27d5e5fc5831931.js.LICENSE.txt /.(self.webpackChunk_adsk_docs_ui_web=self.webpackChunk_adsk_docs_ui_web\|\|[]).push([[3041],{726981:(e,t,r)=>{"use strict";r(911983);var n=o(r(40115));function o(e){return e&&e.__esModule?e:{default:e}}n.default._babelPolyfill&&"undefined"!=typeof console&&console.warn&&console.warn("@babel/polyfill is loaded more than once on this page. This is probably not desirable/intended and may have consequences if different versions of the polyfills are applied sequentially. If you do need to load the polyfill more than once, use @babel/polyfill/noConflict instead to bypass the warning."),n.default._babelPolyfill=!0},911983:(e,t,r)=>{"use strict";r(916266),r(310990),r(470911),r(314160),r(106197),r(296728),r(654039),r(793568),r(978051),r(38250),r(515434),r(354952),r(796337),r(535666)},315897:(e,t,r)=>{"use strict";t.__esModule=!0;var n=r(667294),o=d(n),i,a=d(r(45697)),s,u=d(r(847815)),c,l=d(r(725506));function

Chrome Cache Entry: 383

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (48600)
Category:	downloaded
Size (bytes):	50775
Entropy (8bit):	5.601549197920971
Encrypted:	false
SSDEEP:	768:4Y19NAwuzk007WfCIxzqcW+z1Xj36Wka+z1Xj36WratcN4Xxus3J/Kq:4YwE7mCI9jUF6ZJ/Kq
MD5:	71A04B0FFE24A1AE768FE49D348FAD41
SHA1:	D8B5032C7A2D9F34467B727856F9AB7D5A961615
SHA-256:	38F532157149C2ABC8F8394060E0531404E6D230FBA81AE8D80D2E163F2E3DC8
SHA-512:	03A049B40869D42511A2E5CED860447BB55988D82BD81486142DC16AAEAEDE16AE28BF88C72977499839113B7748D0518FFED038DC8E38A8AE2AF8542431257B
Malicious:	false
Reputation:	low
URL:	https://docs.b360.autodesk.com/assets/8068-6be71d732840e2f49cf7.js
Preview:	/! For license information please see 8068-6be71d732840e2f49cf7.js.LICENSE.txt /.(self.webpackChunk_adsk_docs_ui_web=self.webpackChunk_adsk_docs_ui_web\|\|[]).push([[8068],{791204:e=>{e.exports=function(){return{defs:[],symbol:'<symbol id="clock" viewBox="0 0 20 20" xmlns="http://www.w3.org/2000/svg"><path d="M10.5 10H15v1H9.5V5h1v5Zm-.5 8a8 8 0 1 1 0-16 8 8 0 0 1 0 16Zm0-1a7 7 0 1 0 0-14 7 7 0 0 0 0 14Z" fill="currentColor" fill-rule="evenodd"/></symbol>'}},e.exports.SvgStoreTransformed=!0},831996:(e,t,n)=>{"use strict";n.d(t,{L:()=>Qe});var o={};n.r(o),n.d(o,{startLoading:()=>He,stopLoading:()=>Ze});var r=n(667294),a=n(973935),i=n(828216),d=n(197779),c=n(933042);function l(e){return l="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},l(e)}function s(){return s=Object.assign?Object.assign.bind():function(e){for(var t=1;t<arguments.leng

Chrome Cache Entry: 384

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14973
Entropy (8bit):	5.219599743448611
Encrypted:	false
SSDEEP:	384:PsV0QDI4+Wiqrf1MxcOnL9L1/WdXMUvcJMyCYw5M96b9JG2REi7+pDvId:Ogtqrf1MxjLJlw9/
MD5:	40C0C33CE5BC666990FEDFDDF6516BB3
SHA1:	3AC21C7ADD973A3D7FFE213466E3EF14D7B64FF7
SHA-256:	2B8DCC1DD1C96933CB7D5F2C06B37437B602E26F76A664BD8B4639BD7B046068
SHA-512:	9C59037B6F0AB1E6F3C356A322AAD0B86A85556695990B94729B913012C19D5113D909131F9B84868DE03670E8C0614970F8BDC10D158F080D3524E196964B62
Malicious:	false
Reputation:	low
Preview:	{"ACC-FDX-BRIDGE":{"flagVersion":8,"trackEvents":false,"value":true,"variation":0,"version":603},"ACC-FDX-FILE-OPERATION":{"flagVersion":17,"trackEvents":false,"value":true,"variation":0,"version":603},"ACC-FDX-FILE-OPERATION-COPY":{"flagVersion":14,"trackEvents":false,"value":true,"variation":0,"version":603},"ACC-FILES-REVISION-MANAGEMENT":{"flagVersion":2,"trackEvents":false,"value":false,"variation":1,"version":603},"ACC-NAMING-STANDARDS-IN-PROJECT-TEMPLATE":{"flagVersion":2,"trackEvents":false,"value":false,"variation":1,"version":603},"ACC-PACKAGES-LIVE-VERSIONS":{"flagVersion":2,"trackEvents":false,"value":false,"variation":1,"version":603},"ACC-PROJECT-HA-SETTINGS":{"flagVersion":2,"trackEvents":false,"value":false,"variation":1,"version":603},"ACC-REVIEWS-DYNAMIC-TASKS":{"flagVersion":18,"trackEvents":false,"value":false,"variation":1,"version":603},"ACC-REVIEWS-REVIEWERS-EDIT-ATTRIBUTES":{"flagVersion":4,"trackEvents":false,"value":false,"variation":1,"version":603},"ACC-REVI

Chrome Cache Entry: 385

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65453)
Category:	downloaded
Size (bytes):	3957781
Entropy (8bit):	5.838110831671981
Encrypted:	false
SSDEEP:	49152:slzlCQtTKuI2qL202mdgr9hMEWvg9DixgfKucTxsBdGG0J5NJ7vSOAuJUw6snX2q:a0
MD5:	FBF3C84E0488E7809BC15634FCE630AE
SHA1:	585954A6EA4217AD54C91EA715438433FDF88435
SHA-256:	F2A3460C2541934CE698B0D248FE4CF74974E79F4BFDCC7E416F11BF9BF3E81E
SHA-512:	6E552A8D1AED68C80BAA3B2CA4E0D148255E139356A2F3B54F9D78162F94931C9080CE2C54F7F3716DE8ACD00593ED3ED12F44D92FEFEC40436178C8DC57FB7B
Malicious:	false
Reputation:	low
URL:	https://docs.b360.autodesk.com/assets/main-86e64cd8f521d16b3201.js?9d19d8ebaa1765a8ab82
Preview:	/! For license information please see main-86e64cd8f521d16b3201.js.LICENSE.txt /.!function e(t,a){if("object"==typeof exports&&"object"==typeof module)module.exports=a();else if("function"==typeof define&&define.amd)define([],a);else{var o=a();for(var n in o)("object"==typeof exports?exports:t)[n]=o[n]}}(self,(()=>(()=>{var e={776929:(e,t,a)=>{var o={"./cs/activity.yml":11784,"./cs/admin.yml":460034,"./cs/bimSearch.yml":807982,"./cs/bimviewer.yml":947814,"./cs/buttons.yml":268674,"./cs/cdeUpload.yml":389418,"./cs/cdeValidator.yml":224271,"./cs/copyWorkflows.yml":567155,"./cs/date.yml":17954,"./cs/documentGrid.yml":711738,"./cs/documentLog.yml":532054,"./cs/fileActivities.yml":998381,"./cs/folderTree.yml":855341,"./cs/holdingArea.yml":134577,"./cs/holdingAreaV2.yml":452888,"./cs/mdmKey.yml":223796,"./cs/messages.yml":832097,"./cs/modal.yml":9798,"./cs/namingConvention.yml":933665,"./cs/officeViewer.yml":254355,"./cs/pdfViewing.yml":508383,"./cs/permission.yml":582049,"./cs/publicLink.

Chrome Cache Entry: 386

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	150
Entropy (8bit):	4.817012895739808
Encrypted:	false
SSDEEP:	3:PouV7uJzhquHbtt6vYk2ZRMRJfHKERSAEtvxLrXZiLKY8KDETqLLMu9MK6c4NGL:hxuJzhqIzyYk+qRU4zEdxXZiqiLMcMKj
MD5:	84241342D84AC29592A5D9516F8EDF7F
SHA1:	03C53980E18E17625F439C20E7D438F066202428
SHA-256:	6E21162BC64073FE9E3D3D6375CA24D04FED1912A5B7716AAC0CB0F2D16FAE7C
SHA-512:	7509483335C7A30365F7F403098491AC0B44FFFCC68A5CDACB86EC191F02DBDA5B16A20A09E924B6A29AC938578D43BACB9A50115DB5C5668EA27FE1811BD530
Malicious:	false
Reputation:	low
URL:	https://rdi5cditblgwvqdacqlhomd2xnwm7evojwwetg5vpgo5rnk4btoq.ar-io.dev/favicon.ico
Preview:	<!DOCTYPE html>.<html lang="en">.<head>.<meta charset="utf-8">.<title>Error</title>.</head>.<body>.<pre>Cannot GET /favicon.ico</pre>.</body>.</html>.

Chrome Cache Entry: 387

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (48600)
Category:	dropped
Size (bytes):	50775
Entropy (8bit):	5.601549197920971
Encrypted:	false
SSDEEP:	768:4Y19NAwuzk007WfCIxzqcW+z1Xj36Wka+z1Xj36WratcN4Xxus3J/Kq:4YwE7mCI9jUF6ZJ/Kq
MD5:	71A04B0FFE24A1AE768FE49D348FAD41
SHA1:	D8B5032C7A2D9F34467B727856F9AB7D5A961615
SHA-256:	38F532157149C2ABC8F8394060E0531404E6D230FBA81AE8D80D2E163F2E3DC8
SHA-512:	03A049B40869D42511A2E5CED860447BB55988D82BD81486142DC16AAEAEDE16AE28BF88C72977499839113B7748D0518FFED038DC8E38A8AE2AF8542431257B
Malicious:	false
Reputation:	low
Preview:	/! For license information please see 8068-6be71d732840e2f49cf7.js.LICENSE.txt /.(self.webpackChunk_adsk_docs_ui_web=self.webpackChunk_adsk_docs_ui_web\|\|[]).push([[8068],{791204:e=>{e.exports=function(){return{defs:[],symbol:'<symbol id="clock" viewBox="0 0 20 20" xmlns="http://www.w3.org/2000/svg"><path d="M10.5 10H15v1H9.5V5h1v5Zm-.5 8a8 8 0 1 1 0-16 8 8 0 0 1 0 16Zm0-1a7 7 0 1 0 0-14 7 7 0 0 0 0 14Z" fill="currentColor" fill-rule="evenodd"/></symbol>'}},e.exports.SvgStoreTransformed=!0},831996:(e,t,n)=>{"use strict";n.d(t,{L:()=>Qe});var o={};n.r(o),n.d(o,{startLoading:()=>He,stopLoading:()=>Ze});var r=n(667294),a=n(973935),i=n(828216),d=n(197779),c=n(933042);function l(e){return l="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},l(e)}function s(){return s=Object.assign?Object.assign.bind():function(e){for(var t=1;t<arguments.leng

Chrome Cache Entry: 388

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3455)
Category:	downloaded
Size (bytes):	3515
Entropy (8bit):	5.560720603798609
Encrypted:	false
SSDEEP:	96:6Vp2YnIjYzzwJ5hn2a6C1qBjW/OU5LtXeU55RMIpnIvy:dFPWa11oMIvy
MD5:	6BA789DFCBB8BA9F17D47A224C94E4B8
SHA1:	BD574687B8DBF751507697AEA4D010166ACFD79A
SHA-256:	09AECE171E3357BAF344EA07C0A7C590A9570CF66EA81A5602300049C311FCB4
SHA-512:	7ED86BE2534B107A985B70BE26ADF8AB0BE846BC8D0B7E85137B4110BDDD588AC23134239716487C3E6C380CF0C66FC9E4B24BCCAEC9942D4137A92416739DDB
Malicious:	false
Reputation:	low
URL:	https://docs.b360.autodesk.com/assets/ShareLinks-d061ec3fe7e9bb1de663.js
Preview:	(self.webpackChunk_adsk_docs_ui_web=self.webpackChunk_adsk_docs_ui_web\|\|[]).push([[8146],{972916:(e,r,n)=>{var o={"./clock.svg":791204};function t(e){var r=a(e);return n(r)}function a(e){if(!n.o(o,e)){var r=new Error("Cannot find module '"+e+"'");throw r.code="MODULE_NOT_FOUND",r}return o[e]}t.keys=function e(){return Object.keys(o)},t.resolve=a,e.exports=t,t.id=972916},793114:(e,r,n)=>{var o={"./cs/common.yml":307870,"./cs/error.yml":590967,"./da/common.yml":787291,"./da/error.yml":190155,"./de/common.yml":533448,"./de/error.yml":276239,"./en-GB/common.yml":435731,"./en-GB/error.yml":38634,"./en/common.yml":224193,"./en/error.yml":82396,"./es/common.yml":622694,"./es/error.yml":832400,"./fr-CA/common.yml":735936,"./fr-CA/error.yml":596591,"./fr/common.yml":182317,"./fr/error.yml":787324,"./ja/common.yml":796085,"./ja/error.yml":968360,"./nl/common.yml":593068,"./nl/error.yml":591381,"./no/common.yml":369747,"./no/error.yml":316,"./pl/common.yml":966946,"./pl/error.yml":244174,"./pt-BR

Chrome Cache Entry: 389

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65448)
Category:	dropped
Size (bytes):	2563268
Entropy (8bit):	5.7899380409237695
Encrypted:	false
SSDEEP:	49152:y7vd1jH2P73wyHzt7evVLgPwvnuXgDiFtVc/ijfg/cvVYaeWJ+:kMIKVcFcP+
MD5:	DD3C890E5AA84C7A8D21E45E9AAFEE7C
SHA1:	CE5B25A11766055D4795FA5FDC49835B8EC1C74E
SHA-256:	B67308D3831716A7DF7338A2D4AD175419FF5DDCD43F816DC5F9315AB98EA51C
SHA-512:	7C48AA2E3A96E286E98D7F29669E6A134F2B99F86CEB04901203F9EC15ED7937C5D4D43846218A0EA5CF5229E92A7638D0B359E080386E77CA657888DAEBE443
Malicious:	false
Reputation:	low
Preview:	/! For license information please see dm-matrix-0a9a25dab7e700446b8f.js.LICENSE.txt /.(self.webpackChunk_adsk_docs_ui_web=self.webpackChunk_adsk_docs_ui_web\|\|[]).push([[5188],{389533:(e,t,r)=>{"use strict";r.d(t,{Z:()=>Q});var n=r(667294),o=r(45697),i=r.n(o),a=r(693967),s=r.n(a),l=r(973935),c=r(727735),u=r(335277),p=r(911866),f=r(980127),d=r(691300),h=r(761894),m=r(556909),y=r(680350),g=r(720587),v=r(572951),_=r(21818),O=r(198057),E=r(151973),b=r.n(E),S=r(916592),T=r.n(S),R=r(633866),w=r.n(R),N=r(528063),A=r.n(N),C=r(394916),P=r.n(C),x=r(362878),I=r.n(x),M=r(464497),L=r.n(M),D=r(50573),k=r(894859);function j(e){return j="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},j(e)}function F(){return F=Object.assign?Object.assign.bind():function(e){for(var t=1;t<arguments.length;t++){var r=arguments[t];for(var n in r)Object.prototype.hasOwnP

Chrome Cache Entry: 390

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.5326817819273595
Encrypted:	false
SSDEEP:	3:ah2AR46ED/RNgQJzRWWlKBWRv3puFt6Lyc3FBKGNK1KbLMRGpQ9LNEeH9ZTn:ahnR4vtNgmzR/wgRIFyyABGAbARGoaw9
MD5:	088EB42DDCEF55218AE7778C13408DB5
SHA1:	16E6B50CD075F5C65E7F2F4BBD9B41F19028B8A4
SHA-256:	0DEF8DA6AB92C8DB7113A2EB8FDA5AAE92197FBA7EF4646A50DA84920B5E1111
SHA-512:	636D857D5A45434C51B3EC31ED92A61D7D911EC89480D416EB9E294E946BBBE43B73C7134F59D5914818F63E399A894BFEC8F4B10A846DCA3F781E82CD168BE8
Malicious:	false
Reputation:	low
Preview:	{ "developerMessage":"The requested resource does not exist.", "moreInfo": "https://aps.autodesk.com/en/docs/oauth/v2/developers_guide/error_handling/", "errorCode": ""}

Chrome Cache Entry: 391

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4377)
Category:	downloaded
Size (bytes):	4440
Entropy (8bit):	5.410145494309384
Encrypted:	false
SSDEEP:	96:VhPSCRXCaSCRXbVSCRXrZDxkpSCRXzLSCRXbMZkSCRX8WbAr:aCRXCVCRXbACRX9xk0CRXaCRXbMZHCRW
MD5:	DBAD73787E9D396403428E95EA8BB534
SHA1:	26BDE5BE4C165F48020310A05F9D56B72BA51AA0
SHA-256:	7CAD7827EB7FA71B499FAC8B59FACE9D999D3A970958EF7E489F0C6F62F38DB6
SHA-512:	F4D2A474571075B156FD00DF8B81D339C386EE8F5E944E81C9C055709B1575E279FC8690B7B4B5980A833E38E7E1DE67E197645C06002DD4D37662B105019113
Malicious:	false
Reputation:	low
URL:	https://docs.b360.autodesk.com/assets/IssuesUIChunk-8ef3419f5a4b58ec7ecd.js
Preview:	(self.webpackChunk_adsk_docs_ui_web=self.webpackChunk_adsk_docs_ui_web\|\|[]).push([[7897],{108046:(n,s,o)=>{var r={"./cs.json":569596,"./da.json":650821,"./de.json":93890,"./en-GB.json":869534,"./en.json":117003,"./es.json":59801,"./fr-CA.json":801558,"./fr.json":366378,"./it.json":842977,"./ja.json":5774,"./ko.json":627200,"./nl.json":298259,"./no.json":615462,"./pl.json":930349,"./pt-BR.json":7189,"./ru.json":769027,"./sv.json":935001,"./zh-Hans.json":541353,"./zh-Hant-HK.json":113650,"./zh-Hant.json":236250};function j(n){var s=e(n);return o(s)}function e(n){if(!o.o(r,n)){var s=new Error("Cannot find module '"+n+"'");throw s.code="MODULE_NOT_FOUND",s}return r[n]}j.keys=function n(){return Object.keys(r)},j.resolve=e,n.exports=j,j.id=108046},795624:(n,s,o)=>{var r={"./cs.json":405637,"./da.json":969035,"./de.json":610397,"./en-GB.json":361078,"./en.json":127277,"./es.json":729056,"./fr-CA.json":548881,"./fr.json":528850,"./it.json":884544,"./ja.json":530573,"./ko.json":475392,"./nl.js

Chrome Cache Entry: 392

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

Chrome Cache Entry: 393

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	5575550
Entropy (8bit):	5.8263119530816425
Encrypted:	false
SSDEEP:	49152:yO+VwzAmt2UCej18sJJMBj032fVXjdYFclbcftYLzlb0tvcn861v:MfVXjdYFclbcftYLzlb08v
MD5:	4EF22E3527E14D4903332784620A5198
SHA1:	E171FB5C3DC806F37D90B9AA7DF6C8564652F115
SHA-256:	8D4EF8DA014C076CBD14D97A1AC03A5BF104AC6A8198301E8663145B4F54AB41
SHA-512:	AFB1EC8C2D90F044C9D98336FA97BD97CE4136F43802ED93EC9F57411D446DEE80A515022F64A6D1D964B52F97D5625487C241ADCC3526551B34D280DFCECEF5
Malicious:	false
Reputation:	low
URL:	https://docs.b360.autodesk.com/assets/dm-app-cfa2330a9b060922fc99.js
Preview:	/! For license information please see dm-app-cfa2330a9b060922fc99.js.LICENSE.txt /.(self.webpackChunk_adsk_docs_ui_web=self.webpackChunk_adsk_docs_ui_web\|\|[]).push([[4507],{471595:(e,t,r)=>{var n={"./cs.json":854571,"./da.json":450410,"./de.json":494335,"./en-GB.json":709690,"./en.json":314508,"./es.json":338538,"./fr-CA.json":639253,"./fr.json":598195,"./it.json":507583,"./ja.json":738123,"./ko.json":464955,"./nl.json":63866,"./no.json":596281,"./pl.json":875889,"./pt-BR.json":627523,"./ru.json":345663,"./sv.json":614599,"./zh-Hans.json":207199,"./zh-Hant-HK.json":790332,"./zh-Hant.json":493768};function o(e){var t=i(e);return r(t)}function i(e){if(!r.o(n,e)){var t=new Error("Cannot find module '"+e+"'");throw t.code="MODULE_NOT_FOUND",t}return n[e]}o.keys=function e(){return Object.keys(n)},o.resolve=i,e.exports=o,o.id=471595},92243:(e,t,r)=>{var n={"./cs.json":86837,"./da.json":210600,"./de.json":565813,"./en-GB.json":707617,"./en.json":344295,"./es.json":97821,"./fr-CA.json":6539

Chrome Cache Entry: 394

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	219582
Entropy (8bit):	4.8631816869126965
Encrypted:	false
SSDEEP:	6144:ALZHBUShm5rHeBOMm6OsqEf4L/BzHGkZFcgdTd1lxL897s8b3A/RiqLpvC6bouNZ:ALZHBUShm5rHeBOMm6OsqEf4L/BzHGkn
MD5:	C0713E708A895E3BC905987C2DC0FD77
SHA1:	B2F60484FD36E64C007204B7AC6555DBEA75706F
SHA-256:	1689FA7AF562C2E48166E2D09FFD9B090B831099FD4CBE09B6B148A69A0273A0
SHA-512:	CC3038CEBCC2D3B48F5173E2088546AB833D16E28135B327134A4B0680633B01B2EF0F79178DABCB2414527274E4F0A368A93D9D3351FC14420ECD8F61CE4247
Malicious:	false
Reputation:	low
URL:	https://docs.b360.autodesk.com/assets/7506-8b3f64a9678c8cb17962.css
Preview:	.issues-ui-root-element .isui-root-element{font-size:13px;height:100%;overflow:auto;width:100%}.issues-ui-root-element .isui-root-element .DropdownTree input[type=search]{background:transparent;border:none;box-shadow:none;font-size:13px;margin-bottom:0}.issues-ui-root-element .isui-root-element .IssuePreview label{font-size:13px}.issues-ui-root-element .isui-root-element input[type=search],.issues-ui-root-element .isui-root-element input[type=text]{box-shadow:none}.issues-ui-root-element .isui-root-element .ModalPreviewNavigation__container{display:block}.issues-ui-root-element .isui-root-element--modal-offset-fix .DocumentSelectionModal>div[role=dialog]{position:relative;z-index:1050}.issues-ui-root-element .isui-root-element .SearchBox__input{margin-bottom:0}.issues-ui-root-element .isui-root-element .IFrameModal:not(.IFrameModal--animation-exit){z-index:1051}.issues-ui-root-element .isui-root-element .Tooltip__container{z-index:1080}.issues-ui-root-element .isui-root-element .Toolti

Chrome Cache Entry: 395

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (29402)
Category:	dropped
Size (bytes):	29460
Entropy (8bit):	5.518898066417295
Encrypted:	false
SSDEEP:	768:Zjb11HHlCkfv45H7zC5eKC3wUueYfMtcw4Un15zvmME:Zjb11HVv1c7O0D4U1Rvy
MD5:	CF7D0C6032BD091E8655A97D692AB60A
SHA1:	5A95625987CDBC469198BD8574A7E4849F8889BA
SHA-256:	7DE1F21D5801414B990E0AF5F2400FE8E41F884E6537311F80ED6684A7533A97
SHA-512:	293A199952B1511C99D3A48A73B6E1B4914A34B6A449F679BFD240C71FDE84E8FF2AED78EC78C871C9853551098373811298F9C10DEFF34F82FF25C32D5D8EAB
Malicious:	false
Reputation:	low
Preview:	"use strict";(self.webpackChunk_adsk_docs_ui_web=self.webpackChunk_adsk_docs_ui_web\|\|[]).push([[1161],{349617:(e,t,r)=>{r.d(t,{x:()=>n});var n={CompaniesContext:"CompaniesContext",AlloyLaunchDarklyContext:"AlloyLaunchDarklyContext",ProjectEntitlementsContext:"ProjectEntitlementsContext",AccountEntitlementsContext:"AccountEntitlementsContext",ProjectsContext:"ProjectsContext",RolesContext:"RolesContext",UserContext:"UserContext",UsersContext:"UsersContext",DeletedUsersContext:"DeletedUsersContext",RelationshipsContext:"RelationshipsContext",EntitiesCacheContext:"EntitiesCacheContext",SideNavigationContext:"SideNavigationContext",CurrentProjectIdContext:"CurrentProjectIdContext",CurrentAccountIdContext:"CurrentAccountIdContext",CurrentProductIdContext:"CurrentProductIdContext",CurrentToolIdContext:"CurrentToolIdContext",SubscriptionsContext:"SubscriptionsContext"}},15470:(e,t,r)=>{r.r(t),r.d(t,{CurrentProjectIdProvider:()=>p,useCurrentProjectId:()=>f});var n=r(667294),o=r(45697),i=r.n(o)

Chrome Cache Entry: 396

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	14973
Entropy (8bit):	5.219599743448611
Encrypted:	false
SSDEEP:	384:PsV0QDI4+Wiqrf1MxcOnL9L1/WdXMUvcJMyCYw5M96b9JG2REi7+pDvId:Ogtqrf1MxjLJlw9/
MD5:	40C0C33CE5BC666990FEDFDDF6516BB3
SHA1:	3AC21C7ADD973A3D7FFE213466E3EF14D7B64FF7
SHA-256:	2B8DCC1DD1C96933CB7D5F2C06B37437B602E26F76A664BD8B4639BD7B046068
SHA-512:	9C59037B6F0AB1E6F3C356A322AAD0B86A85556695990B94729B913012C19D5113D909131F9B84868DE03670E8C0614970F8BDC10D158F080D3524E196964B62
Malicious:	false
Reputation:	low
URL:	https://app.launchdarkly.com/sdk/evalx/597f038478f27b0cd19b9e62/contexts/eyJraW5kIjoidXNlciIsImtleSI6Ik5BIiwiZmlyc3ROYW1lIjoidW5kZWZpbmVkIiwibGFzdE5hbWUiOiJ1bmRlZmluZWQiLCJyZWdpb24iOiJVUyJ9
Preview:	{"ACC-FDX-BRIDGE":{"flagVersion":8,"trackEvents":false,"value":true,"variation":0,"version":603},"ACC-FDX-FILE-OPERATION":{"flagVersion":17,"trackEvents":false,"value":true,"variation":0,"version":603},"ACC-FDX-FILE-OPERATION-COPY":{"flagVersion":14,"trackEvents":false,"value":true,"variation":0,"version":603},"ACC-FILES-REVISION-MANAGEMENT":{"flagVersion":2,"trackEvents":false,"value":false,"variation":1,"version":603},"ACC-NAMING-STANDARDS-IN-PROJECT-TEMPLATE":{"flagVersion":2,"trackEvents":false,"value":false,"variation":1,"version":603},"ACC-PACKAGES-LIVE-VERSIONS":{"flagVersion":2,"trackEvents":false,"value":false,"variation":1,"version":603},"ACC-PROJECT-HA-SETTINGS":{"flagVersion":2,"trackEvents":false,"value":false,"variation":1,"version":603},"ACC-REVIEWS-DYNAMIC-TASKS":{"flagVersion":18,"trackEvents":false,"value":false,"variation":1,"version":603},"ACC-REVIEWS-REVIEWERS-EDIT-ATTRIBUTES":{"flagVersion":4,"trackEvents":false,"value":false,"variation":1,"version":603},"ACC-REVI

Chrome Cache Entry: 397

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4377)
Category:	dropped
Size (bytes):	4440
Entropy (8bit):	5.410145494309384
Encrypted:	false
SSDEEP:	96:VhPSCRXCaSCRXbVSCRXrZDxkpSCRXzLSCRXbMZkSCRX8WbAr:aCRXCVCRXbACRX9xk0CRXaCRXbMZHCRW
MD5:	DBAD73787E9D396403428E95EA8BB534
SHA1:	26BDE5BE4C165F48020310A05F9D56B72BA51AA0
SHA-256:	7CAD7827EB7FA71B499FAC8B59FACE9D999D3A970958EF7E489F0C6F62F38DB6
SHA-512:	F4D2A474571075B156FD00DF8B81D339C386EE8F5E944E81C9C055709B1575E279FC8690B7B4B5980A833E38E7E1DE67E197645C06002DD4D37662B105019113
Malicious:	false
Reputation:	low
Preview:	(self.webpackChunk_adsk_docs_ui_web=self.webpackChunk_adsk_docs_ui_web\|\|[]).push([[7897],{108046:(n,s,o)=>{var r={"./cs.json":569596,"./da.json":650821,"./de.json":93890,"./en-GB.json":869534,"./en.json":117003,"./es.json":59801,"./fr-CA.json":801558,"./fr.json":366378,"./it.json":842977,"./ja.json":5774,"./ko.json":627200,"./nl.json":298259,"./no.json":615462,"./pl.json":930349,"./pt-BR.json":7189,"./ru.json":769027,"./sv.json":935001,"./zh-Hans.json":541353,"./zh-Hant-HK.json":113650,"./zh-Hant.json":236250};function j(n){var s=e(n);return o(s)}function e(n){if(!o.o(r,n)){var s=new Error("Cannot find module '"+n+"'");throw s.code="MODULE_NOT_FOUND",s}return r[n]}j.keys=function n(){return Object.keys(r)},j.resolve=e,n.exports=j,j.id=108046},795624:(n,s,o)=>{var r={"./cs.json":405637,"./da.json":969035,"./de.json":610397,"./en-GB.json":361078,"./en.json":127277,"./es.json":729056,"./fr-CA.json":548881,"./fr.json":528850,"./it.json":884544,"./ja.json":530573,"./ko.json":475392,"./nl.js

Chrome Cache Entry: 398

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65454)
Category:	dropped
Size (bytes):	2531319
Entropy (8bit):	5.536923939972988
Encrypted:	false
SSDEEP:	49152:SYJEisu0CbOEazWm8o5wCumBLw3GEPy0TIsMrK8oNgKlb:uCnx
MD5:	69DC703A4D25B284EA4EB26B4B1AAD2F
SHA1:	4C5E0525C36F012AC29E8C0AEB3D5534046623FD
SHA-256:	0F317F65C20574033E465E473E6F2039BB848A41DEA14AAB04B0AC5C296F345C
SHA-512:	B1D7FC0809CFF24CD31D59769304796B09D18998474F3187ADD6BF913B730768B90B342D9BC4F355066804A8511A54AAC8AFE9C79A619A5E86151921F3D6A21A
Malicious:	false
Reputation:	low
Preview:	/! For license information please see 357-fc7d97ad82b8ac739e96.js.LICENSE.txt /.(self.webpackChunk_adsk_docs_ui_web=self.webpackChunk_adsk_docs_ui_web\|\|[]).push([[357],{772910:function(e,t,r){"use strict";var n=this&&this.__importDefault\|\|function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.default=t.namingConvention=void 0;var i=n(r(379541));t.namingConvention=i.default;var o={namingConvention:i.default};t.default=o},456808:function(e,t,r){"use strict";var n=this&&this.__createBinding\|\|(Object.create?function(e,t,r,n){void 0===n&&(n=r),Object.defineProperty(e,n,{enumerable:!0,get:function(){return t[r]}})}:function(e,t,r,n){void 0===n&&(n=r),e[n]=t[r]}),i=this&&this.__setModuleDefault\|\|(Object.create?function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}:function(e,t){e.default=t}),o=this&&this.__importStar\|\|function(e){if(e&&e.__esModule)return e;var t={};if(null!=e)for(var r in e)"default"!==r&&Object.prototype.has

Chrome Cache Entry: 399

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	downloaded
Size (bytes):	18560
Entropy (8bit):	7.982812539877458
Encrypted:	false
SSDEEP:	384:QW/V1rbeYc5Qmgg6w9yxe2pgll5kjbWpj0c7rDO1RNlqOeVhb77v5In3uSx:tV1/ewmCtMj5kPg0Wq1RNlbefb77vda
MD5:	F0B5205BC70899CA9C5A0CF69BC13F01
SHA1:	6EFA3FA37864E79E612C0ACAED2EFF6ABF9791D3
SHA-256:	E888895EE890EFBFE03731D41CD7B577351C44D8D4D78CBDDAC338A274676AF5
SHA-512:	F3D8BDB21D55216F73DB5692EE809926ACBDDE77FE6DCA8CD12526BABF913AAAC7C3B68E6335E6CB74F02EDF991D31BC8F1781222DFC293CD4063DDEE54CC9C2
Malicious:	false
Reputation:	low
URL:	https://share.docs.b360.autodesk.com/data/download/v1/projects/b.d6885cf1-c634-4c5f-abba-7b1cf3a0c7a5/streaming?request_id=092038a2-7b47-408f-8603-61777e426bb1
Preview:	PK........H9PY................Submission Proposal.pdf.w\T..6J...d.@....0...9g. ..0da.Q$..T...........%H.......A.>.s.~.s.{..W.....z....h~]EeQ0.J..x<K.....6N.RR.b...h.....rqw .3F{za...b..b.(.....#.'.3.zz.b.=.h}ww,@.W....Y.........rs......xa.hO]O.=...f....Is..9...\...`..h.....+........^(..+.O4.....R@...p..>;o[.o-?Ip..QX..EI......p...."..@...8:-w..D....u.......b}..U..E.....&~`9...7..\ C........ojA...O q.18..s.,q..{.a......e....0G.1\..C.g.@....l.F.aqZ...1.....jh;..9.gXo/..-..`.r.B.6...q.bRr1E....._........'...bA....r..<w....9m..X....S.b.8..bj.8J.?...<.p.+.aU...F..~in.c.S.'/S.........1...[.m.A....A@......@ ......#..-.)....q.....a,7,.......~=....../.x.@.Z...c.....\L........zb\.3..n..g}..`.~3....4%..+N.....8.qz...q....w..H.7F..W.9B8..f..v..n.F.B.. ._.....C.......Y~....HE.....^..}W.D.9`.q6.......r..6.-?..\..cwN*.#.SEc....(.......([4.)....Q^....s..h....../d.qj.=..]=.....9......]p.+.m..~../,n.r.".{.n...Dk.e.(.H..._'.._8......7.=IE..."..6>"Q.VU.:.....W{oC......

Chrome Cache Entry: 400

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4580)
Category:	downloaded
Size (bytes):	4643
Entropy (8bit):	5.189307608838459
Encrypted:	false
SSDEEP:	48:aYmAXv8SAjWIANXPAu8b3OfofXtXUflUf3UfiGjfGfzNtY4k9fU4k9f24k9fiwow:pm8v8MVM9tx1NtZgtlx3tvgw9Tq23
MD5:	E938DE2D96CA600BB83F3B97425087E7
SHA1:	83DBB8840B44D9437C638F7D8F8E7EFD70FD346C
SHA-256:	93166AFC65113CF2C97A956B5A1598061135E9020DBC4BF9036412C375C03B32
SHA-512:	4A13CBF9F433DEA4537BF197ADB92B8B4E3DAD45E581CA544B56F51E0428A691861DB11303DB8D9C376F3CC72A3C83C27EB50FFF9FA623A4C599E7F9AADED4E6
Malicious:	false
Reputation:	low
URL:	https://docs.b360.autodesk.com/assets/ShareLinks-b9b71c321f60747481ce.css
Preview:	.SharedLinkBar{align-items:center;background-color:#102538;color:#fff;display:flex;flex-direction:row;height:50px;padding-left:30px}.SharedLinkBar__icon{color:#fff}.SharedLinkBar__name{max-width:250px}.SharedLinkBar__item{border:1px solid #fff;border-radius:4px;font-size:14px;padding:0 10px}.SharedLinkBar__item--disabled{border-color:#6b787f;color:#6b787f}.SharedLinkBar>div{height:24px;line-height:24px;margin-right:20px}.error-footer{color:#819099}.AnchorButton{font-weight:700}.MatrixHeader{height:120px}.MatrixHeader__logo{height:100%;margin-left:30px}.MatrixHeader__logo--main{display:block}.DownloadContainer{flex-direction:column;justify-content:center}.DownloadContainer,.DownloadContainer__wrapper{align-items:center;display:flex}.DownloadContainer__button{border-radius:5px;font-size:16px;height:40px;line-height:16px;width:155px}.DownloadContainer__button--wrapper{align-items:center;display:flex}.DownloadContainer__button--info--wrapper{align-items:center;display:flex;margin-left:22px

Chrome Cache Entry: 401

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65448)
Category:	downloaded
Size (bytes):	2563268
Entropy (8bit):	5.7899380409237695
Encrypted:	false
SSDEEP:	49152:y7vd1jH2P73wyHzt7evVLgPwvnuXgDiFtVc/ijfg/cvVYaeWJ+:kMIKVcFcP+
MD5:	DD3C890E5AA84C7A8D21E45E9AAFEE7C
SHA1:	CE5B25A11766055D4795FA5FDC49835B8EC1C74E
SHA-256:	B67308D3831716A7DF7338A2D4AD175419FF5DDCD43F816DC5F9315AB98EA51C
SHA-512:	7C48AA2E3A96E286E98D7F29669E6A134F2B99F86CEB04901203F9EC15ED7937C5D4D43846218A0EA5CF5229E92A7638D0B359E080386E77CA657888DAEBE443
Malicious:	false
Reputation:	low
URL:	https://docs.b360.autodesk.com/assets/dm-matrix-0a9a25dab7e700446b8f.js
Preview:	/! For license information please see dm-matrix-0a9a25dab7e700446b8f.js.LICENSE.txt /.(self.webpackChunk_adsk_docs_ui_web=self.webpackChunk_adsk_docs_ui_web\|\|[]).push([[5188],{389533:(e,t,r)=>{"use strict";r.d(t,{Z:()=>Q});var n=r(667294),o=r(45697),i=r.n(o),a=r(693967),s=r.n(a),l=r(973935),c=r(727735),u=r(335277),p=r(911866),f=r(980127),d=r(691300),h=r(761894),m=r(556909),y=r(680350),g=r(720587),v=r(572951),_=r(21818),O=r(198057),E=r(151973),b=r.n(E),S=r(916592),T=r.n(S),R=r(633866),w=r.n(R),N=r(528063),A=r.n(N),C=r(394916),P=r.n(C),x=r(362878),I=r.n(x),M=r(464497),L=r.n(M),D=r(50573),k=r(894859);function j(e){return j="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},j(e)}function F(){return F=Object.assign?Object.assign.bind():function(e){for(var t=1;t<arguments.length;t++){var r=arguments[t];for(var n in r)Object.prototype.hasOwnP

Chrome Cache Entry: 402

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65453)
Category:	dropped
Size (bytes):	3957781
Entropy (8bit):	5.838110831671981
Encrypted:	false
SSDEEP:	49152:slzlCQtTKuI2qL202mdgr9hMEWvg9DixgfKucTxsBdGG0J5NJ7vSOAuJUw6snX2q:a0
MD5:	FBF3C84E0488E7809BC15634FCE630AE
SHA1:	585954A6EA4217AD54C91EA715438433FDF88435
SHA-256:	F2A3460C2541934CE698B0D248FE4CF74974E79F4BFDCC7E416F11BF9BF3E81E
SHA-512:	6E552A8D1AED68C80BAA3B2CA4E0D148255E139356A2F3B54F9D78162F94931C9080CE2C54F7F3716DE8ACD00593ED3ED12F44D92FEFEC40436178C8DC57FB7B
Malicious:	false
Reputation:	low
Preview:	/! For license information please see main-86e64cd8f521d16b3201.js.LICENSE.txt /.!function e(t,a){if("object"==typeof exports&&"object"==typeof module)module.exports=a();else if("function"==typeof define&&define.amd)define([],a);else{var o=a();for(var n in o)("object"==typeof exports?exports:t)[n]=o[n]}}(self,(()=>(()=>{var e={776929:(e,t,a)=>{var o={"./cs/activity.yml":11784,"./cs/admin.yml":460034,"./cs/bimSearch.yml":807982,"./cs/bimviewer.yml":947814,"./cs/buttons.yml":268674,"./cs/cdeUpload.yml":389418,"./cs/cdeValidator.yml":224271,"./cs/copyWorkflows.yml":567155,"./cs/date.yml":17954,"./cs/documentGrid.yml":711738,"./cs/documentLog.yml":532054,"./cs/fileActivities.yml":998381,"./cs/folderTree.yml":855341,"./cs/holdingArea.yml":134577,"./cs/holdingAreaV2.yml":452888,"./cs/mdmKey.yml":223796,"./cs/messages.yml":832097,"./cs/modal.yml":9798,"./cs/namingConvention.yml":933665,"./cs/officeViewer.yml":254355,"./cs/pdfViewing.yml":508383,"./cs/permission.yml":582049,"./cs/publicLink.

Chrome Cache Entry: 403

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (29402)
Category:	downloaded
Size (bytes):	29460
Entropy (8bit):	5.518898066417295
Encrypted:	false
SSDEEP:	768:Zjb11HHlCkfv45H7zC5eKC3wUueYfMtcw4Un15zvmME:Zjb11HVv1c7O0D4U1Rvy
MD5:	CF7D0C6032BD091E8655A97D692AB60A
SHA1:	5A95625987CDBC469198BD8574A7E4849F8889BA
SHA-256:	7DE1F21D5801414B990E0AF5F2400FE8E41F884E6537311F80ED6684A7533A97
SHA-512:	293A199952B1511C99D3A48A73B6E1B4914A34B6A449F679BFD240C71FDE84E8FF2AED78EC78C871C9853551098373811298F9C10DEFF34F82FF25C32D5D8EAB
Malicious:	false
Reputation:	low
URL:	https://docs.b360.autodesk.com/assets/dm-alloy-e17832cdbff454794405.js
Preview:	"use strict";(self.webpackChunk_adsk_docs_ui_web=self.webpackChunk_adsk_docs_ui_web\|\|[]).push([[1161],{349617:(e,t,r)=>{r.d(t,{x:()=>n});var n={CompaniesContext:"CompaniesContext",AlloyLaunchDarklyContext:"AlloyLaunchDarklyContext",ProjectEntitlementsContext:"ProjectEntitlementsContext",AccountEntitlementsContext:"AccountEntitlementsContext",ProjectsContext:"ProjectsContext",RolesContext:"RolesContext",UserContext:"UserContext",UsersContext:"UsersContext",DeletedUsersContext:"DeletedUsersContext",RelationshipsContext:"RelationshipsContext",EntitiesCacheContext:"EntitiesCacheContext",SideNavigationContext:"SideNavigationContext",CurrentProjectIdContext:"CurrentProjectIdContext",CurrentAccountIdContext:"CurrentAccountIdContext",CurrentProductIdContext:"CurrentProductIdContext",CurrentToolIdContext:"CurrentToolIdContext",SubscriptionsContext:"SubscriptionsContext"}},15470:(e,t,r)=>{r.r(t),r.d(t,{CurrentProjectIdProvider:()=>p,useCurrentProjectId:()=>f});var n=r(667294),o=r(45697),i=r.n(o)

Chrome Cache Entry: 404

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32010)
Category:	downloaded
Size (bytes):	50049
Entropy (8bit):	5.315307632257224
Encrypted:	false
SSDEEP:	768:PFFeY2oE4e2HneiJbpJuAl39FVy7bT0tUpFk8Qgm:tIyreiBphl39FsvTpFvi
MD5:	63E2DF852D15AB21D7FF8FC4363222E8
SHA1:	7EE401BA652DB0A4EC960350E17216CDA01E22FB
SHA-256:	545156ADEAE44DADC82B98D504F805EBE77FB79C928EF34EED1057BB9D4CB8FE
SHA-512:	BAAD17C762461527B270B57EF294E28BEFF92B3A66829B8DDD8788A791AEBB0A40BE849BFC79FCFC5CB0D7FFC7FD709CA6CD6A61CAC878CE60F585D40F214970
Malicious:	false
Reputation:	low
URL:	https://js-agent.newrelic.com/nr-spa-1216.min.js
Preview:	!function(t,n,e){function r(e,o){if(!n[e]){if(!t[e]){var a="function"==typeof __nr_require&&__nr_require;if(!o&&a)return a(e,!0);if(i)return i(e,!0);throw new Error("Cannot find module '"+e+"'")}var s=n[e]={exports:{}};t[e][0].call(s.exports,function(n){var i=t[e][1][n];return r(i\|\|n)},s,s.exports)}return n[e].exports}for(var i="function"==typeof __nr_require&&__nr_require,o=0;o<e.length;o++)r(e[o]);return r}({1:[function(t,n,e){var r=t(46);n.exports=function(t,n){return"addEventListener"in window?window.addEventListener(t,n,r(!1)):"attachEvent"in window?window.attachEvent("on"+t,n):void 0}},{}],2:[function(t,n,e){function r(t,n,e,r){var i=d(t,n,e);return i.stats=a(r,i.stats),i}function i(t,n,e,r,i){var a=d(t,n,e,i);return a.metrics=o(r,a.metrics),a}function o(t,n){return n\|\|(n={count:0}),n.count+=1,v(t,function(t,e){n[t]=a(e,n[t])}),n}function a(t,n){return null==t?s(n):n?(n.c\|\|(n=f(n.t)),n.c+=1,n.t+=t,n.sos+=t*t,t>n.max&&(n.max=t),t<n.min&&(n.min=t),n):{t:t}}function s(t){return t?t.

Chrome Cache Entry: 405

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

Chrome Cache Entry: 406

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1250304
Entropy (8bit):	5.683327945340971
Encrypted:	false
SSDEEP:	24576:KmV+4lZjn4vDeQoCwIF1thCmVgE8NFzV6dNZZqIZkQIxVvGko1H8bIt:KmV+4lZjn4vDeMwIF1thCmVgE8NFzVH+
MD5:	B55A2B8FA75E33DC84DC15602506C8EA
SHA1:	7A83D7DC2CB873A67ACF65178052F4CB8319393D
SHA-256:	A52DBDE8616F7017AC6BEDE8A1130F9BBBF9BDD772AA52EBE4E3A4EC083DA515
SHA-512:	FD509F513C773F135385B23B4CAF20FF61E4B5E9B5442F6F97C81809FCF0F2298739E8816F0F46B375873B9E17AD1FB47B5297C88241F947DD20640CEFAAA121
Malicious:	false
Reputation:	low
Preview:	(self.webpackChunk_adsk_docs_ui_web=self.webpackChunk_adsk_docs_ui_web\|\|[]).push([[4433],{711066:(e,t,r)=>{"use strict";r.d(t,{Mh:()=>Zr,wh:()=>O.Z,sg:()=>z,M4:()=>Ce,As:()=>b.default,ZP:()=>Yr});var o=r(667294),n=r(45697),a=r.n(n),l=r(693967),i=r.n(l),c=r(130845),s=r(491826),p=r(850308),f=r.n(p),u=r(23279),d=r.n(u),h=r(227361),v=r.n(h),m=r(875472),y=r.n(m),g=r(399370),b=r(233540),O=r(189988),w=r(426966),j=r(685644),x=r(761894),P=r(198057),_=r(649742);function A(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,o)}return r}function E(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?A(Object(r),!0).forEach((function(t){C(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):A(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnProper

Chrome Cache Entry: 407

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 44144, version 2.13172
Category:	downloaded
Size (bytes):	44144
Entropy (8bit):	7.994509983867209
Encrypted:	true
SSDEEP:	768:gIbaeavH5tW7cUplyhYIjou/FSoOCuIerxpdacA6sWAAjqrDhl/ZxNtKRk:HvavH5wpkhTJdXOCu/acBikatl/yRk
MD5:	225E7821F3034F63867B46E9533D5852
SHA1:	4C15A222805403DEDF1746E36FA40FA03FFA401C
SHA-256:	5C0CE69F8F18A0B45E76ED06E9FF7F9A263D371F22DCCFCAA41AA2DEF91FF344
SHA-512:	3340FFFDB34DEDAB71A4241D6816F28DCEE769A6FE50AE1D60A6502C3270855F05FDB2626C391887C794734BB08091A7F4B2F8C3B57892848AADDAE8FED7C55C
Malicious:	false
Reputation:	low
URL:	https://fonts.autodesk.com/ArtifaktElement/WOFF2/Artifakt%20Element%20Bold.woff2
Preview:	wOF2.......p..............3t.....................v...h..v.`..J..B...........;.6.$..t..>.. .....d..1[....U....=5...m....V.#.^{F..y+..$ 5xn.~w..8.Cf......d"...I.........L...U..'G..>..R..a(z.n...7...\`.yBZ.)+....."....:......X.p.)e5(..H.t,v....9.fI_..z.z9....T.-r.s[J..NF....7ET.2k.l......\|.n...P..{3_..W.P...rD]...._..j06E5vVV.B..h.......+e...UVyi..+T.o.Q.......R=...._..3>'\Ht.....l.C...^.......Z{r..1....&$."h..n...v....]9...}w..pU%..u...Iv.~........+.\|v..tu..W(bV...6..@dh.M.u....y...}v>...d...BU....IL.PU........wD.."%.`$eaR`........f`t...............0..$.".P..(.V.!.j..\|T4.b.PT....].\5y._...y .W\%W...."".H..TtvlF"..tS.N....o...m...yDJJ..x.\.r.Z....)...SZ.8..h..pNp#....l9...........9...7.n......d....,d4...G~..?.... ....HC._-........!w'..p....).shS.."(....d.20.?.&(..t..k!.1.3...#q...HZ.K.HJd..}..oNKR..&.X.$....t......W..@.........@u.`...d..v....k.A....`N...l+d.8Q...Rv.P...x.;.q.v......j..%.<....G..._..... D..of7...}DH.@.....lu.$.j.d`......~.J..jvl.

Chrome Cache Entry: 408

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	449911
Entropy (8bit):	5.884897794654309
Encrypted:	false
SSDEEP:	12288:1izQx0OFWmczKxMFn4lITpS4ZZRoNJQTSoNJQi:KOFWmczKxMFn4lITpS49Oq
MD5:	707BCDD16EFF8D48C7E517E178505991
SHA1:	2F60C25B571E09F61C7235C9C06D6BF76D8716FE
SHA-256:	EFC9619367AEF9E34766EEEDCD3E154092B7512270C6710DC9FDFB7B7F9557EF
SHA-512:	D9BF892699B0883384DD846403D8D3B71A5DE35D65EE1A1D97A41EEF518F42B5949C1572F1ED1C7DE0A2B3A1933376177FEFCFEDC6FECDF9A2C0567302F28A09
Malicious:	false
Reputation:	low
URL:	https://docs.b360.autodesk.com/assets/dm-app-42740b094fab74749fd3.css
Preview:	.DraftEditor-editorContainer,.DraftEditor-root,.public-DraftEditor-content{height:inherit;text-align:initial}.public-DraftEditor-content[contenteditable=true]{-webkit-user-modify:read-write-plaintext-only}.DraftEditor-root{position:relative}.DraftEditor-editorContainer{background-color:hsla(0,0%,100%,0);border-left:.1px solid transparent;position:relative;z-index:1}.public-DraftEditor-block{position:relative}.DraftEditor-alignLeft .public-DraftStyleDefault-block{text-align:left}.DraftEditor-alignLeft .public-DraftEditorPlaceholder-root{left:0;text-align:left}.DraftEditor-alignCenter .public-DraftStyleDefault-block{text-align:center}.DraftEditor-alignCenter .public-DraftEditorPlaceholder-root{margin:0 auto;text-align:center;width:100%}.DraftEditor-alignRight .public-DraftStyleDefault-block{text-align:right}.DraftEditor-alignRight .public-DraftEditorPlaceholder-root{right:0;text-align:right}.public-DraftEditorPlaceholder-root{color:#9197a3;position:absolute;width:100%;z-index:1}.public-D

Chrome Cache Entry: 409

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	79
Entropy (8bit):	3.9951663126378123
Encrypted:	false
SSDEEP:	3:U3KTDW3MiLLUHcjVXlVBT7J:H6NLgHWXZT7J
MD5:	97B958FA75E225CEA6FA3F3E399010D0
SHA1:	4DDFF887AB1D6FFC1678A717F1327E6C0900B9F8
SHA-256:	0C909725B0EA7DA9994F16E47A4142783410C5AA25CDD7770F85DC61EB8A170C
SHA-512:	C8130E21AF2E53D9B3615EAF54714A1160C0D2D80629F4EC19108F307226FA62ED9A45D415041C649A9E2BC2631AF87DD0FC88792051B82096904D3A44166882
Malicious:	false
Reputation:	low
URL:	"https://bam.nr-data.net/1/4c213c66c1?a=44672672&sa=1&v=1216.487a282&t=Unnamed%20Transaction&rst=4606&ck=1&ref=https://docs.b360.autodesk.com/shares/71eed6cd-6f17-43e1-9baf-76250ffcdf51/recipients/69a7f40d-d879-4336-899e-8d70b1c53626&be=2179&fe=3858&dc=3846&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1729552128932,%22n%22:0,%22f%22:890,%22dn%22:891,%22dne%22:912,%22c%22:912,%22s%22:912,%22ce%22:1514,%22rq%22:1515,%22rp%22:2078,%22rpe%22:2164,%22dl%22:2091,%22di%22:2956,%22ds%22:3846,%22de%22:3846,%22dc%22:3857,%22l%22:3857,%22le%22:3859%7D,%22navigation%22:%7B%7D%7D&fp=3466&jsonp=NREUM.setToken"
Preview:	NREUM.setToken({'stn':0,'err':1,'ins':1,'spa':1,'sr':0,'srs':0,'st':1,'sts':0})

Chrome Cache Entry: 410

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

Chrome Cache Entry: 411

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32010)
Category:	dropped
Size (bytes):	50049
Entropy (8bit):	5.315307632257224
Encrypted:	false
SSDEEP:	768:PFFeY2oE4e2HneiJbpJuAl39FVy7bT0tUpFk8Qgm:tIyreiBphl39FsvTpFvi
MD5:	63E2DF852D15AB21D7FF8FC4363222E8
SHA1:	7EE401BA652DB0A4EC960350E17216CDA01E22FB
SHA-256:	545156ADEAE44DADC82B98D504F805EBE77FB79C928EF34EED1057BB9D4CB8FE
SHA-512:	BAAD17C762461527B270B57EF294E28BEFF92B3A66829B8DDD8788A791AEBB0A40BE849BFC79FCFC5CB0D7FFC7FD709CA6CD6A61CAC878CE60F585D40F214970
Malicious:	false
Reputation:	low
Preview:	!function(t,n,e){function r(e,o){if(!n[e]){if(!t[e]){var a="function"==typeof __nr_require&&__nr_require;if(!o&&a)return a(e,!0);if(i)return i(e,!0);throw new Error("Cannot find module '"+e+"'")}var s=n[e]={exports:{}};t[e][0].call(s.exports,function(n){var i=t[e][1][n];return r(i\|\|n)},s,s.exports)}return n[e].exports}for(var i="function"==typeof __nr_require&&__nr_require,o=0;o<e.length;o++)r(e[o]);return r}({1:[function(t,n,e){var r=t(46);n.exports=function(t,n){return"addEventListener"in window?window.addEventListener(t,n,r(!1)):"attachEvent"in window?window.attachEvent("on"+t,n):void 0}},{}],2:[function(t,n,e){function r(t,n,e,r){var i=d(t,n,e);return i.stats=a(r,i.stats),i}function i(t,n,e,r,i){var a=d(t,n,e,i);return a.metrics=o(r,a.metrics),a}function o(t,n){return n\|\|(n={count:0}),n.count+=1,v(t,function(t,e){n[t]=a(e,n[t])}),n}function a(t,n){return null==t?s(n):n?(n.c\|\|(n=f(n.t)),n.c+=1,n.t+=t,n.sos+=t*t,t>n.max&&(n.max=t),t<n.min&&(n.min=t),n):{t:t}}function s(t){return t?t.

Chrome Cache Entry: 412

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65453)
Category:	dropped
Size (bytes):	4715221
Entropy (8bit):	5.824936249582252
Encrypted:	false
SSDEEP:	49152:tqtlBxGGTYwFjHkUk6tqQOpiwxvJoaUUkyClsYsHZmMOW6q7:tZWYwM62VH
MD5:	514077BF2048BF2F28A265871929CC5F
SHA1:	E467EE8718C134F20ABEF3EB53914DA2F4A50F7C
SHA-256:	6251C1819DC06246994EBCE4D486C193B3EBD5A584A167A2797F573B5151E438
SHA-512:	7BBB10790BB8768650BD468B33579D89A248198CAA7FAB50E99AA3DEA8A5DAEC80D7A39C8ED6D257B84B1CBCE7A73AA4B09ECE5D456669DB8E25C70CCF8C45F4
Malicious:	false
Reputation:	low
Preview:	/! For license information please see 7506-1eb47107a1f9881e5c19.js.LICENSE.txt /.(self.webpackChunk_adsk_docs_ui_web=self.webpackChunk_adsk_docs_ui_web\|\|[]).push([[7506],{882869:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.getOxygenId=t.parseJwt=void 0;var n=function(e){var t,n=e.split(".")[1].replace(/-/g,"+").replace(/_/g,"/"),r=decodeURIComponent(atob(n).split("").map((function(e){return"%"+("00"+e.charCodeAt(0).toString(16)).slice(-2)})).join(""));return JSON.parse(r)};t.parseJwt=n;var r=function(e){return(0,t.parseJwt)(e).userid};t.getOxygenId=r},987493:(e,t,n)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.fetchCompanies=void 0;var r=n(690159),a=n(227935),i=n(470427),o=n(571987),s=function(e){var t=e.projectId,n=e.offset,s=e.limit,u=(0,i.default)({offset:n,limit:s});return(0,o.fetchWithTokenAndRegion)("".concat((0,r.getEnvValue)(a.ENV_CONFIG_KEYS.ADMIN_API),"/v1/projects/").concat(t,"/companies").concat(u))};t.fetchCompanies=s},6901

Target ID:	0
Start time:	19:08:44
Start date:	21/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:08:45
Start date:	21/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1984,i,17366287729370669979,6165770494908461818,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:08:48
Start date:	21/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://u1931584.ct.sendgrid.net/ls/click?upn=u001.0E02-2FzIG11vXmfBwdT167PQOcAxKKwdHOFrr9Q707zuCmae7OGpEH0sjgTwVKZOKGOIXhaZab42uYJDjXq-2BvDmBrB-2BitjeHEOm417wfwEN5DyKmWjx8GiK0vS0qP2-2FkZEXzCjOD1ATi51VFipfhQLxfE8-2FFtDYLE86HSpQBMyyH0F22Zm-2FfU1z5fJcYtwUM-2FxFJS_p4A4YQt8epDIK9HlKea9sedvYl6q0W66qnzBrcHOUCWErG8eYzfGVOB9NWJFyY4eLd2APu7Ps5E6ldV9YAcohj-2Fi086o8cWXXfFLnAGl6fjIOJQY5-2FQ-2F0-2BiCUTBMFYjbe292XkQmYU7w5w0oMitE-2Fn5R5dV1nHfTciU6eLmPx0ie-2BBr7HxuQc0d5wlQhWiwGZYXHSECUpMfsZuL3vCwzBA-3D-3D"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:09:15
Start date:	21/10/2024
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Submission Proposal.pdf.zip"
Imagebase:	0xab0000
File size:	12'800 bytes
MD5 hash:	16FF3CC6CC330A08EED70CBC1D35F5D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:09:16
Start date:	21/10/2024
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\gxrvoq3c.c3c" "C:\Users\user\Downloads\Submission Proposal.pdf.zip"
Imagebase:	0x250000
File size:	289'792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:09:16
Start date:	21/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	19:09:16
Start date:	21/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C "C:\Users\user\AppData\Local\Temp\gxrvoq3c.c3c\Submission Proposal.pdf"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:09:16
Start date:	21/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	19:09:16
Start date:	21/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\gxrvoq3c.c3c\Submission Proposal.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	19:09:17
Start date:	21/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	19:09:17
Start date:	21/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2068 --field-trial-handle=1580,i,8949217225099387246,9342843988186091837,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	19:11:23
Start date:	21/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://rdi5cditblgwvqdacqlhomd2xnwm7evojwwetg5vpgo5rnk4btoq.ar-io.dev/iNHRDRMKzWrAYBQWdzB6u2zPkq5NrEmbtXmd2LVcDN0"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	19:11:23
Start date:	21/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=2056,i,9991034077987844039,10875721668343843587,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 011AB1D6 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 011AB208

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: c2baf9634b641bcbe5040ea8d7b9e909e36a58219c709733856f1c207dae445d
Instruction ID: 4a01363f9496b4da83d2b702f22832a57c44b7fc78d924f2811236ef0a68298e
Opcode Fuzzy Hash: c2baf9634b641bcbe5040ea8d7b9e909e36a58219c709733856f1c207dae445d
Instruction Fuzzy Hash: 8C01A2755042809FDB10CF15E88576AFFD4DF44224F48C4ABDD498F256D379A504CB62

Function 05270C99 Relevance: 3.8, Strings: 3, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`tj, xrefs: 05270D37
`tj, xrefs: 05270D62
Pvj, xrefs: 05270CC8

Memory Dump Source

Source File: 00000007.00000002.3241784641.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5270000_unarchiver.jbxd

Similarity

API ID:
String ID: Pvj$`tj$`tj
API String ID: 0-3322856794
Opcode ID: e37601b284ea6a46c65f907985e375c19e90e33aeb5a2e06ac16f60e6b99c9f4
Instruction ID: 60e20214a83f6e7214cb66ea2c8686d9e5d67a800d54e18abbc60028d5e62358
Opcode Fuzzy Hash: e37601b284ea6a46c65f907985e375c19e90e33aeb5a2e06ac16f60e6b99c9f4
Instruction Fuzzy Hash: 5D2125707003188FCB05EB39C6447AE7BD7AF9A208B45447CD086DB382DF7AAD068791

Function 05270CA8 Relevance: 3.8, Strings: 3, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`tj, xrefs: 05270D37
`tj, xrefs: 05270D62
Pvj, xrefs: 05270CC8

Memory Dump Source

Source File: 00000007.00000002.3241784641.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5270000_unarchiver.jbxd

Similarity

API ID:
String ID: Pvj$`tj$`tj
API String ID: 0-3322856794
Opcode ID: ae98cb275a99338ef94798bcbbe1e98036ba9e15f331a1424a8fbab14d452be0
Instruction ID: cae685040fae3eae897a3faade52eea7e9a50c55e4a224f1eb1c2d5f2ed7546f
Opcode Fuzzy Hash: ae98cb275a99338ef94798bcbbe1e98036ba9e15f331a1424a8fbab14d452be0
Instruction Fuzzy Hash: 3B21E4707003188BCB14EB3586446AEBBD7AFC5208B45843DD186DB381DF7AAD068B91

Function 011AB246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 011AB2F3

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b045c6b6728f7f6739e9a33ae64ad70dc123a9b077e72776488896d9e5245f9c
Instruction ID: 481a0491508e5d5bb6c2fe5951b1e81d756a7b8c26cfecb4bf8cf7c8f63c1aaa
Opcode Fuzzy Hash: b045c6b6728f7f6739e9a33ae64ad70dc123a9b077e72776488896d9e5245f9c
Instruction Fuzzy Hash: FC31C676404384AFE7228B25CC45FA7BFBCEF05214F04449EE985CB163D328A909CBB1

Function 011AAD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 011AADA7

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f89520bae02831ac285725936e5cd5f0120cc7cb34dde70d1ad7b1855c03a4f7
Instruction ID: af086a465bb579891310de763cc02e79f1a754c5f2a527e55a3f4226625f9dd9
Opcode Fuzzy Hash: f89520bae02831ac285725936e5cd5f0120cc7cb34dde70d1ad7b1855c03a4f7
Instruction Fuzzy Hash: 1331B372504344AFEB228B65DC45FABBFACEF05214F04889EF985DB152D324A509CBB1

Function 011AAB76 Relevance: 1.6, APIs: 1, Instructions: 92
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E24,?,?), ref: 011AAC36

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: a1bf9b7f26d78faa3e74a20528b3e9b773398ed3dc1d5f13c4d7820d64b056c8
Instruction ID: ebd86107edfe15bce56f2326e344ef872d7c421f22a45f13decbf4cca9f1f6d7
Opcode Fuzzy Hash: a1bf9b7f26d78faa3e74a20528b3e9b773398ed3dc1d5f13c4d7820d64b056c8
Instruction Fuzzy Hash: 8F316E7250E3C05FD3038B718C65AA5BFB4AF47610F1A84CBD8C4DF1A3D2696919CB62

Function 011AA5DC Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 011AA67D

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b8e9f0b5844d370b77176bbf5ce70df6b4b85d43f34ed1d12a6258a88f7c6b17
Instruction ID: f5d82a8a4e80e67cdacbe9224c8ecdb39c4603cc43f27b4f26116ea80f1ca37c
Opcode Fuzzy Hash: b8e9f0b5844d370b77176bbf5ce70df6b4b85d43f34ed1d12a6258a88f7c6b17
Instruction Fuzzy Hash: BB31B171505344AFE722CF25DC44F66BFE8EF45220F08849EE9898B252D375E409CB71

Function 011AA120 Relevance: 1.6, APIs: 1, Instructions: 83
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 011AA1C2

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: a22fa34f918428bc61b8d7f997fa611a63d3c85f45b79e0cc57f043dc98e00b1
Instruction ID: be9415ac4bc1b14c73192e74b52ec9b0315d18949dd4ba49a4df9a22baa27085
Opcode Fuzzy Hash: a22fa34f918428bc61b8d7f997fa611a63d3c85f45b79e0cc57f043dc98e00b1
Instruction Fuzzy Hash: 3F21B57150D3C06FD3128B258C51BA2BFB4EF47610F0945CBD884DF593D229A919C7B2

Function 011AAD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 011AADA7

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: df5a24708cff0586dd4bb7a7f6c1b3efc5b40931b7565441af738df4537e8596
Instruction ID: 73e05b7adaf09c1ae68714b0d1d7569f76de3bdc67991e2daadea87d9e5358c6
Opcode Fuzzy Hash: df5a24708cff0586dd4bb7a7f6c1b3efc5b40931b7565441af738df4537e8596
Instruction Fuzzy Hash: 1A21B076500208AFEB218F65DC45F6BBBACEF04224F04886EEA859B552D734A504CBA1

Function 011AA370 Relevance: 1.6, APIs: 1, Instructions: 80
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,24FFFE73,00000000,00000000,00000000,00000000), ref: 011AA40C

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 42e1f64ba4702dc37672d9f34caa34dbcebfd3cab338164e4828dc1ddad15fe6
Instruction ID: 34bff3946d40b9f8c0ce056e03875af17863711da059f6b53bbabe9b8fd912a8
Opcode Fuzzy Hash: 42e1f64ba4702dc37672d9f34caa34dbcebfd3cab338164e4828dc1ddad15fe6
Instruction Fuzzy Hash: 46215CB6504744AFE721CF15DC84FA6BBF8EF45610F08849AEA458B292D364E909CBB1

Function 011AB276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 011AB2F3

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 99320d48d2e7c04d5fe465508eb8c8442ad27b9286ba4c1747a0b06559c33695
Instruction ID: 3d2b40a87b3590a9e83a2bc92605b2ad9f24ec4987f4d0baadcd0fda9eb6d38c
Opcode Fuzzy Hash: 99320d48d2e7c04d5fe465508eb8c8442ad27b9286ba4c1747a0b06559c33695
Instruction Fuzzy Hash: E121C176504204AFEB218F65DC45F6BBBECEF04224F04886EEA45CB152D338E504CBB5

Function 011AA850 Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E24,24FFFE73,00000000,00000000,00000000,00000000), ref: 011AA8DE

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 20156fe80e52d71dfdcd3b786bb81bdb2ef7344d768b91070e3be34dc32790c3
Instruction ID: c815aae15995333def09a6b2daec025bae72d7bf2eb5aea8dad2f0897bb6bf5d
Opcode Fuzzy Hash: 20156fe80e52d71dfdcd3b786bb81bdb2ef7344d768b91070e3be34dc32790c3
Instruction Fuzzy Hash: CB21C4754083846FE7228B24DC44F66BFB8EF46614F0984DAE9848B153D224A909C7B1

Function 011AA933 Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,00000E24,24FFFE73,00000000,00000000,00000000,00000000), ref: 011AA9C1

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f4590666a0cf45078e2ece0689e80c5ca308f75bbfcd12d243248c5608d6e3ec
Instruction ID: e282efe863ffb398b794020f58fdb2d4e459d913ce7d339031285c51c6909846
Opcode Fuzzy Hash: f4590666a0cf45078e2ece0689e80c5ca308f75bbfcd12d243248c5608d6e3ec
Instruction Fuzzy Hash: 1C21A171409384AFDB228F25DC45F96BFB8EF46214F08849AE9849B153D365A509CBB2

Function 011AA5FE Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 011AA67D

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 84d1310a3483eea1ef9c024bcb74f557b0e653c4ec734224b7e1992b8caecda1
Instruction ID: 29251c8ae3854b804ed8e6211ff61b7dc32cdc051c766b5fd9ef7724b8db5986
Opcode Fuzzy Hash: 84d1310a3483eea1ef9c024bcb74f557b0e653c4ec734224b7e1992b8caecda1
Instruction Fuzzy Hash: A6219275600604AFEB25CF25DD45F66FBE8EF48214F04846EEA898B252E375E404CF71

Function 011AA78F Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,24FFFE73,00000000,00000000,00000000,00000000), ref: 011AA815

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: db84ca5927320e03676fffa0bcc2dd31660883f036fa7969d2c77ec14d6239a6
Instruction ID: bef0b1988430da637084b8fbeede2b0364b55f74be41629eb7b1848ede63b0bb
Opcode Fuzzy Hash: db84ca5927320e03676fffa0bcc2dd31660883f036fa7969d2c77ec14d6239a6
Instruction Fuzzy Hash: 662105B54083846FE7128B25DC41FA2BFB8DF42314F0880DBE9848B193D268A909C7B1

Function 011AAA0B Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 011AAA8B

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: d3c8ab32d600cbb8d6a9d26f8b88503fc6bdaa06c0f5f8fc2a0a8edc52acc1e4
Instruction ID: 1442c8dd573285dea5a8bd163c7fff13c8a4cd8cb18181e4a5fd899d8a95e3fe
Opcode Fuzzy Hash: d3c8ab32d600cbb8d6a9d26f8b88503fc6bdaa06c0f5f8fc2a0a8edc52acc1e4
Instruction Fuzzy Hash: 0F21AF765083805FEB12CB29DC55B92BFE8AF06314F0984EAE984CB153D325D909CB61

Function 011AA392 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,24FFFE73,00000000,00000000,00000000,00000000), ref: 011AA40C

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: f09a2059ff06403cf9817b0a81a9166fe82b5c9eb46159279cd22fc3610f7440
Instruction ID: 6b18d1e2a41bcb9fd097033e8de87dbd3a65b6e3bcd087d0e795c0e62b4423f3
Opcode Fuzzy Hash: f09a2059ff06403cf9817b0a81a9166fe82b5c9eb46159279cd22fc3610f7440
Instruction Fuzzy Hash: F721A5B9600604AFE721CF29DC85F67FBECEF04614F08845AEA45CB252D364E905CAB1

Function 011AA962 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,24FFFE73,00000000,00000000,00000000,00000000), ref: 011AA9C1

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 300e1a92c30d66a99c5fa7acc94c44a800a2a3905a3e27ec659261aabb6112d1
Instruction ID: 4c65b4e02d97b97c2027c260378e680de248def9e404b091e7b67636bb775899
Opcode Fuzzy Hash: 300e1a92c30d66a99c5fa7acc94c44a800a2a3905a3e27ec659261aabb6112d1
Instruction Fuzzy Hash: A811E775500204AFEB21CF65EC45F6AFBE8EF44324F04845BEA499B152D379A544CBB1

Function 011AA882 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000E24,24FFFE73,00000000,00000000,00000000,00000000), ref: 011AA8DE

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a18eb86483af8d5bab7f2512392c8844702c57678c3374ca434500a5b3ece679
Instruction ID: 6363b7328c20da40c67fe6a41516e1bb5be78bed01b1c66d2b1263f477d3c670
Opcode Fuzzy Hash: a18eb86483af8d5bab7f2512392c8844702c57678c3374ca434500a5b3ece679
Instruction Fuzzy Hash: 2811E775500204AFEB21CF65EC45F66FBE8EF44324F04845AEA459B146D374A505CBB1

Function 011AA2AE Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 011AA30C

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: e764fa6ba9d33ee9bb3366bab250d46c5d527c0540e7ebdcc895b024c538c28f
Instruction ID: f1c841ad5481cd872bf130823c99c4ad66b27d1143b789addc45cf70c6f44a04
Opcode Fuzzy Hash: e764fa6ba9d33ee9bb3366bab250d46c5d527c0540e7ebdcc895b024c538c28f
Instruction Fuzzy Hash: 96115E7540D3C09FDB228B25DC94A96BFB4DF47224F0A80DBD9858F263D265A909CB72

Function 011AAF8B Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 011AAFE4

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 19d766314247856fbcc9aded9f67a41c555cb4013a5ed9bef46d0c24845c40ff
Instruction ID: 6838dece664f69573b96b7c631e864e8b6e6bbbfefb6e93a166eb883e715e0c9
Opcode Fuzzy Hash: 19d766314247856fbcc9aded9f67a41c555cb4013a5ed9bef46d0c24845c40ff
Instruction Fuzzy Hash: 1E11A0755093C09FD7128B25DC85B52BFF4EF06220F0984DBED858B263D265A808CB62

Function 011AB1B4 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 011AB208

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: eb8ccf021ba0fdc54a4e1bc1d3ae560da425496266644a14218b97478e5e42d1
Instruction ID: 4cc433c7d768a16b64aa82a0439f1e270621ea494621a98238987ef61f5c9e75
Opcode Fuzzy Hash: eb8ccf021ba0fdc54a4e1bc1d3ae560da425496266644a14218b97478e5e42d1
Instruction Fuzzy Hash: A811AC754093C0AFDB128F25DC84B56BFA4DF46220F0884EBED848F253D279A908CB72

Function 011AA7C2 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,24FFFE73,00000000,00000000,00000000,00000000), ref: 011AA815

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 7072ea9fe81fa591d007216eb9706caea5071efcdd51b2f16ebab8897c0f69c9
Instruction ID: 129add3b2d1d7406c367f29e145c25b32538f1da9f16a4e3c093d8a8b06af2f1
Opcode Fuzzy Hash: 7072ea9fe81fa591d007216eb9706caea5071efcdd51b2f16ebab8897c0f69c9
Instruction Fuzzy Hash: 3301D675504204AFE720CB15EC85F66FBDCDF44624F04C09AEE458B242D378A505CAB6

Function 011AAA46 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 011AAA8B

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: af496b2221a30ff4fcfb9f49fa58e2abaa4061c81140ddf5da36a5fe1314a2f4
Instruction ID: ff3e737beae2b70e8de046d80ef5f0666d69cc65256829794146e95a938d2f8a
Opcode Fuzzy Hash: af496b2221a30ff4fcfb9f49fa58e2abaa4061c81140ddf5da36a5fe1314a2f4
Instruction Fuzzy Hash: 1F11D6756042409FEB14CF29E995B66FFD8EF04220F08C4AADD49CB252E374E504CF61

Function 011AA172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 011AA1C2

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 590169bcd67dc41e736bd8808117178e7c990ab9569a9d4c30ee546f69c0a766
Instruction ID: 3ac1f49cba306af8032e284e725c6f9acd44f343bce5f15e1601f6ab7f4540ab
Opcode Fuzzy Hash: 590169bcd67dc41e736bd8808117178e7c990ab9569a9d4c30ee546f69c0a766
Instruction Fuzzy Hash: 08017171A00200AFD310DF16DC86B76FBE8EB88A20F14855AED489B645E735B915CBE6

Function 011AABE6 Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E24,?,?), ref: 011AAC36

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 662747b6885296a66583e4919206d6e25bd5d2a601f1f9bb5382ff7708ed5ab1
Instruction ID: 347c43f7afe37f93a6bbd0d5ed1229617ab228e5b46510486beaaa9a3ccc048b
Opcode Fuzzy Hash: 662747b6885296a66583e4919206d6e25bd5d2a601f1f9bb5382ff7708ed5ab1
Instruction Fuzzy Hash: C801B171A00200AFD310DF16CC86F76FBE8FB88A20F14811AEC489B641E735B915CBE6

Function 011AAFB2 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 011AAFE4

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 009ad112d500278508e8be979c3ce29d3c7fd0bba39946d75979e810cd5dc36c
Instruction ID: cfae6c2f12735b9ad33e2300c1436e0daab880614a4db14ff4ef9fe1d727ff09
Opcode Fuzzy Hash: 009ad112d500278508e8be979c3ce29d3c7fd0bba39946d75979e810cd5dc36c
Instruction Fuzzy Hash: 8F01F979604744DFDB188F19E885766FFE8EF04224F08C0AADD554B392D375E444CEA2

Function 011AA2DA Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 011AA30C

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: a53f77436bcdf1de3ad5d8bf8716079bbef3c70ace829e0f66a2b22a983e44b8
Instruction ID: e44ea0c74e7b7b3dba39be957f6bcad676bdbe21a3dba017c7d0cdcb7cc5bb88
Opcode Fuzzy Hash: a53f77436bcdf1de3ad5d8bf8716079bbef3c70ace829e0f66a2b22a983e44b8
Instruction Fuzzy Hash: AEF0AF79508644DFDB208F1AE885766FFE4EF04624F48C0AADD494B356D3B9A408CEA2

Function 011AA6D4 Relevance: 1.3, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 011AA748

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 35323b875ab53e5daa1f7483f098f134cd84e684cb6effd411acb80622d9c550
Instruction ID: aabd1e3224a2aa3c48f5f1884190cf153d8d90bce365a5963af02baf3ee567f9
Opcode Fuzzy Hash: 35323b875ab53e5daa1f7483f098f134cd84e684cb6effd411acb80622d9c550
Instruction Fuzzy Hash: 3221C2B65097C09FD7138B25DC94792BFB4EF06320F0980DBDC858B1A3D2259909C772

Function 011AA716 Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 011AA748

Memory Dump Source

Source File: 00000007.00000002.3240376160.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11aa000_unarchiver.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 24865e03a7ff828cc9fa38c8ad1a061503b635a15497822b85899302732bc800
Instruction ID: 411ea5e33b30993a0f9bb2892ce35b7f433cab905c848caa03f66cc2e23537c3
Opcode Fuzzy Hash: 24865e03a7ff828cc9fa38c8ad1a061503b635a15497822b85899302732bc800
Instruction Fuzzy Hash: 0701F7796006408FDB15CF69E885766FFE4DF04220F08C4ABDC468F256D379E544CEA2

Function 01540880 Relevance: 1.0, Instructions: 974COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3240735540.0000000001540000.00000040.00000020.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1540000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9daa2f1dd5fbba9c826b23f3a1c8d3182f06ac03246e6dcd345a71ae8c00b13e
Instruction ID: 6b83e36adaf29e566e33077bd0b5556e5fd2fb719af1e8fddc8e1a090d4a144c
Opcode Fuzzy Hash: 9daa2f1dd5fbba9c826b23f3a1c8d3182f06ac03246e6dcd345a71ae8c00b13e
Instruction Fuzzy Hash: 1F117C6554F3C00FE72383346C665A57FB49E43129B2E81EFD4848E9A3D65E494B83A3

Function 052702C0 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3241784641.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5270000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a7aaceb77353c8b9cfc247fe3b138253de8f3a2d83e38f77c4c9fd3d46d70b6
Instruction ID: 51b44374cfa982c678d9d842995a22ef2ac3f6c2ba9f55aa878cd5b3ad407248
Opcode Fuzzy Hash: 3a7aaceb77353c8b9cfc247fe3b138253de8f3a2d83e38f77c4c9fd3d46d70b6
Instruction Fuzzy Hash: EAB13E34611204DFD718EF65E998A5A7BB2FF88240B1180B9E917AB396DF389C41CF90

Function 05270799 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3241784641.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5270000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 410816ef40c916f9bce190294b36be2b88bb1dcaeca12ca248812b5328033a2a
Instruction ID: 38e914527152c80972a08315a543d8e78c026f00b614f28efa4846e867dddab3
Opcode Fuzzy Hash: 410816ef40c916f9bce190294b36be2b88bb1dcaeca12ca248812b5328033a2a
Instruction Fuzzy Hash: 1BA15B30B152058BDB18EFB48499B6E77A6EFC8308F158039D516AB395DF7C9D828B90

Function 05270BA0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3241784641.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5270000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7c0c56be59feb2eee5d2913bff988e3423ce0118e4598f70f5dd904b96d24c8
Instruction ID: 7920e20fd195307437628c9fff2f9e30305315e92072ef97abccd0e366695f79
Opcode Fuzzy Hash: f7c0c56be59feb2eee5d2913bff988e3423ce0118e4598f70f5dd904b96d24c8
Instruction Fuzzy Hash: 1D11A332B10118AFCB04DBB8D8489DE7BF6FFC8214B06407AE206EB261DF359C458B80

Function 01540808 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3240735540.0000000001540000.00000040.00000020.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1540000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5decb8432a583fe2612dcfc255cb8780babb0cac6444a928dd82a5bfe80f049f
Instruction ID: 27d10875de817d35c7e69bc894add066d711ae9b74a5303bc21f7624261f3be1
Opcode Fuzzy Hash: 5decb8432a583fe2612dcfc255cb8780babb0cac6444a928dd82a5bfe80f049f
Instruction Fuzzy Hash: 7E01B5B240D7446FD3018F15EC42C57BBE8DF86525F09C5AAE8488B212D229AD098BB2

Function 015405E0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3240735540.0000000001540000.00000040.00000020.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1540000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1dd151df19c1d3dfa48b7fde0a98dcb318b9cb1f29fa71aeb25dd100f040e8f
Instruction ID: cba5bfb0c8fa94ae411678be4a67c8bb796505c74cac5ab71acdf56ded2cf564
Opcode Fuzzy Hash: e1dd151df19c1d3dfa48b7fde0a98dcb318b9cb1f29fa71aeb25dd100f040e8f
Instruction Fuzzy Hash: 4C01DB7650D7805FD7118F169C41863FFF8DF86620709C4DFE8498B653C129A909CB72

Function 0154082E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3240735540.0000000001540000.00000040.00000020.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1540000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90ec39809a573a8f205121c30241d4b8d7c52a886a04598dc8d8aef3b6fa87a1
Instruction ID: 15095dbc437ffd0704da14243305e9316432d9160c65841eca4a8b6849e1a5cf
Opcode Fuzzy Hash: 90ec39809a573a8f205121c30241d4b8d7c52a886a04598dc8d8aef3b6fa87a1
Instruction Fuzzy Hash: A9F082B2805204AF9240DF15ED46856F7ECDFC4525F04C56BEC088B305E676AD154AF6

Function 05270C50 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3241784641.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5270000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bf39ab6843a635526b1ac0530c46a7a1b513c187a058c2c462884f075a45155
Instruction ID: 36da76785335965fbd0b3ce83836b0638b595b89ab5c83d6be01ac75578acb12
Opcode Fuzzy Hash: 2bf39ab6843a635526b1ac0530c46a7a1b513c187a058c2c462884f075a45155
Instruction Fuzzy Hash: 48E09231F242541FCB44DAF885945EE7FE19B85554B41457AC108C7241EE3189428380

Function 01540606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3240735540.0000000001540000.00000040.00000020.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1540000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e665fd57ae4671dabee9e56ab01238c5b57ff29e16d23a6ec6acaad8e5413409
Instruction ID: 06c7782648e29e820032a927df4bdac7335229eac7cf28dbcf5216ea2cf439fe
Opcode Fuzzy Hash: e665fd57ae4671dabee9e56ab01238c5b57ff29e16d23a6ec6acaad8e5413409
Instruction Fuzzy Hash: 58E012B66046049B9750DF0BFC81452F7D8EB88630718C47FDC0D8B711D679B505CEA5

Function 05270C60 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3241784641.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5270000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e33e4e032e6a69244d21340309b7c48705999128e4d44dda14269befc48a26b
Instruction ID: 6d194dd1d7dc0be52338db7cd0b4aa9e36a0a1f2bb58c99f96f940e30eb593fa
Opcode Fuzzy Hash: 3e33e4e032e6a69244d21340309b7c48705999128e4d44dda14269befc48a26b
Instruction Fuzzy Hash: B7D0C231F102182B8B44DBF849445EF7EEA9B84154B42807EC008D3301EE31988183C0

Function 05270DD1 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3241784641.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5270000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a002f800d9f10dc0df3185856ba15cf5131d81711e4672bd050c46f8a0ad2c2
Instruction ID: 57124e466b73f26a847ecd158aac55f417643c860a978edda135d8f6516e4821
Opcode Fuzzy Hash: 9a002f800d9f10dc0df3185856ba15cf5131d81711e4672bd050c46f8a0ad2c2
Instruction Fuzzy Hash: 00E086302553448FCB06CF38D458DA93BB16FE2214F1585DAC405CF163C635D858DB41

Function 011A23F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3240352514.00000000011A2000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11a2000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d3a4f58ced3486651e752d424fccc64e4bae9ee7cef0c6c162133f5975876eb
Instruction ID: daf778db7f9efb1f82271c148756473b261ee88a9c461a8ffdcb6e3ec2bed60a
Opcode Fuzzy Hash: 9d3a4f58ced3486651e752d424fccc64e4bae9ee7cef0c6c162133f5975876eb
Instruction Fuzzy Hash: ABD05E793057814FE71A9A1CC1A5F963FE4AB51714F9A44FDA800CB763C778D581D640

Function 011A23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3240352514.00000000011A2000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11a2000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 238a58b833018d569ab4592ffe395186d06fb03914f5b43369b5a7a9b2d51bc3
Instruction ID: a4034ae25ac7a5c65a66fdd67b4d7599524c4980afcfd2cdf521480f2a43956f
Opcode Fuzzy Hash: 238a58b833018d569ab4592ffe395186d06fb03914f5b43369b5a7a9b2d51bc3
Instruction Fuzzy Hash: 44D05E382042814BDB29DA1CC2E4F593BD4AF85714F0644ECAC108B362C7B8D8C0DA40

Function 05270DE0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3241784641.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5270000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef41574b06ad20107e799d16a3451101c43f7dc43ea64e582baa501b5ed7f76c
Instruction ID: ef0805559680e5fe027ae867cec2f03eecef36e30e2576c83a17122f71a6fad2
Opcode Fuzzy Hash: ef41574b06ad20107e799d16a3451101c43f7dc43ea64e582baa501b5ed7f76c
Instruction Fuzzy Hash: 5DC012303142088BC708EB79D51CE2973D66FD0304F45C069C5094B251CA74EC84CA84

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c9126686-f8c2-4a9d-8061-46a77609076d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention