Edit tour

Windows Analysis Report
http://propdfhub.com

Overview

General Information

Sample URL:	http://propdfhub.com
Analysis ID:	1562237
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

AI detected landing page (webpage, office document or email)

AI detected suspicious URL

Checks for available system drives (often done to infect USB drives)

Creates files inside the system directory

Deletes files inside the Windows folder

Downloads executable code via HTTP

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

HTML page contains hidden javascript code

Queries the volume information (name, serial number etc) of a device

Sigma detected: Msiexec Initiated Connection

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7052 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6340 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1964,i,10582329154645288296,11736562035223287704,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msiexec.exe (PID: 3552 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Downloads\ProPDFHub.msi" MD5: E5DA170027542E25EDE42FC54C929077)

chrome.exe (PID: 6204 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://propdfhub.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msiexec.exe (PID: 3284 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 2080 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 04C9E4F57D0D1C32905015F5BA761C6B C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 1476 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 1B86E0D7ED7E00C7133AD0225C92F308 MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Sigma Signatures

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 18.161.97.120, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 1476, Protocol: tcp, SourceIp: 192.168.2.16, SourceIsIpv6: false, SourcePort: 49793

Suricata Signatures

ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T11:42:52.739694+0100	2829202	1	A Network Trojan was detected	192.168.2.16	49793	18.161.97.120	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected landing page (webpage, office document or email)

Source: https://propdfhub.com/

Joe Sandbox AI: Page contains button: 'DOWNLOAD NOW' Source: '0.0.pages.csv'

AI detected suspicious URL

Source: Email	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: http://propdfhub.com
Source: Email	Joe Sandbox AI: AI detected Typosquatting in URL: http://propdfhub.com
Source: Email	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://propdfhub.com
Source: Email	Joe Sandbox AI: AI detected Typosquatting in URL: https://propdfhub.com

Source: https://propdfhub.com/

HTTP Parser: Base64 decoded: {"version":3,"sources":["webpack://./../../.yarn/__virtual__/@termly-react-components-virtual-d20d8fbfab/0/cache/@termly-react-components-npm-3.6.3-4f5cb71732-eba2e81f60.zip/node_modules/@termly/react-components/src/components/Button/styles.module.sass"],...

Source: https://propdfhub.com/dl/thank-you?cid=fNK8V6bSBo7vQFT8p	HTTP Parser: No favicon
Source: https://propdfhub.com/dl/thank-you?cid=fNK8V6bSBo7vQFT8p	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49788 version: TLS 1.2

Source: C:\Windows\System32\msiexec.exe	File opened: z:
Source: C:\Windows\System32\msiexec.exe	File opened: x:
Source: C:\Windows\System32\msiexec.exe	File opened: v:
Source: C:\Windows\System32\msiexec.exe	File opened: t:
Source: C:\Windows\System32\msiexec.exe	File opened: r:
Source: C:\Windows\System32\msiexec.exe	File opened: p:
Source: C:\Windows\System32\msiexec.exe	File opened: n:
Source: C:\Windows\System32\msiexec.exe	File opened: l:
Source: C:\Windows\System32\msiexec.exe	File opened: j:
Source: C:\Windows\System32\msiexec.exe	File opened: h:
Source: C:\Windows\System32\msiexec.exe	File opened: f:
Source: C:\Windows\System32\msiexec.exe	File opened: b:
Source: C:\Windows\System32\msiexec.exe	File opened: y:
Source: C:\Windows\System32\msiexec.exe	File opened: w:
Source: C:\Windows\System32\msiexec.exe	File opened: u:
Source: C:\Windows\System32\msiexec.exe	File opened: s:
Source: C:\Windows\System32\msiexec.exe	File opened: q:
Source: C:\Windows\System32\msiexec.exe	File opened: o:
Source: C:\Windows\System32\msiexec.exe	File opened: m:
Source: C:\Windows\System32\msiexec.exe	File opened: k:
Source: C:\Windows\System32\msiexec.exe	File opened: i:
Source: C:\Windows\System32\msiexec.exe	File opened: g:
Source: C:\Windows\System32\msiexec.exe	File opened: e:
Source: C:\Windows\System32\msiexec.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2829202 - Severity 1 - ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA : 192.168.2.16:49793 -> 18.161.97.120:80

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/x-msdownloadContent-Length: 104306832Connection: keep-aliveLast-Modified: Thu, 21 Nov 2024 08:30:23 GMTx-amz-server-side-encryption: AES256x-amz-version-id: QD0.j3x.jWatc58srSAXkGrBkmXywxgEAccept-Ranges: bytesServer: AmazonS3Date: Mon, 25 Nov 2024 03:02:43 GMTETag: "0445655b306fc987fa5337a5e5b67443-7"X-Cache: Hit from cloudfrontVia: 1.1 fd568a3da1f881f8511d482847a492ea.cloudfront.net (CloudFront)X-Amz-Cf-Pop: MRS52-P3X-Amz-Cf-Id: -jRIqKWuj5cacBn4WY9T5yv2xIqVl_Cd1Q4josRhdpH7C1UdU2wA8Q==Age: 27610Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 39 7e fb 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 a6 0f 00 00 c4 27 06 00 00 00 00 a0 3d 0a 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 0a 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 00 70 38 06 00 04 00 00 b6 1a 38 06 02 00 60 c1 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 28 b7 11 00 57 00 00 00 80 b7 11 00 b4 00 00 00 00 b0 14 00 c0 91 23 06 00 e0 13 00 64 6e 00 00 00 70 37 06 90 28 00 00 00 50 38 06 64 11 00 00 3c aa 11 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 a9 11 00 28 00 00 00 90 d1 0f 00 40 01 00 00 00 00 00 00 00 00 00 00 f0 bf 11 00 b8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 06 a5 0f 00 00 10 00 00 00 a6 0f 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 9a 02 00 00 c0 0f 00 00 9c 02 00 00 aa 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c8 7e 01 00 00 60 12 00 00 e2 00 00 00 46 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 64 6e 00 00 00 e0 13 00 00 70 00 00 00 28 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 67 78 66 67 00 00 00 f0 2d 00 00 00 50 14 00 00 2e 00 00 00 98 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 74 70 6c 6e 65 8c 00 00 00 00 80 14 00 00 02 00 00 00 c6 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 6c 73 00 00 00 00 32 01 00 00 00 90 14 00 00 02 00 00 00 c8 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEd9~f"'=@p88`(W#dnp7(P8d< (@.text

Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: propdfhub.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /epibrowser_installer_130.0.6723.141_2.exe HTTP/1.1Accept: /User-Agent: AdvancedInstallerHost: resources.epibrowser.comConnection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: propdfhub.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: app.termly.io
Source: global traffic	DNS traffic detected: DNS query: res.propdfhub.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: smarttechconsutacy.net
Source: global traffic	DNS traffic detected: DNS query: resources.epibrowser.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49788 version: TLS 1.2

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\411197.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI131E.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI137D.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI13BC.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{DD86AD20-EACB-446C-83F3-83B2A77C3D42}
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI143A.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI146A.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1517.tmp

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI131E.tmp

Source: classification engine

Classification label: mal56.win@29/49@31/276

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\Temp\MSI468.tmp

Source: C:\Windows\System32\msiexec.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1964,i,10582329154645288296,11736562035223287704,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://propdfhub.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1964,i,10582329154645288296,11736562035223287704,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Downloads\ProPDFHub.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 04C9E4F57D0D1C32905015F5BA761C6B C
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Downloads\ProPDFHub.msi"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 1B86E0D7ED7E00C7133AD0225C92F308
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 04C9E4F57D0D1C32905015F5BA761C6B C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 1B86E0D7ED7E00C7133AD0225C92F308
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI545.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\EPISoftware\installer.exe.part	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1517.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\MSI1517.tmp

Jump to dropped file

Source: C:\Windows\SysWOW64\msiexec.exe

File created: C:\Users\user\AppData\Local\EPISoftware\installer.exe.part

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI545.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\EPISoftware\installer.exe.part	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI1517.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	31 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
http://propdfhub.com	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\MSI545.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI1517.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://propdfhub.com/	0%	Avira URL Cloud	safe
http://resources.epibrowser.com/epibrowser_installer_130.0.6723.141_2.exe	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
propdfhub.com	18.161.97.49	true	true	unknown
googleads.g.doubleclick.net	172.217.19.226	true	false	high
res.propdfhub.com	52.222.144.96	true	false	unknown
www.google.com	142.250.181.100	true	false	high
app.termly.io	104.18.30.234	true	false	high
td.doubleclick.net	142.250.181.130	true	false	high
prod.globalsign.map.fastly.net	151.101.130.133	true	false	unknown
resources.epibrowser.com	18.161.97.120	true	true	unknown
smarttechconsutacy.net	54.230.112.122	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://resources.epibrowser.com/epibrowser_installer_130.0.6723.141_2.exe	true	Avira URL Cloud: safe	unknown
http://propdfhub.com/	false	Avira URL Cloud: safe	unknown
https://propdfhub.com/dl/thank-you?cid=fNK8V6bSBo7vQFT8p	true		unknown
https://propdfhub.com/	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.226	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
151.101.130.133	prod.globalsign.map.fastly.net	United States	54113	FASTLYUS	false
172.217.17.46	unknown	United States	15169	GOOGLEUS	false
142.250.181.130	td.doubleclick.net	United States	15169	GOOGLEUS	false
216.58.208.227	unknown	United States	15169	GOOGLEUS	false
142.250.181.138	unknown	United States	15169	GOOGLEUS	false
142.250.181.136	unknown	United States	15169	GOOGLEUS	false
18.161.97.49	propdfhub.com	United States	3	MIT-GATEWAYSUS	true
172.217.19.170	unknown	United States	15169	GOOGLEUS	false
18.161.97.120	resources.epibrowser.com	United States	3	MIT-GATEWAYSUS	true
172.217.21.34	unknown	United States	15169	GOOGLEUS	false
172.217.21.35	unknown	United States	15169	GOOGLEUS	false
172.217.17.42	unknown	United States	15169	GOOGLEUS	false
199.232.210.172	bg.microsoft.map.fastly.net	United States	54113	FASTLYUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.17.78	unknown	United States	15169	GOOGLEUS	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
52.222.144.96	res.propdfhub.com	United States	16509	AMAZON-02US	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
74.125.205.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.18.30.234	app.termly.io	United States	13335	CLOUDFLARENETUS	false
54.230.112.122	smarttechconsutacy.net	United States	16509	AMAZON-02US	false
18.161.97.11	unknown	United States	3	MIT-GATEWAYSUS	false
18.161.97.70	unknown	United States	3	MIT-GATEWAYSUS	false

Private

IP
192.168.2.17
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562237
Start date and time:	2024-11-25 11:41:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://propdfhub.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@29/49@31/276

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.17.46, 74.125.205.84
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://propdfhub.com

LLM Input / Output

Input	Output
URL: http://propdfhub.com Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": true, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": true, "third_party_hosting": true }
URL: http://propdfhub.com
URL: https://propdfhub.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Your Go-To Hub for All PDF Tools Simplified, Secure, and Efficient", "prominent_button_name": "DOWNLOAD NOW", "text_input_field_labels": "unknown", "pdf_icon_visible": true, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://propdfhub.com/dl/thank-you?cid=fNK8V6bSBo7vQFT8p Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Download Progress:", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://propdfhub.com Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": true, "third_party_hosting": true }
URL: https://propdfhub.com
URL: https://propdfhub.com/dl/thank-you?cid=fNK8V6bSBo7vQFT8p Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Click here to try again", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://propdfhub.com/dl/thank-you?cid=fNK8V6bSBo7vQFT8p Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: https://propdfhub.com/ Model: Joe Sandbox AI	{ "brands": [ "Pro PDF Hub" ] }
	{ "brands": [ "Pro PDF Hub" ] }
URL: https://propdfhub.com/dl/thank-you?cid=fNK8V6bSBo7vQFT8p Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: https://propdfhub.com/dl/thank-you?cid=fNK8V6bSBo7vQFT8p Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Click above Then click the PDF Installer file", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": true, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://propdfhub.com/dl/thank-you?cid=fNK8V6bSBo7vQFT8p Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	unknown
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.676048742462893
Encrypted:	false
SSDEEP:
MD5:	E94FB54871208C00DF70F708AC47085B
SHA1:	4EFC31460C619ECAE59C1BCE2C008036D94C84B8
SHA-256:	7B9D553E1C92CB6E8803E137F4F287D4363757F5D44B37D52F9FCA22FB97DF86
SHA-512:	2E15B76E16264ABB9F5EF417752A1CBB75F29C11F96AC7D73793172BD0864DB65F2D2B7BE0F16BBBE686068F0C368815525F1E39DB5A0D6CA3AB18BE6923B898
Malicious:	false
Reputation:	unknown
Preview:	0..r0..Z.......vS..uFH....JH:N.0....H........0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450...200318000000Z..450318000000Z0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450.."0....H.............0.........-.0.z.=.r.:K..a....g.7..~.....C..E..cW]....%..h.K..K.J...j..a'..D...?".O.....(..].Y.......,.3$.P:A..{.M.X8.........,..C...t...{.3..Yk....Z.{..U......L...u.o.a.tD....t..h.l&>.......0....\|U..p\$x %.gg...N4.kp..8...........;.gC....t./.....7=gl.E\.a.A.....w.FGs.....+....X.W..Z..%....r=....;D.&.........E.......Bng~B.qb...`.d....!N+.mh...tsg1z...yn\|..~FoM..+."D...7..aW...$..1s..5WG~.:E.-.Q.....7.e...k.w....?.0.o1..@........PvtY..m.2...~...u..J.,....+B..j6..L.............:.c...$d.......B0@0...U...........0...U.......0....0...U.........F...x9...C.VP..;0...*.H.............^+.t.4D_vH(@....n..%.{...=..v...0 ..`.....x.+.2..$.RR......9n....CA}..[.]...&..tr&....=;jR.<../.{.3.E.....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.239498819991208
Encrypted:	false
SSDEEP:
MD5:	C0C6BF9879E3F968399F7EE20460D549
SHA1:	D24ADFA2158772B9DEEC8FCD8B782C6400252C4B
SHA-256:	16C660F80F3CAD4C5C2ECFB8F2BBE034704661484D78DEB72AB4C9C126B501F4
SHA-512:	0653A772575488955FE8F94745F2E629A865E70BF5D2F50CA9CC990581C36EE5D25466BBDEB9F05051249E0674A5C001C550BFC24884852673B1C36BAC5CB8F9
Malicious:	false
Reputation:	unknown
Preview:	p...... ........% ..&?..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	264
Entropy (8bit):	3.1537500202709894
Encrypted:	false
SSDEEP:
MD5:	F5345DA845801EAAD23C0BDEFC51A61B
SHA1:	4E9D80D16EA6CB96D1D6FD0D25673034F00B7DE6
SHA-256:	980A0745B66E00A0172339B4736389FC5AC86F1B1EC58D722002DFDCF3088ECC
SHA-512:	E7B25B9BC859A94919E0B17EC2352140E219A1962E8CBD56BE3061D7699B9CFB59610817D570990374A7A086CF52B43E951827A1F7B9F809E1ECE6FDFC181E8D
Malicious:	false
Reputation:	unknown
Preview:	p...... ....v....F..&?..(....................................................... ......................N.....v...h.t.t.p.:././.s.e.c.u.r.e...g.l.o.b.a.l.s.i.g.n...c.o.m./.c.a.c.e.r.t./.c.o.d.e.s.i.g.n.i.n.g.r.o.o.t.r.4.5...c.r.t...".6.2.f.a.4.8.4.5.-.5.7.6."...

C:\Users\user\AppData\Local\EPISoftware\installer.exe.part

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	43697449
Entropy (8bit):	7.995798571049398
Encrypted:	true
SSDEEP:
MD5:	FC87134CF5C2EF4E8BF88D2888CDF77F
SHA1:	5F05B4B2597B477A887FA09F3D2C8D12D2DED3A6
SHA-256:	7AEDE2A006E1C9AA2BA639D497A0AC0E16400CDF707BEAB8B22429978764DF52
SHA-512:	4228010D3EC4071A140FD43136B33B951CA2CE68AA51910F45630655D13C8171E49230383B4B93480CAA23E4EDBD6508B815A3E37C1EF4C2FBA004B603EBB93C
Malicious:	false
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...9~.f.........."...........'......=.........@.............................p8.......8...`.........................................(...W.................#.....dn...p7..(...P8.d...<....................... ...(.......@...........................................text............................... ..`.rdata.............................@..@.data....~...`.......F..............@....pdata..dn.......p...(..............@..@.gxfg....-...P......................@..@.retplne.................................tls....2...........................@..._RDATA..............................@..@.rsrc.....#.......#.................@..@.reloc..d....P8......^7.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI545.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608380087035959
Encrypted:	false
SSDEEP:
MD5:	EC6EBF65FE4F361A73E473F46730E05C
SHA1:	01F946DFBF773F977AF5ADE7C27FFFC7FE311149
SHA-256:	D3614D7BECE53E0D408E31DA7D9B0FF2F7285A7DD544C778847ED0C5DED5D52F
SHA-512:	E4D7AAFA75D07A3071D2739D18B4C2B0A3798F754B339C349DB9A6004D031BF02F3970B030CEC4A5F55B4C19F03794B0CE186A303D936C222E7E6E8726FFFFF7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L...l..f.........."!...).....`............... ......................................Di....@A............................L...,...@....................Z..`=......h....K..p....................L...... K..@............ ...............................text...Z........................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.008177261119409
Encrypted:	false
SSDEEP:
MD5:	AF14DB36D60B3CC2183F8ED2DE992B58
SHA1:	09180EBC2CA6A2813D536AC017F26E66A85AF266
SHA-256:	514F3C1F4FFD7C3A5C953232DDEE8A485AAFA3B2A0650844225B0842F8F93D6F
SHA-512:	8715E25A516476A6BA48D66F060D4F43F587FDB4F1D5EE6F3CC78D4DC8E5041E111E88A47910B4789D1BDE59E3EE059E5B42A666375E7593133F05B24CC735B8
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IyY2U....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY@U....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY@U....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY@U..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............(......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 09:42:01 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9946312426805894
Encrypted:	false
SSDEEP:
MD5:	9B4CC6C41A8F9CC4F41CC112B9C1A493
SHA1:	C6E85A7FAD6660E9F7CB54736CF087E712EED4B7
SHA-256:	13465C507372BA6E0A564CA14FC3E9DFF3BAB1CA62C52AB497A353FA75951DC9
SHA-512:	CE18C12976339C7D497A43FF4C70864E6025D3CEBB702F354005F820E1668827A3F9DD33A89EA357AE060F26613F5BB1D8470F3469F605626C9A90B709E43829
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....@.&?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IyY2U....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY@U....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY@U....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY@U..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyYAU...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............(......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\ProPDFHub.msi (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {7230FB38-9EC1-4C53-831F-5ED5E4AC3240}, Number of Words: 10, Subject: EPI PDF, Author: EPI Software, Name of Creating Application: EPI PDF, Template: ;1033, Comments: EPI PDF 20.1.2009.2, Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Thu Nov 21 08:24:28 2024, Last Saved Time/Date: Thu Nov 21 08:24:28 2024, Last Printed: Thu Nov 21 08:24:28 2024, Number of Pages: 450
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	27EF0143D7ADB39A9D3A5A3585F1312D
SHA1:	5321DDC0C261D1110C0870FE8D05D4D1A00C65C2
SHA-256:	CE8F285CDDEEDCF1246A82B924F7E82BEE45B61DA1133C9A1DEDF1CF3FC182D1
SHA-512:	521A8FA5D76AA9846490A721CE8E250B9B2289D090DFA48711C568893BCF42657CFBBFB2059A6A6232301CD6F82607639F92313F61F9F6262E8C409695A5C30C
Malicious:	false
Reputation:	unknown
Preview:	......................>...................6...................................I.......y.......r...............................h...i...s...t...u...v...w...x...y...z...{...\|...}...~...................{...\|...}...~...........................................................................{......................................................................................................................................................................................................................................................."...5............................................................................................... ...!...-...#...2...%...&...'...(...)...*...+...,.........../...0...1...6...3...4...=...@...7...8...9...:...;...<...H...>...?...n...A...B...C...D...E...F...G...............K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Downloads\Unconfirmed 530306.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {7230FB38-9EC1-4C53-831F-5ED5E4AC3240}, Number of Words: 10, Subject: EPI PDF, Author: EPI Software, Name of Creating Application: EPI PDF, Template: ;1033, Comments: EPI PDF 20.1.2009.2, Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Thu Nov 21 08:24:28 2024, Last Saved Time/Date: Thu Nov 21 08:24:28 2024, Last Printed: Thu Nov 21 08:24:28 2024, Number of Pages: 450
Category:	dropped
Size (bytes):	3493888
Entropy (8bit):	6.703161929532187
Encrypted:	false
SSDEEP:
MD5:	27EF0143D7ADB39A9D3A5A3585F1312D
SHA1:	5321DDC0C261D1110C0870FE8D05D4D1A00C65C2
SHA-256:	CE8F285CDDEEDCF1246A82B924F7E82BEE45B61DA1133C9A1DEDF1CF3FC182D1
SHA-512:	521A8FA5D76AA9846490A721CE8E250B9B2289D090DFA48711C568893BCF42657CFBBFB2059A6A6232301CD6F82607639F92313F61F9F6262E8C409695A5C30C
Malicious:	false
Reputation:	unknown
Preview:	......................>...................6...................................I.......y.......r...............................h...i...s...t...u...v...w...x...y...z...{...\|...}...~...................{...\|...}...~...........................................................................{......................................................................................................................................................................................................................................................."...5............................................................................................... ...!...-...#...2...%...&...'...(...)...*...+...,.........../...0...1...6...3...4...=...@...7...8...9...:...;...<...H...>...?...n...A...B...C...D...E...F...G...............K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Downloads\b6c9ace2-5767-4e89-b6a9-061369497eb9.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Composite Document File V2 Document, Can't read SAT
Category:	dropped
Size (bytes):	5397
Entropy (8bit):	4.384847034884802
Encrypted:	false
SSDEEP:
MD5:	1AA1773587F8E57E0C796BA267A926FA
SHA1:	BCD7174EFF951E7F478B037A98FAA27D09E245B3
SHA-256:	EAECB8A3C7BA740B5B252F4B1EE76620DD2E2579BDF397A136522C1B47CD05BD
SHA-512:	E66FD83809B0D9B361418168EEE0DAA4F930D6944403063B3BF35A998275CFD36B033E49A2CFBE8FEFA53058363F4D2A0876EB996A25B34AADE08738E92D1E40
Malicious:	false
Reputation:	unknown
Preview:	......................>...................6...................................I.......y.......r...............................h...i...s...t...u...v...w...x...y...z...{...\|...}...~...................{...\|...}...~...........................................................................{......................................................................................................................................................................................................................................................."...5............................................................................................... ...!...-...#...2...%...&...'...(...)...*...+...,.........../...0...1...6...3...4...=...@...7...8...9...:...;...<...H...>...?...n...A...B...C...D...E...F...G...............K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI143A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1592762
Entropy (8bit):	6.726438075303584
Encrypted:	false
SSDEEP:
MD5:	F4DB2E08A4F2E3133DBBB91CCB874011
SHA1:	57D4B1D2AE7B01F128AB77B01F2F3454E79A09E2
SHA-256:	1F7B75FA55C4DA2ABC7597AAF09654665AF8BBD8AB580686B765311EF57ED5C7
SHA-512:	0232856DE796EA7884C64103F0EC3BFF2BCBFD6C13F9CC6381F31D281B2D734E4DEAECAB54A75090997E9F5E7C6CA41DB69AE68C810B98C3FB420C7423CC73D6
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@Y-yY.@.....@.....@.....@.....@.....@......&.{DD86AD20-EACB-446C-83F3-83B2A77C3D42}..EPI PDF..ProPDFHub.msi.@.....@.....@.....@........&.{7230FB38-9EC1-4C53-831F-5ED5E4AC3240}.....@.....@.....@.....@.......@.....@.....@.......@......EPI PDF......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{C6DDA962-6EBA-4DFF-8B39-D66799784604}(.C:\Users\user\AppData\Local\EPISoftware\.@.......@.....@.....@........CreateFolders..Creating folders..Folder: [1]".(.C:\Users\user\AppData\Local\EPISoftware\.@........AI_FdRollback..Rolling back downloaded files#.Rolling back downloaded file: "[1]"J...AI_FdRollback.@.-....h$..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.!qg.O"g.O"g.O"..L#k.O"..J#.O"w+L#..O"w+K#v.O"w+J#1.O"..K#..O"..N#~.O"g.N"-.O"/F#..O"/O#f.O"/."f.O"g.."f.O"/M#

C:\Windows\Installer\MSI1517.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	795752
Entropy (8bit):	6.725813999920173
Encrypted:	false
SSDEEP:
MD5:	8D7DB54BD4DB23E5F8B8CFD791307E85
SHA1:	792B0B4B8C7062D1EB56656E3EE3330F728BC776
SHA-256:	8188B77BD8F60CD0B929EF70B71CD7E4F6D77E4F276A4E99723964B49CE0A4A8
SHA-512:	DFA2B900810573A82619B6E12C08F1490DB4A65342FC5881BB8AAFC1DB0D9E1EC75486B44F50D71CEE747C3A3F13C466047EE1A8D25D3C1927C04559EF372FD3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.!qg.O"g.O"g.O"..L#k.O"..J#.O"w+L#..O"w+K#v.O"w+J#1.O"..K#..O"..N#~.O"g.N"-.O"/F#..O"/O#f.O"/."f.O"g.."f.O"/M#f.O"Richg.O"........PE..L......f.........."!...).............................................................n....@A........................@n..D....o..........................h:... ..Xd......p...................@..........@...............d............................text...J........................... ..`.rdata..`...........................@..@.data....a...........j..............@....fptable.............\|..............@....rsrc................~..............@..@.reloc..Xd... ...f..................@..B........................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	454234
Entropy (8bit):	5.356172972886662
Encrypted:	false
SSDEEP:
MD5:	89C06619ACA30C42A634EB7ED98B2AB3
SHA1:	C05DF1F904644BEA54D293EF50B0971290024B05
SHA-256:	985D5BE21CA59B68770FC6460E480608BB807BC2B65FE0B3CB28E630FCE505A2
SHA-512:	B2F03D5D11668DBB5ED2CFA019B171872484F270ECE77218D608A3E686432497F63CB15E7EF8D7A5F401CD4ED06AAC3EC0A016764F58D21BA91E25DB7683F5B7
Malicious:	false
Reputation:	unknown
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF5CB88856735E0BA7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF610BA5C629EC9D3C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2566013027170784
Encrypted:	false
SSDEEP:
MD5:	662857B44E54DAE9E4F9994A4A24FFE2
SHA1:	8BFD8607B4FDF1E40E2BA3A62AD37BFD4C88A023
SHA-256:	4444D24255896CE9CD6E8247D583B5B575F23AC9D125E6813F8BD576AAD77F41
SHA-512:	4D76ED790BAE9EAB55E22F8E9835A55DF7EEB8B5FD0ED38AB346481C29AF5DF0ED045B0F650B49703CA070E4BBDA581CF30576C071F1F561258CDAF7D6082833
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 512 x 449, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	28043
Entropy (8bit):	7.8700715858929104
Encrypted:	false
SSDEEP:
MD5:	24A6AC7A5093D9DA032D5FADD9A0B4AC
SHA1:	2266EE47F5591FD04978EE73B9987C1E3E298389
SHA-256:	D4728250AB2D27B8CC7E922C02DA3FCF63576A4EDD4C57EB6D970C7685A3F743
SHA-512:	70B338023A46899DCE1B5F3F78276C9BE75FD74FD381CA0E896154BEB4C800A831F0F575A8197312EB20318BEFB3C43DAF9BBEDA906BBED256865677D802FE8E
Malicious:	false
Reputation:	unknown
URL:	https://propdfhub.com/images/pic-3.png
Preview:	.PNG........IHDR.............(..D....PLTE....U..............~............5.............}.................U.....{.....\|...6................-4.U.................\|..V........}.........}.....{..............\|..............V.................................................3.y.........T..y....................-2.+/.......,3...\|........U.....y............z...........z.....c..R..............b.............T../=...}........T.......'...v................>.......Y...y.q...i.......(6;..............;.....W..........2..R............J.....-..P\`....].3AF...f...........o....._......q{.#(,..........o...."^.\|.....)..~..~.._koR............7_?OY.1J......ZNP...........p.7t.Dy.....Bs...+j..........`..<9:......H..ts......5l....a..j.........f........tef....................N.ICE....#@V.......Lk.e.C...jFIDATx...Aj.0.F.!..2...7.Q...*i....c.....+....6.........................R..$I....p)]..,..E......B........W.i3M.\.'....H..X..7..N^...].v......6.7.k.l;.....A+......@......v..x...}

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4828), with no line terminators
Category:	dropped
Size (bytes):	4828
Entropy (8bit):	5.805158687172649
Encrypted:	false
SSDEEP:
MD5:	04DE655821D9FE73E02D926602708052
SHA1:	0BCC1F857A43DB1FB94DCB420D863611ABDD96D7
SHA-256:	0B9F7B73A57A5596C1FD331EE23AFE71DF1761E1E06998CDAC42F769943DF72A
SHA-512:	14031E113FC2A54C59020D240CB1A02CA6AFB56FF4D22CCF4D0F59BE7CACCC3B6C1C9A1DBB4974A144D9BA8927323772C5AF46AC2A1C268443094206DD5B5A36
Malicious:	false
Reputation:	unknown
Preview:	(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(b,a,c){if(b==Array.prototype\|\|b==Object.prototype)return b;b[a]=c.value;return b};function k(b){b=["object"==typeof globalThis&&globalThis,b,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var a=0;a<b.length;++a){var c=b[a];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");} var m=k(this),n=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",q={},t={};function u(b,a,c){if(!c\|\|b!=null){c=t[a];if(c==null)return b[a];c=b[c];return c!==void 0?c:b[a]}} function v(b,a,c){if(a)a:{var d=b.split(".");b=d.length===1;var e=d[0],g;!b&&e in q?g=q:g=m;for(e=0;e<d.length-1;e++){var f=d[e];if(!(f in g))break a;g=g[f]}d=d[d.length-1];c=n&&c==="es6"?g[d]:null;a=a(c);a!=null&&(b?h(q,d,{configurable:!0,writable:!0,value:a}):a!==c&&(t[d]===void 0&&(b=Math.random()*1E9>>>0,t[d]=n?m.Symbol(d):"$jscp$"+b+"$"+d),h(g,t[d],{co

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 34328, version 1.0
Category:	downloaded
Size (bytes):	34328
Entropy (8bit):	7.992979044306872
Encrypted:	true
SSDEEP:
MD5:	6581AB53C220B5828E37162349375431
SHA1:	1922912CA5AB6EB5A55DB138B183B38D066E85C8
SHA-256:	A8E429611131E3FDC2018EC943A36100DBABB4AAA788C8DEAD6BDCF927917293
SHA-512:	B8FE079BD4AACD01FA41799999452B27051A4CCB4DBB91D9E1F2662C5D6112032B1633DFB2E31DB71F57FB4511A48B55646D034BD6F81CAF017ED0DACE0603F2
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufN5qU.woff2
Preview:	wOF2...............D..............................l..H...?HVAR...`?STAT..'...@/l.....p.<....0..F.6.$..(. ............l.V3.....'%6..&...%;N5.!l.@4.[.......}Xw.F....R..z..i"\:.S.v..g..j..s\...E(...B...#43....f..i.ql....\|>6.4..C..\..D\|fmt..C......'./.`..T.........[.3.......}H\.R.8.6w].b.:.]'..x..}/....J tA...V>..w\..5..W..j6..f.Z.b...#( .@bHH..nv....3.;...@......\..v..1Hr.v....=<.._P.......l..#...@....h.kx^....U..t..E.g4K.D....#.1v.7.3VD.....)...jt.yk..s..O.'.U.Z.....y.D....\.b.<!$..!h....x(T.B.!..n....kG.;k...kU).u..jG.."..@..Hc.B..o)ex..?"G.16....F...q.}.z...g.U..(....?...?........E.F1.1P.Ft.....c.w....n3.o.9.Z2..P,5..QNmF+Hv.V..!..!..)....}.z.../ .r.x......db..GY.e.;.....l..k.....h..S.....X.1..y.P.v>..V..h@j.m.......Z..n..am..s>w.C...4.Rl.....s.J..n...1.h..........'.5(..s..Zc..>r.s..G.r6...l.xf,mJ.,........J..4.......>m&.=.u..[v...y37I&K...,~ ..An..A.P1...'l....p.u.U.....k.i..5w.ou..~u._E.`....}?..............BF...(....1**.=2...#q.m?K.YD....y

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2513
Entropy (8bit):	5.4964210142668035
Encrypted:	false
SSDEEP:
MD5:	756C06E7DD81CC024B9956AE73DE4998
SHA1:	A0E125E371CC2DBD4518AC50F3B36BC21387AD6A
SHA-256:	7C88DA72A8A895618E967DCB4FFD5E57637405A9C7C4B1030188F74B5E33B827
SHA-512:	32EACFC78132091F5F36252CD1CD795BC60EDD0BC3A77F1860014ECCDCC2C4736F15583B92FB2F1E5A34DE81FD300012E540B7C0C7379D2B4578A90F3665730E
Malicious:	false
Reputation:	unknown
URL:	https://fonts.googleapis.com/css2?family=Roboto+Slab:wght@100..900&display=swap
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Roboto Slab';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufA5qW54A.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Roboto Slab';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufJ5qW54A.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Roboto Slab';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufB5qW54A.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Roboto Slab';. font-style: normal;. font-weight:

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1040 x 631, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	50621
Entropy (8bit):	7.983572934286031
Encrypted:	false
SSDEEP:
MD5:	51BB049CE8E7AD2BA87D094496E248C2
SHA1:	41D7F4A2661387E6C60E7F11852B84A0D5FB79AB
SHA-256:	A0C1E3233C5F1FEC7838581FFC29E1625444C2CD1254FFBDDF79D9D704D0994C
SHA-512:	75CD9999A768FD33992E0E9DE73F7137249E6BCE3C759BCAB97007B29A03D75C6F7B67521B0A31A5EB556760245E82B7A61A21714BBC1E070460508D6D9AD87A
Malicious:	false
Reputation:	unknown
URL:	https://propdfhub.com/images/pic-1.png
Preview:	.PNG........IHDR.......w.......R.....PLTE......//0.....-...,+,.....679rsv......................%....................UWYmnp....y{~.........$0......................4. bfiy\|.S..........$0.............-...... -##-...!%0...."~......#/.'2.PW.@I.........dr.......$06@T..,fs.z......n.es........xT.#/.&2.!/.....an.<FY...................................eq..$2............................lt....4>Q......iv.......}..FQc...........!,......lw.!+;lx..+6............s{.3B.^f..v...cD/9J.pw.......hp..&.^j{....&3........IR.........7A....S]m..,.....\|..LWhXct...............}......^.pO...,%0...3].....y.k<BLp...d......./?.h.<?NB/8...]RX9E.&3.................L...........!.....>_..qVJ>M..p.RK.4D.C?4.....h..R.$...?.....px.GK].....x....gNO..}4@...[O{q"0.UG..'........cpzCcaH]{s....F...ItRNS.G.......&..../.....E..Ek.?0.ZB.2....U.x.k.7\{cXg.........i.......w........&IDATx...?..A....ppJ....?....E,d5K.-T.JFG.pXng!v.....Z......&..6........Vnr95Y7......,a_..g.....l.

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2310)
Category:	downloaded
Size (bytes):	253442
Entropy (8bit):	5.552190700415061
Encrypted:	false
SSDEEP:
MD5:	F0C1EE1C38C32C157AC22D2C81CC721F
SHA1:	23E47C9FD10B64C2E65C7E81491050B1C9312505
SHA-256:	26523EF1A439F83B4B21D24528DD9CDE099E124BD6166FAF2A1DC68DBFFA59A3
SHA-512:	893325730DAF2134BC59AF888BCC71E59C30ED480224DC0AB7C53CD921A3B2FF4B96F051A9202C58A1A06989D44A8D258856D705AB621E6898B9380D32E28F06
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/gtag/js?id=AW-
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__cid"}],. "tags":[{"function":"__rep","once_per_event":true,"vtp_containerId":["macro",1],"tag_id":1}],. "predicates":[{"function":"_eq","arg0":["macro",0],"arg1":"gtm.js"}],. "rules":[[["if",0],["add",0]]].},."runtime":[ [50,"__cid",[46,"a"],[36,[17,[13,[41,"$0"],[3,"$0",["require","getContainerVersion"]],["$0"]],"containerId"]]]. ,[50,"__e",[46,"a"],[36,[13,[41,"$0"],[3,"$0",["require","internal.getEventData"]],["$0","event"]]]]. .].,"entities":{."__cid":{"2":true,"4":true,"3":true}.,."__e":{"2":true,"4":true}...}.,"blob":{"1":"1"}.,"permissions":{."__cid":{"read_container_data":{}}.,."__e":{"read_event_data":{"eventDataAccess":"specific","keyPatterns":["event"]}}...}....,"security_groups":{."google":[."__cid".,."__e"..]...}....};.....var h,ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{d

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (56653)
Category:	dropped
Size (bytes):	514981
Entropy (8bit):	5.421347038075334
Encrypted:	false
SSDEEP:
MD5:	979643DADD4B021CA3DD96C4B4890DCA
SHA1:	B56411BA3011DBA6705CC6237A85601CF5A2CF85
SHA-256:	7A2BD5B0488C7F1AC6023B31A02C29769928A699AA1AAD48068629EF68D29E6B
SHA-512:	4D13DA5716F053D571ABFB2AFE63D878E8F9BD7CF6C6EFF961D612A8C42AFF0A939393AE850F91DE38A0C07DD26D7F4DA34071BB127D493196989B1D88FA0904
Malicious:	false
Reputation:	unknown
Preview:	(function() {.const __TERMLY_CLIENT_INFO__ = {"continent_code":"NA","country_code2":"US","state":"New York"};...const __TERMLY_WEBSITE_CONFIG__ = {"enabled_frameworks":[],"website":{"uuid":"4735e287-6f94-474b-9109-31fb52844ee0","id":3646483,"name":"propdfhub.com","over_consent_quota":false,"consents_count":0,"provisions":[{"id":null,"key":"allow_sub_domains","type":"boolean","config":{"value":true},"data":{},"create_time":null,"update_time":null,"delete_time":null,"provision_set":{"resource_id":"4735e287-6f94-474b-9109-31fb52844ee0","resource_type":"website"}},{"id":null,"key":"allowed_policy_embed_options","type":"list","config":{"allowed_list":["html","embed","url"]},"data":{},"create_time":null,"update_time":null,"delete_time":null,"provision_set":{"resource_id":"4735e287-6f94-474b-9109-31fb52844ee0","resource_type":"website"}},{"id":null,"key":"allowed_scan_periods","type":"list","config":{"allowed_list":["weekly","monthly","trimonthly"]},"data":{},"create_time":null,"update_time":

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	4858
Entropy (8bit):	7.852604653648413
Encrypted:	false
SSDEEP:
MD5:	4E4A97B79D34CB776CE6B129FB1C4F42
SHA1:	958BEE769790A17796FB3F2A982058CAEEF60CA1
SHA-256:	6BC472F29C31C31F7878D5E6E42F923DEA6DD33E6E6516A0CE0CDE7A65F78E9F
SHA-512:	B3CE9AD8356531EABC2E4BF7BDEDC0D89135ACB018AA29B3F2D2FF6603750175BC7274353184DFCD5DF1222D4BC0AFAD5AA610FA381F77B9BA764D5F694B8E12
Malicious:	false
Reputation:	unknown
URL:	https://propdfhub.com/images/ico-2.png
Preview:	.PNG........IHDR.............k.XT....PLTE......}}}....................................UUU................................................................................................???.............................................}}}.......................................???....................................5.^/...ZtRNS..9n.....V.O..........(...{.".s...32.`.,.g..xgH8...nC.\R..VN@K*{>%ZF.6..Iyi^QMtC.@7../...>IDATx...yw.@.....$.....4.R(.......j.^..?.>....Bv.U...{.d....M...................S...qu...o..}..../.W.N\Q..k.-.\.I.G8......-...&{.LK8.\..d...9._......q.?.!.....r..?..0..u3.P.K.[..S.iDB...S..N..Z.}.>.....A..b.r...I....5.?^\|.\.Hu.x\..6..\|Ql'.]/r..`N.b_r:.n].T.HM.9Zk.e. y..9...%..V..a$.Z.h.....A.R......&._of...9.Y..h.7K).H....m}y.W.T...V....f...[.i.Y Q:..h[.IEjk0.......f........RidZ...]..(g+.$}.iP.%.S.u...z.&L...3.`....E.V.A.N4.RFO.^9....\$..+..Y..XC..S...#\...i.K....-...&c7.}...4...L..n../.+LC.h%...&!...rU...u......B.L.y1.(...$..h.EL.1G..D{......3....

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (474)
Category:	downloaded
Size (bytes):	7978
Entropy (8bit):	4.285965290281468
Encrypted:	false
SSDEEP:
MD5:	AA64B484F787149DE28CF8E1294BD336
SHA1:	3A8FC56914022702E6A2F4FEEA9FB7E87FC2307B
SHA-256:	1F1313D3BB7FD4B3DB38475F8B677D76F8D03607FDA8784A9D5D678BFF96DA18
SHA-512:	4717DA6EBE6AE26BBE735848B0628FC1823B7EDD919614B42BC28EF0808CD0D1271283BBE8802FFCD517B16A25BEC9C57C352C77B7931B95450E1DF92FA1C2A6
Malicious:	false
Reputation:	unknown
URL:	https://propdfhub.com/dl/thank-you?cid=fNK8V6bSBo7vQFT8p
Preview:	<!DOCTYPE html>.<html lang="en">..<head>. <script type='text/javascript' src='https://app.termly.io/resource-blocker/4735e287-6f94-474b-9109-31fb52844ee0?autoBlock=on'></script>. <meta charset="UTF-8">. <meta http-equiv="X-UA-Compatible" content="IE=edge">. <meta name="robots" content="noindex,nofollow">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title></title>. <link rel="icon" type="image/x-icon" href="https://res.propdfhub.com/images/favicon.png">. <link rel="stylesheet" href="https://res.propdfhub.com/ext/thankyou/style.css">. Google tag (gtag.js) --> <script async src='https://www.googletagmanager.com/gtag/js?id=AW-'10944743139></script> <script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'AW-10944743139'); </script>. Event snippet for onlineconv conversion page In your html page, add the snippet and call gtag_report_co

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2310)
Category:	dropped
Size (bytes):	253442
Entropy (8bit):	5.552124346714343
Encrypted:	false
SSDEEP:
MD5:	0D89F1264D7E646487428A3EA3D3488B
SHA1:	B32C738932B135A29C0BEA1436C7FA75F47AD856
SHA-256:	4940553887213104D7D88DD82644D39915EA25E49BB1327633726222B257F0FB
SHA-512:	A79461CABFAE1CCFC2B873144328066123B8CE09AC63BDE9CC241B42D913575D6D455AAE7B7D58FD3FD02C69D8D666490949B7504ABE7929AF366CA213339DBC
Malicious:	false
Reputation:	unknown
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__cid"}],. "tags":[{"function":"__rep","once_per_event":true,"vtp_containerId":["macro",1],"tag_id":1}],. "predicates":[{"function":"_eq","arg0":["macro",0],"arg1":"gtm.js"}],. "rules":[[["if",0],["add",0]]].},."runtime":[ [50,"__cid",[46,"a"],[36,[17,[13,[41,"$0"],[3,"$0",["require","getContainerVersion"]],["$0"]],"containerId"]]]. ,[50,"__e",[46,"a"],[36,[13,[41,"$0"],[3,"$0",["require","internal.getEventData"]],["$0","event"]]]]. .].,"entities":{."__cid":{"2":true,"4":true,"3":true}.,."__e":{"2":true,"4":true}...}.,"blob":{"1":"1"}.,"permissions":{."__cid":{"read_container_data":{}}.,."__e":{"read_event_data":{"eventDataAccess":"specific","keyPatterns":["event"]}}...}....,"security_groups":{."google":[."__cid".,."__e"..]...}....};.....var h,ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{d

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	12612
Entropy (8bit):	4.821091366638074
Encrypted:	false
SSDEEP:
MD5:	6FA06B587DFCA418BFA6C9C97BE80482
SHA1:	3D515D692EBE8232AAC2248E31AB58A70DF3834D
SHA-256:	477EF7BCBC1FA2C4F2C74FA3D20CF2B3D26BCCD12602DF6C6164DF66BEB12E5C
SHA-512:	FB76E581B56294406F11C0CA4D1CA5838C04B1870AAAD4484F9AEA2B215B6BB023C42F285B36FDBE31BD295C01FAE550643529850C4C77B03598FCD5655C39CB
Malicious:	false
Reputation:	unknown
URL:	https://propdfhub.com/css/styles.css
Preview:	@import url("https://fonts.googleapis.com/css2?family=Roboto+Slab:wght@100..900&display=swap");.* {. -webkit-box-sizing: border-box;. box-sizing: border-box;. scroll-behavior: smooth;. scroll-margin-top: 50px;.}..body {. position: relative;. margin: 0;. font-family: "Roboto Slab", serif;.}..body img {. width: 100%;.}..body a {. color: #000;.}..body .sub {. max-width: 768px;. margin: 0 auto 50px;.}...btn {. background: #C42430;. color: #fff;. font-weight: 600;. display: inline-block;. text-decoration: none;. font-size: 27px;. padding: 20px 50px;. text-transform: uppercase;. -webkit-transition: .3s;. transition: .3s;. -webkit-box-shadow: 12px 12px 12px #00000029;. box-shadow: 12px 12px 12px #00000029;. font-weight: bold;.}...btn:hover {. background: #2C6769;. -webkit-transition: .3s;. transition: .3s;.}../* HEADER */.header {. padding: 20px;. z-index: 9999;.}..@media (min-width: 1300px) {. header {. position: absolute;. top: 0;. left

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 500 x 159, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1349
Entropy (8bit):	7.436622218311567
Encrypted:	false
SSDEEP:
MD5:	84B7BB61400047C52E82662337C4F3BB
SHA1:	2711E09BFCD52277AEAAFBDD9DB6FE4A9FF2E1E1
SHA-256:	D53541781B3BBB7FAC1249D0C1E81A0B9FACCC0B805DF64881BFB4B33C39615F
SHA-512:	BF2C4D47082B2F18BEB07F461C9C45B8FD862E35B203059FB7441144E9350024A9BB51BBA3559D71B21063B43CF15155545917B05A57579246EC31B72F9858DD
Malicious:	false
Reputation:	unknown
URL:	https://res.propdfhub.com/ext/thankyou/arrow-right.png
Preview:	.PNG........IHDR.............8L....2PLTE......LLL................................................................................mml...................................................20.RRR......rrr.........(&%......kkk.......................jdd<..E.................;..G..=..?.....'........B..~..i..N..2..+....................R................n.....EtRNS../....1.....................G6.............vj?+&.........\|k][[A/).&PH...}IDATx....J.@.....uI..t.t..........?.I.B..../.R..{`4.!.=..........=.:..R).......4ETj..H#.....P;.@....'.=.P..%q.$ul...P...*.Msaiz... .b-R^tSpn9F..>....II....lk...=.`..Hy.6..........KJuh.-...+T....$u....k.2.....R.p,.#..$O.0...m!......f.RK.._.s...)D.<..u.]5/....\8...n.U....pGJ6w.~KL...o..9/..7...:~2.w....#...at..........g....6...k.L.3:...>.9..0...nq..D...K..%...Bt.!...]B......@....@... .B...I..>$}H...!.C...I..>$}H...!.C...I..>$}H...!.C...I..>$}H..........A..t..N...:.t:.t...A..N...:.t:.t...A..N...:.t:.t...A..N...:.t:.t...A..N...:.t:.t...A..N...

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	3519
Entropy (8bit):	7.704232142863915
Encrypted:	false
SSDEEP:
MD5:	365676D96B304AD84BFC7AC95E554E2A
SHA1:	2273B2A207BB79C77245AE4AC8D7772B20736043
SHA-256:	EBD489E02DE575D855592769DF7E5E95639D409598CF974ED8D2F2E8DFA5CC4E
SHA-512:	1895FFF435C6B7B25FD0D6FD56B47FB3DEFDAE7B1A07687AD140E4858B48330C6E3F12D09A2ABCB0D58ED42138BA90B582D08D0031C499B4EC732B64EC7BBFFE
Malicious:	false
Reputation:	unknown
URL:	https://propdfhub.com/images/ico-1.png
Preview:	.PNG........IHDR.............k.XT...APLTE.....................uuu............ppp...............PPP.....................{{{~~~...............===..................???......................................................~~~.......................................~~~.................................................................................~~~................c.....ftRNS..P..}...?...t.......m......rY...... .....i.x$...=.1..C-'OC...ncZME,.R..?65...lfeF.^HuF.L.XT\|tcQKmc.V.....IDATx...{W.A.....d.8....D@..Q0$....bv.{.:?....bvA.Q.....\|..o./3G....(..(..(..(..(........pu............k.......\..n.Y...V.8....\.6....).}. ..{..iS..^.2...6...a..OK0.V.t.?30.<......]r..axv....2..'...5....f9...A`E..=.2O.Ms.B../...'W...<..].3....mv.A._...\.O@X.A;..R._=.......O..d.$..f.I../N..CX.A{.a.S_y..&sR.....3......A.C.r.'f..H..Yi".F........Z.B..Ji.6I....e.q.....C..../Y.....AD7.m.`..$...dxr..^..(..A..Q.@O.IQ[....kA....7...p.F3.}*......r.X...4T..A.P.T..`h..\|.....c.<@...T..@.P.T..@.P.N..v.].

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (453)
Category:	downloaded
Size (bytes):	8373
Entropy (8bit):	4.129828876274841
Encrypted:	false
SSDEEP:
MD5:	CAE2CC34DAB3DE004C242F1B31654B95
SHA1:	05C4AB6010BA33BE22983D4E0010925B03700ED0
SHA-256:	E9590CB46D89B5B4C1F5B51D94A6269BA7ADC96283D99E092310AA7D9C0A370B
SHA-512:	77B0F43B9E2BA2C58E014D136D693D79CE3F58CC375F9D4EEE77EC789327DB7EF82AE228C9162E78823F444BB77A8E593528FAC345F1A9BCBB6E2E165E285DBA
Malicious:	false
Reputation:	unknown
URL:	https://propdfhub.com/
Preview:	.<!DOCTYPE html>.<html lang="en">.<head>. termly script -->. <script type="text/javascript" src="https://app.termly.io/resource-blocker/4735e287-6f94-474b-9109-31fb52844ee0?autoBlock=on" ></script>. . <meta charset="UTF-8">. <meta name="description" content="Pro PDF Hub: Access essential PDF tools all in one place. Convert, edit, merge, compress, and sign PDFs with secure, user-friendly features. Start today!">. <meta http-equiv="X-UA-Compatible" content="IE=edge">. <meta name="robots" content="noindex, nofollow">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title>Pro PDF Hub - Easy Access to Essential Pro PDF Tools</title>. <link rel="icon" type="image/x-icon" href="images/favicon.png">.. CSS -->. <link rel="stylesheet" href="css/styles.css">. <style>* {margin: 0;padding: 0;}</style>.</head>.<body>. <header>. <div class="header_container">. <div class="logo">.

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1023x574, components 3
Category:	downloaded
Size (bytes):	40435
Entropy (8bit):	7.262780823525723
Encrypted:	false
SSDEEP:
MD5:	8E08464E9F4721C08DB8B484718E8B45
SHA1:	065AF56E41910FC359605CD0A95C332F3BB8ED83
SHA-256:	BD2C404DE1030BE8C6C8B8FC1FF66E21AECD509F060056D17B31F3EDBB1A6E19
SHA-512:	0BE511623DBC343C2E1286708A539C8369D523C00503DB8422632F015447D794EC5F705A878A7DED0EB5E65515662F221F5C01FE7358BD6FD098E440EAA4585D
Malicious:	false
Reputation:	unknown
URL:	https://res.propdfhub.com/ext/thankyou/download.jpg
Preview:	......Exif..II*.................Ducky.......d.....2http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a6a63968a, 2024/03/06-11:52:05 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 25.12 (Macintosh)" xmpMM:InstanceID="xmp.iid:D998DFBC9E7911EFBFA2D112F2FA53EA" xmpMM:DocumentID="xmp.did:D998DFBD9E7911EFBFA2D112F2FA53EA"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D998DFBA9E7911EFBFA2D112F2FA53EA" stRef:documentID="xmp.did:D998DFBB9E7911EFBFA2D112F2FA53EA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d..........................................................................................................................

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1223)
Category:	downloaded
Size (bytes):	19485
Entropy (8bit):	5.498123677217319
Encrypted:	false
SSDEEP:
MD5:	ACFAAF3B7DA03D515C434409A8CEDFE3
SHA1:	4E2FE4950FCED5DF7A649497A093614E0A7D778F
SHA-256:	A192CC8B869A545B6910C7CB5C96612499A856C49585A67D1629CEC7EBB83DA0
SHA-512:	8F6D029D18C0AEFECC9F864A9DAA33E19D6F7B73E9CE6D4FABEEB7DABACE55764A7DE6771604B2E2CF59BCC5E3E12D076D508D9773EA14E6E1B2188F25184AE0
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/static/service_worker/4bj0/sw.js?origin=https%3A%2F%2Fpropdfhub.com
Preview:	'use strict';var aa=function(a){function c(d){return a.next(d)}function b(d){return a.throw(d)}return new Promise(function(d,e){function f(g){g.done?d(g.value):Promise.resolve(g.value).then(c,b).then(f,e)}f(a.next())})},h=function(a){return aa(a())};/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self;var r,u;a:{for(var ba=["CLOSURE_FLAGS"],z=n,A=0;A<ba.length;A++)if(z=z[ba[A]],z==null){u=null;break a}u=z}var ca=u&&u[610401301];r=ca!=null?ca:!1;var D;const da=n.navigator;D=da?da.userAgentData\|\|null:null;function F(a){return r?D?D.brands.some(({brand:c})=>c&&c.indexOf(a)!=-1):!1:!1}function G(a){var c;a:{const b=n.navigator;if(b){const d=b.userAgent;if(d){c=d;break a}}c=""}return c.indexOf(a)!=-1};function H(){return r?!!D&&D.brands.length>0:!1}function I(){return H()?F("Chromium"):(G("Chrome")\|\|G("CriOS"))&&!(H()?0:G("Edge"))\|\|G("Silk")};!G("Android")\|\|I();I();G("Safari")&&(I()\|\|(H()?0:G("Coast"))\|\|(H()?0:G("Opera"))\|\|(H()?0:G("Edge"))\|\|(

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1486
Entropy (8bit):	4.496145606954209
Encrypted:	false
SSDEEP:
MD5:	F795A28F1E49FA0C3BDB198C2C718FE5
SHA1:	5D8594EE4E817A2D9954969A3D8222E602D09204
SHA-256:	779294959B7269D16634F2F0E524B7A2C080C1303367D5737F69A00AE65E3857
SHA-512:	3FE09B7ADD83C026566156E7D8D576A87819BF8D25A3B3FD840AAAFEE430E94EB98F01AD328B9B813813AC333D56630D5B71B636B3E6CA62024945B9EBAC855A
Malicious:	false
Reputation:	unknown
URL:	https://propdfhub.com/dl/home.js
Preview:	try{. function createLink(text, url) {. var a = document.createElement('a');. a.href = url;. a.textContent = text; . a.target = '_blank';. return a;. }.. var pp = document.getElementsByClassName('pp-link');. if (pp != null) {. Array.from(pp).forEach(span => {. var originalText = span.textContent; . span.textContent = ''; . span.appendChild(createLink(originalText, 'https://propdfhub.com/privacy.html')); . });. }. var tos = document.getElementsByClassName('tos-link');. if (tos != null) {. Array.from(tos).forEach(span => {. var originalText = span.textContent; . span.textContent = ''; . span.appendChild(createLink(originalText, 'https://propdfhub.com/terms.html')); . });. }. var cs = document.getElementsByClassName('cu-link');. if (cs != null) {. Array.from(cs).forEach(span => {. var originalText = span.textConten

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	3961
Entropy (8bit):	7.840791423693716
Encrypted:	false
SSDEEP:
MD5:	EE750E6560D2F0A4DB3D343A5F6F5B93
SHA1:	4D3566A0E41C6C4FBA28B4929919DC3AA388A729
SHA-256:	4F0C7F4D6A193A50BA215D9851AD6C560B1F48825687B40F8ECFF9D421D71A55
SHA-512:	15820BB143778F738A7A6230E969D2631BD027A16F30E35372702DD069C2AB40986C5B2022418D908E4E261571D633F85CE8590C6A1E8141BD5D2D5930028C7C
Malicious:	false
Reputation:	unknown
URL:	https://propdfhub.com/images/ico-3.png
Preview:	.PNG........IHDR.............k.XT....PLTE.........HHH..............................@@@.........???.......................................................................................???...........................???.....................~~~.........@@@.........???............=......NtRNS..U..!...\.{....4...:..-...LE.L.r@..X..`...).wa.g;%.j.1.mF4.8.R#tA6..,...K.....IDATx....R.@....7 ...r(gA.......-..~..9.Ib.lH ...>.....%d7.$ I.$I.$I.$I.$I.$I.?EF.C.@L....... .e..h..K...).X....D..}...#...M.........:.o..(.....w'.....d...Y...$>..[..f.....B..@ W._...._}...}..X..O ..:..-.....N...JqC.5v\..LAl_....^...,@. .....d..........U..._...R.t.....j.8}.` .........P.(.>..>...wV.Vq.I?. ...H...0C.j.u....i`.G......i.oS..<........?....i@..8....V...@..T9....\T..pxZ.]..V.Yt...<n.)LS...(Z"....z....R.2.\|W...~\|..2%......".y......l..iF.>~..N..x...f4......&......<.......Y....@3.F...L..g.@7.2U...F.J........Ql.+..ik.....;..y....@..U.C.=........).T+U.g....6.%.....-ps.6...!..7....

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 512 x 449, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	25023
Entropy (8bit):	7.889723902845917
Encrypted:	false
SSDEEP:
MD5:	42D398C78E17B6935E40BE53ACB0B923
SHA1:	12D8D34A7F72E0355CB6B815629FD106992BA2E0
SHA-256:	111079644C7A9F07B1CE8876D9626771E6B217042D89C93D0BCE2C63BEEE930D
SHA-512:	D472F9CB4491C68BE877D0EDB70F53D2A774E80BD314DA95EFB2476123A42C2A2127F4B864C21800E3420A9AAE0687F6D1127ABBB1B0BA302C4DD7DB34652F1E
Malicious:	false
Reputation:	unknown
URL:	https://propdfhub.com/images/pic-2.png
Preview:	.PNG........IHDR.............(..D....PLTE................~....c......V...............5.............~..W.c...-5.........-7.}........-3.\|....a......{..U..W.................e.................{...e.................z..V..{....e..`...}.......c...}...........y..y...................{.........g....<.,0.w........T...........v.......+0.........................z..{.........................................T.j...2M....y...../C...................F....&..............v.....9..{.....q..................#......<f....6Y......b..................Q..EvX..N........%_....l..I..%28B...M..q....}.C..-~.?q....3BF....k..%)r..CPV48=R..........T..o..8h.aot\..(..S........E.....c...\.L[a@FJ...;..M}...Xdi`RS+)-...d.....~..{..q\|....]........9..........Z...................a....l..)T~.zz\|ff............................^zIDATx...j.0.E..... ...mBH..."..Tv9...................'.GK$......=d..M{..ZS..j.M.k.N.A..3~.I....w.^]..3d.U.N..4.N..I^..*k..}KN.>......ge.'.G.u{.zR.I...9.._.?.Z.....0.......Z..G.

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1920 x 1078, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	47059
Entropy (8bit):	7.912231160295199
Encrypted:	false
SSDEEP:
MD5:	383E94C0D37E50E67729DD38EA0A4152
SHA1:	0E6F0A104ED216A5947DC942FA27D803F6F577EC
SHA-256:	B3EB890596A539F18BDE1B1232719B3189513C8F02EF1AECFF843399B6462354
SHA-512:	45E73F6A70C9523F01CFB2D067602E7BB701CDB453F765D3AEEC0E6EE695E3E16D7F5E949263579D55A682DEB7D00239571600E3923EEA4C51D9E33909D2FF38
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......6.......P....TPLTE...................................................................................qh.....:IDATx....n.0..PY&.0.....E....U.c...,..xd$/~'..ADDN.C..TR.}.......\|~....I.5.Z...`..0.pyb.)...I...SJ....F..!...=...N....\|.p=&........<s.{.Y.r.."".........".....2....'b.5o.ED...>......`D.u0y..aT...2.U..V5`..9......{/).7...u.....a...h..........).[....O.a`?.....n._.....Y......t\|..)}......B.y...1...G.XDD.`D...C....0...u...= ...V5`..y9.`.PRiF...0.....0....Y.Vm."".r...i.\....p.!\..........5W5`.....(.KJ....X....#...q.8n...ED..F6.f...$.w..@......XDD........Z.`..&.. ......Z........4.v.z... ....[h.......DD....pSA.."Jp................%........E.....".j......(..7'C.8..I......F(,..^..\|........-........y:....@.;.!.,e..v...^..`33.]........+!...o..%3...V...2...u......&.\...<...{@..#.v..u.....`33.S.&.\|{M....+A. ....Ihp....z.q8......v..2.W..H.`...d...v.\|....lff..y.ZY.a...I..`U.%....k.d..q......pM.....m`P@.f.K........63.}uc..t..i}....m.

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	87533
Entropy (8bit):	5.262536918435756
Encrypted:	false
SSDEEP:
MD5:	2C872DBE60F4BA70FB85356113D8B35E
SHA1:	EE48592D1FFF952FCF06CE0B666ED4785493AFDC
SHA-256:	FC9A93DD241F6B045CBFF0481CF4E1901BECD0E12FB45166A8F17F95823F0B1A
SHA-512:	BF6089ED4698CB8270A8B0C8AD9508FF886A7A842278E98064D5C1790CA3A36D5D69D9F047EF196882554FC104DA2C88EB5395F1EE8CF0F3F6FF8869408350FE
Malicious:	false
Reputation:	unknown
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	530
Entropy (8bit):	4.948340831568334
Encrypted:	false
SSDEEP:
MD5:	F5462CACF0314C656A0155AA94FC28DC
SHA1:	15B2FB8752DA571C21E95392342BF983340FA023
SHA-256:	C8FF41CC06F178AEB7F1E570CF15CF5774C00CB68FB0FA381296C3CB1DCE1F8D
SHA-512:	D612973B3BCDEA80DD4F92B482308BAC6C206B8DFE92AADD7578B46A8E067FE03A58CFD85E9AC70059E5E71B9FDEBB50741443D4C150DD96D11E28092EDF31AB
Malicious:	false
Reputation:	unknown
URL:	https://smarttechconsutacy.net/0?cid=fNK8V6bSBo7vQFT8p
Preview:	<!DOCTYPE html>..<html>.<head>. <meta name="referrer" content="always"> . <noscript>. <meta http-equiv="refresh" content="0;URL=https://smarttechconsutacy.net:443/?cid=fNK8V6bSBo7vQFT8p&id=0">. </noscript>.</head>.<body>...<script>...window.opener = null;. window.onload = function () {. setTimeout(function () { . location.replace("https://smarttechconsutacy.net:443/?cid=fNK8V6bSBo7vQFT8p&id=0"); . }, 500);...}..</script>.</body>.</html>

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4811), with no line terminators
Category:	downloaded
Size (bytes):	4811
Entropy (8bit):	5.802594060561828
Encrypted:	false
SSDEEP:
MD5:	32F0E5C5060B62C8ADC8D05A78E35563
SHA1:	0C0A35648A24A8A9AF65549ACBCE5D4BF3BB7CFA
SHA-256:	2A1E4DE99A003E6C2E12EADD7E7FFED01457700A69C0E7C93E63E5D1E3815FFD
SHA-512:	5536DC29B2195268C5DC5A9307CE4C1F42E1FED34B16716F4AD8E835F08AC1FAFDA4B34121E28B05A18C7CFB67E5DA979498059024E2A2F6408AA497CAC5C4CF
Malicious:	false
Reputation:	unknown
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10944743139/?random=1732531343066&cv=11&fst=1732531343066&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9172054717za200&gcd=13r3r3r3r5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1280&u_h=1024&url=https%3A%2F%2Fpropdfhub.com%2Fdl%2Fthank-you%3Fcid%3DfNK8V6bSBo7vQFT8p&ref=https%3A%2F%2Fpropdfhub.com%2F&hn=www.googleadservices.com&frm=0&npa=0&pscdl=noapi&auid=1429924886.1732531343&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(b,a,c){if(b==Array.prototype\|\|b==Object.prototype)return b;b[a]=c.value;return b};function k(b){b=["object"==typeof globalThis&&globalThis,b,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var a=0;a<b.length;++a){var c=b[a];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");} var m=k(this),n=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",q={},t={};function u(b,a,c){if(!c\|\|b!=null){c=t[a];if(c==null)return b[a];c=b[c];return c!==void 0?c:b[a]}} function v(b,a,c){if(a)a:{var d=b.split(".");b=d.length===1;var e=d[0],g;!b&&e in q?g=q:g=m;for(e=0;e<d.length-1;e++){var f=d[e];if(!(f in g))break a;g=g[f]}d=d[d.length-1];c=n&&c==="es6"?g[d]:null;a=a(c);a!=null&&(b?h(q,d,{configurable:!0,writable:!0,value:a}):a!==c&&(t[d]===void 0&&(b=Math.random()*1E9>>>0,t[d]=n?m.Symbol(d):"$jscp$"+b+"$"+d),h(g,t[d],{co

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	7989
Entropy (8bit):	4.747572087103069
Encrypted:	false
SSDEEP:
MD5:	C0E01BB159AF1A2D946E5077C940A858
SHA1:	F2B42D5AB4E045FEA52A354B139E45263E47FF01
SHA-256:	C8847D4ADE2C221E33B581F783552F3CD3EECAA43683E0F68DCBA203B13BAA2E
SHA-512:	6931317684DA91CB5AEF21B9F4439EE47E5B7A75802211E9EE3AE30C7389B5F0AF4B7BD281DA0639A1C9865867AAF6E1A05C4967BF4B8E487172C69F6A5DDD25
Malicious:	false
Reputation:	unknown
URL:	https://res.propdfhub.com/ext/thankyou/style.css
Preview:	* {. margin: 0;. padding: 0;. box-sizing: border-box;. font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, 'Open Sans', 'Helvetica Neue', sans-serif;.}..body.dl {. position: relative;.}..body.dl:before {. position: fixed;. top: -400px;. right: -400px;. content: '';. width: 60%;. height: 100%;. opacity: 0;. animation: pulse;. animation-duration: 2s;. animation-iteration-count: infinite;. background: radial-gradient(circle, rgba(145,219,61,1) 0%, transparent 55%);. z-index: 1;. border: 0px!important;. outline: 0!important;.}...download_link {. cursor: pointer;.}..@keyframes pulse {..0% {...transform: scale(0.2);. opacity: 1;..}...50% {...transform: scale(1);. opacity: 1;..}....100% {...transform: scale(0.2);. opacity: 1;..}.}../* SECOND PAGE */..second-page {. position: absolute;. top: 0;. left: 0;. width: 100%;. height: 100%;. background: #fff;..}

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5447
Entropy (8bit):	7.949768611534708
Encrypted:	false
SSDEEP:
MD5:	089F15895CB7E174BC09200654B8A955
SHA1:	83A252C7772EB9EF8BDFFC6CA81641D8EA2428C1
SHA-256:	84E0611CC71A807AB21C42B91FCFC9A2CA98C7624CB2B0C30C7CF229D53B0434
SHA-512:	22C95E58B3B4DA75ED91F18DED6C6EF355108994DF0AB209650F730C2E84B83666B2326C9E4EB9CDC3D3D302C39365E77C910D9E14F86C4E369C24B86D7BC5B0
Malicious:	false
Reputation:	unknown
URL:	https://res.propdfhub.com/images/favicon.png
Preview:	.PNG........IHDR...d...d.....p.T....pHYs.................IDATx..yxT..?.Y..d&.. {.& R.E..+z..h.(V....[..O.z....O7j+.....u.U\.VYTHb...!$$.@&.l..s..d..=3.I...9ON.....~..~..... RSS.&M..tZZZ. .2.F.Rbcc.....M.2....q.....f....0.5m.;.....!R.....:\|..\|.I..S...D..^..U.N6..ho..j..DQ.hnnvEE.ND...'g.......F..~.y.3#Qt.hv(..^.._..z..l. 33....7.&.0.?Q..1...+.r. ....)...?5...........?.r4...:...~../.9H.N...`.b..)((X~.......z..l....v@.....#/..].._.ju.{EQ...v...e...!;;.....wu.M.:...S.h5...........RVVF....,,.z%..../......_l..j.~.t:.J.$...VK.........<..6m.O..;O}........v.z:<...k....j].Q.._>.k6%I.j4..5.2...3g......Yvv......n^q..^y....huZbM..,j.P...'6...8dY...b4..L.v.c...........].......(."M/..#?...@..b.Y.......E.....V:::...ws..QQQd.Y.p...^./m\|......bkk.#..H..6B....uuu.........h.Di.q*.:^....:Iyv...3...@QUN.d..5.s.....7....yyy...j.k...e...L..m.8.kg..5..O\z......%..YP..{..7....c..7..5...wtt."!_..ikk3u.../"..S....Z.../.0.,..z%[.{+.b.a$.k.(........(.'.b.w.5.`

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3969)
Category:	downloaded
Size (bytes):	291945
Entropy (8bit):	5.563340246924873
Encrypted:	false
SSDEEP:
MD5:	2CFF721F001C72A78129A82AC645EB80
SHA1:	C7C79566764C501680C4DE65B8F5263F346791DA
SHA-256:	21EEBF36BBF59F533AC13DD72A6ECBD4518F008EB96F8C03847E4605F779B778
SHA-512:	5184ADCE345301284FF937529FC2D44C59F0D2972DF66E2DE68AB8BDB97951A6185892A7655119F9C528D3BED2CABC895F604AB8513A916CBD60FB8F2F72F9A0
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/gtag/js?id=AW-10944743139&l=dataLayer&cx=c&gtm=45be4bk0za200
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_ads_datatos","priority":16,"vtp_instanceDestinationId":"AW-10944743139","tag_id":10},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_lastNameType":"CSS_SELECTOR","vtp_autoAddressEnabled":false,"vtp_re

Chrome Cache Entry: 153

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	unknown
URL:	https://td.doubleclick.net/td/rul/10944743139?random=1732531343066&cv=11&fst=1732531343066&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4bk0v9172054717za200&gcd=13r3r3r3r5l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&u_w=1280&u_h=1024&url=https%3A%2F%2Fpropdfhub.com%2Fdl%2Fthank-you%3Fcid%3DfNK8V6bSBo7vQFT8p&ref=https%3A%2F%2Fpropdfhub.com%2F&hn=www.googleadservices.com&frm=0&npa=0&pscdl=noapi&auid=1429924886.1732531343&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Preview:	<html></html>

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4443
Entropy (8bit):	7.918104770155148
Encrypted:	false
SSDEEP:
MD5:	0606ED9745742B9D09EAEFBDA8E923FD
SHA1:	D04F45AA4BAA5A9F2FF371F3049D52F6443268B0
SHA-256:	E2F50526653F93CC97CD628583E13A2C59C08D37311D8687FC56E6E42A7C091B
SHA-512:	DF97B57585F38CAB35E307A3A8A15EC1F61925C9D55BD3D10A384E267E402E60542AE14FD1BEE82122B96D56E9424A7B09C8778B36514453FEA0E7F41CF391F0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....pHYs.........'.......tEXtSoftware.www.inkscape.org..<.....IDATx..{tT...3......@.c...Ex.C..R.....z.d...-/.w....xo{]......d2..0....Z....^-o..(.CHB......?B..{..yMr>..9..a..g....m...`.BZ.P..;....V2...G...J.d0..q....1L...bx...h.S....QE.J......)e.r.Z.]J0,..S.s..0.....l.f.....&...\|..O....b..P..4@..$...e...p/...I... .x..m:.m.k..L..`E.f..a....O.....6..3..o.w.g..MkA..{..Jlw...G.+!....u`.....u..@`.......`.PZ^. ...0Wk=ar.._l.h.........7.Q..y.O.Z.....W^H.....Ok1.....v.e.`.9.t..(....._.[S...Z...r.sf... \|Gk-.9H\..k)B3....~..y...V:4F.....3...-.hb.[.-...5\|...U.x..\|C.U5@.........F..7'....nR.H....b.t......V...9.X..p.T.0A.Bl%...>5?(.....R..j..h.....2..w Z.d9.W..uJ~@R....7D.....zL.2F.L{..Ox.x.Jd......D....{.......X.m..R/w...^n.(.8..N..........n.(g... .\|.d_.x...s.V0........r.).[@^i.._...F.+.1...thE.r.)....d..m/.f_.h..gy.^n..#.....Y...B...D?.\\|........[..{.....A../KM.....'qN..5`~-\..a.dwe..HM....b....8"g..p../..ES..HI

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 795 x 755, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	38799
Entropy (8bit):	7.973649676798504
Encrypted:	false
SSDEEP:
MD5:	5F70F04BE33FF83C7D0DDF18C0057EEF
SHA1:	A4504B2E63DDA44A60D298314561017A6E7B8111
SHA-256:	E07C2481E134575741BE7256BAD5F52E85072F56EC6794AA8CC878B19A5060CC
SHA-512:	90D9E228D1C042F97AF2D6D6A3C6ABA06191D3528D7087E3D674B7936D322B773DC5C6FFBF7D8A255BF37A7D8C9241806B451D076DA68A8E12817CF135BD491F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............N`.....PLTE.................&29.........%27...'26&16......'2:...)1:..."339FL\|..DQX)5<+4:....(4:......MW\...8?E....PZ......(39.OZ&286AF......266.OZ%28......4@H.KU.PZbjn....OY.UU&28...'28.PZ.OZ39.hh'39lsw......4:...(37....QY.M]...(28.NY...\dh.PZHTX.~k.PZ8BI.O[....PY0;A.............MW9DI.MV...z......OY.PZ.......PZ...T]bdlp...HRWR^d.;D............sz~.....tGGGZcg9CH.sg.......NM...GJQ....~r...qq...w5>.....n...........eJO.lo....PZ......&28........v.R]DZd................sz~?JN.8@...0<BW`e...HR.......Q[............hr......{..hnq.^h.rz......}?Gq?G.BL.AI..IS.CL94:.18...._8>....FPE8>..q.DN.R@D...Pdl.vcP6=.cT.NX...k7?~fb.LX.nZ.fa.vmk_\...~29...Y_VWY.he..i....tRNS......Q/..a.B/@..V......o.q.......!.mQ.......7X....g.....D......Ix.u!...]......Z`......8.S)...........D.....g6.g...H...+....;.v...)..y....IDATx...1k.@...O...r....t../....!. ..h.l....... ..kk..).s.K.z...2$d.Og.................. R+......7..qu-.<rM..k.k..............H..n.F

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 550 x 115, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	4823
Entropy (8bit):	7.891386625953358
Encrypted:	false
SSDEEP:
MD5:	25F7E25E0822686B1BF7C3BAAF72AE68
SHA1:	55FF0F9C7CA25161937936FD193C45CC8B3A90EC
SHA-256:	DC4172ADDFF30E4E611BFE8A0E264F763A500448508023BD62B19ABA34BDCE50
SHA-512:	7D25928CFF406005E0B9F053BE5BA568CFE2F37E8D99DDC8331B0CAD24B9FAA123F6398531F59EB44DD5CE2B36253ED25933DC004F9F1727EA34F2FFBF590FC2
Malicious:	false
Reputation:	unknown
URL:	https://propdfhub.com/images/logo.png
Preview:	.PNG........IHDR...&...s.......9.....PLTE.......$0...................$0....$0......................$0....$0....$0.$0.$0.$0.$0.$0.$0....$0(((....$0$$$..."""..............................%%%......... ......""".........124dfk....$0.IU.........[..w..ils&'X..Jo.Y\|.&(1Kp.Hl.(9H....BL'JU.8A......"0<...i.........JV.........../;N...3<..(_.$]..=F......08..."..469j#)...w'-......XVX.DO.........<..-@Q.19.,3...MLM@BI.......+1L........Ml../4.-4##'Q..F.........@Ko$......6.....P..lkm7Rl.GS.FQe!&)..t.....yz~RUZ.?I.5>{(/..#0.............^..M..Z~.J..Cx.D^wutv=^oacn[[].IUQQS&DR.9C.)5."..!+-.....s....................Pt.Ab....orz.]h"6B.6?.2:.1+,/\.#W.!A.....w.....l........U................ ?O,>N;=D$&0..'x..i..$.................W.....o\|.w}....Br.>jx.Y_WVX1EW4CR.AM.AL.>J459..8.%..".F'..!-..9".....=tRNS.DD.w.....w..".3fU...".f3....X.U@./....5....w$..oQ....Z.pC...UIDATx..w\|.U../..w1f.i..T......W.F.8p.J.-..".@@....'C..{...{..\|...].n..:...\|...G.{..{/..1...B.P(...B.P(...G.t.A.....

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	4630
Entropy (8bit):	7.816814743092138
Encrypted:	false
SSDEEP:
MD5:	1A5232C011DBFF8BDFBBCA103D25E435
SHA1:	1FB01E6FC76BF07027F4B8E917AE5FD6AA3B3B3F
SHA-256:	25C40338A68093EE4A3513BB814033659A548F778E177FEC27316A785B033CE6
SHA-512:	919D2E5E0F70FAF290C24CD555F40C241247007EDE16F36B087A9A99D09F153B06B291C8D2D86073A3594AFDF0378C427FFD541DA96BB89A028162628CBD8A07
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............k.XT....PLTE...fff............\|\|\|............\|\|\|......HHH...........................AAA........................................................................~~~..............................................................................@@@................................................4...[tRNS.............R.....t....?.7...y.......F.....oH@2-. ..).e.pM$..}[j\U/.Q93..cG'?`V.\|Y`iM2o......VIDATx..iC.H..+.#.6..).). ...z..x...l......-...4.5<.00.~.R.0.d.%K.,Y.d.%K...x.S......L2).L`..'. J..H...H..(D...e .t.j.4......=Sr\....z.q.$.Y4e.D..'"..p.....7z.Y....'.....3AG....]..x.;.I!PLc...!zf.A!.J..."V..%8.?....."..p.Y...qE.N........9.V.t.s%.5..hP.c..#....z.....H......3&.......E.>;W$.%.H..!..t..q.2I.....;..?\|:.....[..3k.CD..Tt..s.\|...?....-.C.n..@F.bR:..s......b.=*...p..dE.B......p...E.eC`)D.q......f.(.F\|..$..@\|......}(.:...;.R.......w.1.F......R....1..OCje..wF........0[5.;....p.....5...B$.C....%..IZ:......P..x.U.&pVNFC..\|.YDi..R....

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	2975
Entropy (8bit):	7.647621562412029
Encrypted:	false
SSDEEP:
MD5:	397258D020984D50277B731D76362091
SHA1:	AB0996E31CE4928B6001E5566A9D442E30869923
SHA-256:	CFFC5BD03C6F05F6493C7F8EB64FC25910C8B3D3AEE2D1A924E3239D10E3F2D4
SHA-512:	E80C2C41112CC2ADB2C091E20688862046A91525917109DBA7209051F0EB8348A1453633D54348443EB72B225EDC04490F5F243BEE3F7EEED8DA814B5171A062
Malicious:	false
Reputation:	unknown
URL:	https://propdfhub.com/images/ico-4.png
Preview:	.PNG........IHDR.............k.XT...&PLTE.................................}}}....................................zzz......===...CCC===......???.................................???............~~~......AAA.................................~~~............???>>>...............???...................................................................atRNS..gn..$R...5U.E.:\|..{....H}....?....<....F%.j1,.....nWS'..yW....LG.....c8/".t@cK<..zq[\9^.q)...6.....IDATx...R.@....aR..4...Q"JE.P..@...~V.v.u..&.....v.!i..>?....y.e9..P(...B.P(...B.P(...B.P(...B.P(.......).-.....(-..&L.bOG..{.0..!...1L...c..4.C.y..0..3..0........7..AB.J....(.J.....9..iz,..f.t..2..^....u.~.%...L.!J..g.vQ.v=...R......=z!..z.gY.'`<.U....E.5.i.$.t.[.;....:<.hH6....T.....V-kx.=.D.v..$.5C^.!V7x....p..I/..a5p.F..FB>h...;\|GB8X..._%A.....0...yM... .........C..8........g..`..w..#@........xA......k8$........ ..........C. ...Q.@05r=.....?Ik.].-..{........Y...$K.b.(Urm.@.'.F....P!..F.....i..?.._.E.fX....].?.....g...

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (815)
Category:	downloaded
Size (bytes):	3501
Entropy (8bit):	5.383873370647921
Encrypted:	false
SSDEEP:
MD5:	147FD3B00C22BA9C939712E9213C24CA
SHA1:	3B48369B86FA0574F35379AACD1F42CC9C98A52B
SHA-256:	70F5B11C1870CF90201A6D5F770CA318A3FA5827C74A8765EDE22B487F7D4532
SHA-512:	E8419A71232EDAC8FD131446777F7D034B3171EFE07B3267479B439E4982650DB65A0D1DDC9F516315D5ED1B01ECFD2F7EB55D75D44AA51EE0AD494D441586D2
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/static/service_worker/4bj0/sw_iframe.html?origin=https%3A%2F%2Fpropdfhub.com
Preview:	<!DOCTYPE html>.<html>.<head>. <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon">.</head>.<body>. <script>.'use strict';class m{constructor(a){this.j=a;this.g={};this.h={};this.i=0;this.id=String(Math.floor(Number.MAX_SAFE_INTEGERMath.random()))}}function n(a){return a.performance&&a.performance.now()\|\|Date.now()}.var p=function(a,b){class d{constructor(c,g,f){this.failureType=c;this.data=g;this.g=f;this.h=new m(n(f))}s(c,g){const f=c.clientId;if(c.type===0){c.isDead=!0;var e=this.h,h=n(this.g);e.g[f]==null&&(e.g[f]=0,e.h[f]=h,e.i++);e.g[f]++;c.stats={targetId:e.id,clientCount:e.i,totalLifeMs:Math.round(h-e.j),heartbeatCount:e.g[f],clientLifeMs:Math.round(h-e.h[f])}}c.failure={failureType:this.failureType,data:this.data};g(c)}}return new d(5,a,b)};/.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0.*/.let q=globalThis.trustedTypes,r;function t(){let a=null;if(!q)return a;try{const b=d=>d;a=q.createPolicy("goog#html",{createHTML:b,createScript:b,crea

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1534
Entropy (8bit):	4.467162231095702
Encrypted:	false
SSDEEP:
MD5:	D0E56133E418EE791027781724981EF4
SHA1:	8F413CEE465E1DEDF64E4EDD0A96CC4EACB7FD41
SHA-256:	FFF848CFF0C781C5E3C287C4EFE903504FC1A24104006B1439D01BADE4BFFFCE
SHA-512:	985C47557B139D5899383F89FE60F6EC15D8A9C81FB12C3E277019AD3E0533670C90B1719B72DE4B5C0B6DDB125F9EF6DCBC7B66ED67F3068FB6322CD33B4686
Malicious:	false
Reputation:	unknown
URL:	https://propdfhub.com/dl/overlay2.js
Preview:	(function(){. function updateCTAButton(){. var btnDownload = document.querySelectorAll('.download_link, .downloadBtn');. for (var i = 0; i < btnDownload.length; i++) {. btnDownload[i].onclick = function() {. location.href = '/dl/thank-you' + location.search; . }. }. }.. updateCTAButton();.. function updateLinks(){. try{. var links = Array.from(document.querySelectorAll('[role=link]'));. var cpList = links.filter(x=>x.innerText == 'Cookie Policy');. var ppList = links.filter(x=>x.innerText == 'Privacy Policy');. var cp = cpList.at(0);. var pp = ppList.at(0);. if(cp!=null && !cp.classList.contains('mod_elem')){. var clone = cp.cloneNode(true);. clone.onclick = function() { window.open('/cookiepolicy.html', '_blank');}. clone.classList.add('mod_elem');. cp.replaceWith(clone)

Static File Info

⊘No static file info

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://propdfhub.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Spreading

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560

C:\Users\user\AppData\Local\EPISoftware\installer.exe.part

C:\Users\user\AppData\Local\Temp\MSI545.tmp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Downloads\ProPDFHub.msi (copy)

C:\Users\user\Downloads\Unconfirmed 530306.crdownload

C:\Users\user\Downloads\b6c9ace2-5767-4e89-b6a9-061369497eb9.tmp

C:\Windows\Installer\MSI143A.tmp

C:\Windows\Installer\MSI1517.tmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

C:\Windows\Temp\~DF5CB88856735E0BA7.TMP

C:\Windows\Temp\~DF610BA5C629EC9D3C.TMP

Chrome Cache Entry: 111

Chrome Cache Entry: 115

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 127

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 136

Windows Analysis Report
http://propdfhub.com