Edit tour

Windows Analysis Report
https://www.wixsite.com/_api/invoice/2d5e7023-6014-4f5e-ab31-c1e25d999b96:9b27124a-a130-45dc-b81f-e5675b538826/view?token=56c18155-b636-4505-b95c-630f3d19901a

Overview

General Information

Sample URL:	https://www.wixsite.com/_api/invoice/2d5e7023-6014-4f5e-ab31-c1e25d999b96:9b27124a-a130-45dc-b81f-e5675b538826/view?token=56c18155-b636-4505-b95c-630f3d19901a
Analysis ID:	1564997
Infos:

Detection

HTMLPhisher

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish29

Blob-based file download detected

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7032 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1956,i,7098894343769963763,6036900527392418219,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.wixsite.com/_api/invoice/2d5e7023-6014-4f5e-ab31-c1e25d999b96:9b27124a-a130-45dc-b81f-e5675b538826/view?token=56c18155-b636-4505-b95c-630f3d19901a" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

rundll32.exe (PID: 4120 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

Acrobat.exe (PID: 3996 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\Invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6452 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5528 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1580,i,2897418132230118679,16357965458181838666,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
0.0.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish29

Source: Yara match

File source: 0.0.pages.csv, type: HTML

Source: file:///C:/Users/user/Downloads/Invoice.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/Invoice.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/Invoice.pdf	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49737 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197

Source: global traffic	DNS traffic detected: DNS query: www.wixsite.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: static.parastorage.com
Source: global traffic	DNS traffic detected: DNS query: cdn.ravenjs.com
Source: global traffic	DNS traffic detected: DNS query: static.wixstatic.com
Source: global traffic	DNS traffic detected: DNS query: frog.wix.com
Source: global traffic	DNS traffic detected: DNS query: manage.wix.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49737 version: TLS 1.2

System Summary

Blob-based file download detected

Source: C:\Users\user\Downloads\Invoice.pdf

File download: blob:https://www.wixsite.com/c8a7a925-7bfd-423c-a9b2-b4ff92f3a6b4C:\Users\user\Downloads\Invoice.pdf

Source: classification engine

Classification label: mal52.phis.win@43/64@25/137

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

File created: C:\Users\user\AppData\Local\Temp\acrocef_low\0bdb4038-1b2f-4ccc-a78e-4c991b0806aa.tmp

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1956,i,7098894343769963763,6036900527392418219,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.wixsite.com/_api/invoice/2d5e7023-6014-4f5e-ab31-c1e25d999b96:9b27124a-a130-45dc-b81f-e5675b538826/view?token=56c18155-b636-4505-b95c-630f3d19901a"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1956,i,7098894343769963763,6036900527392418219,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\Invoice.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1580,i,2897418132230118679,16357965458181838666,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1580,i,2897418132230118679,16357965458181838666,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 6960DF2B990D267F7BA0CD1DDB6595C7

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\crash_reporter.cfg

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Rundll32	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://www.wixsite.com/_api/invoice/2d5e7023-6014-4f5e-ab31-c1e25d999b96:9b27124a-a130-45dc-b81f-e5675b538826/view?token=56c18155-b636-4505-b95c-630f3d19901a	0%	Avira URL Cloud	safe
https://www.wixsite.com/_api/invoice/2d5e7023-6014-4f5e-ab31-c1e25d999b96:9b27124a-a130-45dc-b81f-e5675b538826/view?token=56c18155-b636-4505-b95c-630f3d19901a	1%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
www.wixsite.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
file:///C:/Users/user/Downloads/Invoice.pdf	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
glb-editor.wix.com	34.149.206.255	true	false		high
username-ccm-206-118.wix.com	34.144.206.118	true	false		high
cdn.ravenjs.com	151.101.2.217	true	false		high
d1cq301dpr7fww.cloudfront.net	108.158.75.103	true	false		high
www.google.com	172.217.21.36	true	false		high
d2v4ffmk60pnnm.cloudfront.net	13.227.8.42	true	false		high
bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com	54.196.108.80	true	false		high
www.wixsite.com	unknown	unknown	false	1%, Virustotal, Browse	high
static.wixstatic.com	unknown	unknown	false		high
frog.wix.com	unknown	unknown	false		high
x1.i.lencr.org	unknown	unknown	false		high
manage.wix.com	unknown	unknown	false		high
static.parastorage.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
file:///C:/Users/user/Downloads/Invoice.pdf	false	Avira URL Cloud: safe	unknown
https://www.wixsite.com/_api/invoice/2d5e7023-6014-4f5e-ab31-c1e25d999b96:9b27124a-a130-45dc-b81f-e5675b538826/view?token=56c18155-b636-4505-b95c-630f3d19901a	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.238	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.17.67	unknown	United States	15169	GOOGLEUS	false
216.58.208.227	unknown	United States	15169	GOOGLEUS	false
34.144.206.118	username-ccm-206-118.wix.com	United States	2686	ATGS-MMD-ASUS	false
151.101.130.217	unknown	United States	54113	FASTLYUS	false
54.196.108.80	bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
23.56.162.204	unknown	United States	16625	AKAMAI-ASUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
74.125.205.84	unknown	United States	15169	GOOGLEUS	false
108.158.75.73	unknown	United States	16509	AMAZON-02US	false
151.101.2.217	cdn.ravenjs.com	United States	54113	FASTLYUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.227.8.42	d2v4ffmk60pnnm.cloudfront.net	United States	16509	AMAZON-02US	false
34.237.241.83	unknown	United States	14618	AMAZON-AESUS	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
23.195.39.65	unknown	United States	20940	AKAMAI-ASN1EU	false
108.158.75.103	d1cq301dpr7fww.cloudfront.net	United States	16509	AMAZON-02US	false
34.149.206.255	glb-editor.wix.com	United States	2686	ATGS-MMD-ASUS	false
199.232.210.172	bg.microsoft.map.fastly.net	United States	54113	FASTLYUS	false
13.227.8.47	unknown	United States	16509	AMAZON-02US	false
2.18.108.135	unknown	European Union	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564997
Start date and time:	2024-11-29 05:25:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://www.wixsite.com/_api/invoice/2d5e7023-6014-4f5e-ab31-c1e25d999b96:9b27124a-a130-45dc-b81f-e5675b538826/view?token=56c18155-b636-4505-b95c-630f3d19901a
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.phis.win@43/64@25/137

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 172.217.19.238, 74.125.205.84
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information

LLM Input / Output

Input	Output
URL: https://www.wixsite.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://www.wixsite.com
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This is a legitimate React DOM production build file from Facebook. It contains standard React library code, is properly licensed (MIT), and shows expected patterns for a minified production JavaScript framework. The code includes normal DOM manipulation and event handling functionality typical of React." }
/** @license React v16.8.3 * react-dom.production.min.js * * Copyright (c) Facebook, Inc. and its affiliates. * * This source code is licensed under the MIT license found in the * LICENSE file in the root directory of this source tree. / / Modernizr 3.0.0pre (Custom Build) \| MIT */ 'use strict';(function(da,pb){"object"===typeof exports&&"undefined"!==typeof module?module.exports=pb(require("react")):"function"===typeof define&&define.amd?define(["react"],pb):da.ReactDOM=pb(da.React)})(this,function(da){function pb(a,b,c,d,e,f,g,h){if(!a){a=void 0;if(void 0===b)a=Error("Minified exception occurred; use the non-minified dev environment for the full error message and additional helpful warnings.");else{var l=[c,d,e,f,g,h],k=0;a=Error(b.replace(/%s/g,function(){return l[k++]})); a.name="Invariant Violation"}a.framesToPop=1;throw a;}}function n(a){for(var b=arguments.length-1,c="https://reactjs.org/docs/error-decoder.html?invariant="+a,d=0;d<b;d++)c+="&args[]="+encodeURIComponent(arguments[d+1]);pb(!1,"Minified React error #"+a+"; visit %s for the full message or use the non-minified dev environment for full errors and additional helpful warnings. ",c)}function rh(a,b,c,d,e,f,g,h,l){qb=!1;$b=null;sh.apply(th,arguments)}function uh(a,b,c,d,e,f,g,h,l){rh.apply(this,arguments); if(qb){if(qb){var k=$b;qb=!1;$b=null}else n("198"),k=void 0;ac\|\|(ac=!0,Yc=k)}}function Ee(){if(bc)for(var a in Na){var b=Na[a],c=bc.indexOf(a);-1<c?void 0:n("96",a);if(!cc[c]){b.extractEvents?void 0:n("97",a);cc[c]=b;c=b.eventTypes;for(var d in c){var e=void 0;var f=c[d],g=b,h=d;Zc.hasOwnProperty(h)?n("99",h):void 0;Zc[h]=f;var l=f.phasedRegistrationNames;if(l){for(e in l)l.hasOwnProperty(e)&&Fe(l[e],g,h);e=!0}else f.registrationName?(Fe(f.registrationName,g,h),e=!0):e=!1;e?void 0:n("98",d,a)}}}} function Fe(a,b,c){Oa[a]?n("100",a):void 0;Oa[a]=b;$c[a]=b.eventTypes[c].dependencies}function Ge(a,b,c){var d=a.type\|\|"unknown-event";a.currentTarget=He(c);uh(d,b,void 0,a);a.currentTarget=null}function Pa(a,b){null==b?n("30"):void 0;if(null==a)return b;if(Array.isArray(a)){if(Array.isArray(b))return a.push.apply(a,b),a;a.push(b);return a}return Array.isArray(b)?[a].concat(b):[a,b]}function ad(a,b,c){Array.isArray(a)?a.forEach(b,c):a&&b.call(c,a)}function Ie(a,b){var c=a.stateNode;if(!c)return null; var d=bd(c);if(!d)return null;c=d[b];a:switch(b){case "onClick":case "onClickCapture":case "onDoubleClick":case "onDoubleClickCapture":case "onMouseDown":case "onMouseDownCapture":case "onMouseMove":case "onMouseMoveCapture":case "onMouseUp":case "onMouseUpCapture":(d=!d.disabled)\|\|(a=a.type,d=!("button"===a\|\|"input"===a\|\|"select"===a\|\|"textarea"===a));a=!d;break a;default:a=!1}if(a)return null;c&&"function"!==typeof c?n("231",b,typeof c):void 0;return c}function cd(a){null!==a&&(rb=Pa(rb,a));a=rb; rb=null;if(a&&(ad(a,vh),rb?n("95"):void 0,ac))throw a=Yc,ac=!1,Yc=null,a;}function dc(a){if(a[ea])return a[ea];for(;!a[ea];)if(a.parentNode)a=a.parentNode;else return null;a=a[ea];return 5===a.tag\|\|6===a.tag?a:null}function Je(a){a=a[ea];return!a\|\|5!==a.tag&&6!==a.tag?null:a}function Da(a){if(5===a.tag\|\|6===a.tag)return a.stateNode;n("33")}function dd(a){return a[ec]\|\|null}function fa(a){do a=a.return;while(a&&5!==a.tag);return a?a:null}function Ke(a,b,c){if(b=Ie(a,c.dispatchConfig.phasedRegistrationNames[b]))c._dispatchListeners= Pa(c._dispatchListeners,b),c._dispatchInstances=Pa(c._dispatchInstances,a)}function wh(a){if(a&&a.dispatchConfig.phasedRegistrationNames){for(var b=a._targetInst,c=[];b;)c.push(b),b=fa(b);for(b=c.length;0<b--;)Ke(c[b],"captured",a);for(b=0;b<c.length;b++)Ke(c[b],"bubbled",a)}}function ed(a,b,c){a&&c&&c.dispatchConfig.registrationName&&(b=Ie(a,c.dispatchConfig.registrationName))&&(c._dispatchListeners=Pa(c._dispatchListeners,b),c._dispatchInstances=Pa(c._dispatchInstances,a))}function xh(a){a&&a.dispatchConfig.registrationName&& ed(a._targetInst,null,a)}function Qa(a){ad(a,wh)}function fc(a,b){var c={};c[a.toLowerCase()]=b.toLowerCase();c["Webkit
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The code appears to be a legitimate invoice handling module with standard functionality like PDF downloads and payment processing. It uses standard APIs and makes requests to same-origin endpoints. The only minor risk indicators are token handling in cookies and form submissions, but these follow normal security practices with XSRF protection." }
(()=>{var e,t,n,o,r,i={62572:(e,t,n)=>{"use strict";var o=n(6376),r=n(39944),i=n(81792),a=n(36512),s=n(58144),c=n(14296),l=n.n(c),d=n(55424),u=n.n(d),p=n(64764),m=(n(35850),n(97772),n(93360),n(7872),n(43004),n(94840),n(65752));const v="_1TAv0",w="Sr7Yhm",_="L685tl",f="invoice-view",h="P7v1x_",E="H0h62A",y="j1aiI9",b="I0Tzc2";var I=n(31036),g=n.n(I),O=n(12832),P=n(34952),x=n(94738),T=n(54468),N=n(32848),k=n.n(N),S=n(19964),L=n(46672),C=n(30048),D=n(46956),j=n.n(D);const M=new(n(17208).K),A=()=>{const e=document.cookie.indexOf("XSRF-TOKEN"),t=document.cookie.indexOf("=",e),n=document.cookie.includes(";",t)?document.cookie.indexOf(";",t):void 0;return document.cookie.substring(t+1,n)},F=e=>e.title?o.createElement(P.c,k()({priority:"secondary"},e,{prefixIcon:o.createElement(j(),null)}),e.title):o.createElement(S.c,k()({priority:"secondary"},e),o.createElement(j(),null)),R=e=>{let{token:t,text:n,pdfUrl:r,onDownloadPDF:i,onDownloadFail:a,newMobileViewEnabled:s=!1}=e;const[c,l]=(0,o.useState)(!1),d=e=>s?o.createElement(F,k()({},e,{title:n})):o.createElement(P.c,k()({theme:"whiteblueprimary"},e));return o.createElement(d,{dataHook:"download-pdf-button",onClick:()=>{l(!0),((e,t)=>M.post(e,{token:t,"x-xsrf-token":A()},{headers:{"content-type":"application/json",Accept:"text/html,application/xhtml+xml"},responseType:"blob"}))(r,t).then((e=>{(0,C.saveAs)(e.data,"Invoice.pdf"),i()})).catch(a).then((()=>l(!1)))}},o.createElement(L.cp,k()({align:"center"},s?{}:{width:"110px"}),c?o.createElement(x.c,{size:"tiny"}):n))},V=e=>{let{token:t,t:n,url:r,version:i,onPayForm:a,onError:s}=e;const[c,l]=(0,o.useState)(!1);return o.createElement("form",{onSubmit:async e=>{if(e.preventDefault(),!c){l(!0);try{const e=await fetch(r,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({token:t,version:i.toString(),"x-xsrf-token":A()})});if(!e.ok)throw new Error("Network response was not ok");const n=await e.text();history.pushState(null,"",r),document.open(),document.write(n),document.close(),a()}catch(e){s()}finally{l(!1)}}}},o.createElement(P.c,{className:"pay-button",dataHook:"pay-button",type:"submit"},c?o.createElement(x.c,{size:"tiny"}):n("translation:invoice.actions.pay")),o.createElement("input",{type:"hidden",name:"token",value:t}),o.createElement("input",{type:"hidden",name:"version",value:i}),o.createElement("input",{type:"hidden",name:"x-xsrf-token",value:A()}))},U=(0,O.A)()((e=>{let{withPay:t,pdfUrl:n,payUrl:r,token:i,print:a,setup:s={},version:c,onDownloadPDF:l,t:d,onPayForm:u=(()=>{}),newMobileViewEnabled:p,isPremium:m}=e;const[v,w]=(0,o.useState)({show:!1,message:""}),_=t\|\|!s.hidePdfDownloader,f=e=>{w({show:!0,message:e})};return o.createElement(o.Fragment,null,o.createElement(T.cp,{autoHideTimeout:4e3,theme:"error",show:v.show,type:"sticky",onClose:()=>w({show:!1,message:""})},o.createElement(T.cp.TextLabel,null,v.message),o.createElement(T.cp.CloseButton,null)),o.createElement("div",{className:`${h} ${_?b:""}`},o.createElement("div",{className:E},o.createElement(P.c,{theme:"icon-white",dataHook:"print-button",onClick:a},o.createElement(g(),null)),!s.hidePdfDownloader&&o.createElement(R,{text:d("translation:invoice.actions.save-pdf"),token:i,pdfUrl:n,onDownloadPDF:l,onDownloadFail:()=>f(d("translation:invoice.actions.save-pdf.error"))})),o.createElement("div",{className:y},!!t&&m&&o.createElement(V,{t:d,url:r,token:i,version:c,onPayForm:u,onError:()=>f(d("translation:invoice.actions.pay-invoice.error"))}),!s.hidePdfDownloader&&p&&o.createElement(R,{text:t\|\|null==s\|\|!s.mobileInvoiceViewV2Enabled?"":d("translation:invoice.actions.save-pdf"),token:i,pdfUrl:n,onDownloadPDF:l,onDownloadFail:()=>f(d("translation:invoice.actions.save-pdf.error")),newMobileViewEnabled:!0}))))}));n(58284);const B={enabled:!1,showTaxPerLineItem:!1,showTaxBreakdown:!0,showItemsSubtotalPerTax:!1,showTransactionDetails:!1};var $=n(64936);let z=function(e){return e.RECURRING="Recurring",e.ONE_TIME="One Time",e}({});const H=window
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This is the minified production version of React v16.8.3, a legitimate and widely-used JavaScript library from Facebook. The code is minified (compressed) but comes with proper licensing and attribution. It contains standard React implementation code with no suspicious behaviors or security risks." }
/** @license React v16.8.3 * react.production.min.js * * Copyright (c) Facebook, Inc. and its affiliates. * * This source code is licensed under the MIT license found in the * LICENSE file in the root directory of this source tree. */ 'use strict';(function(N,q){"object"===typeof exports&&"undefined"!==typeof module?module.exports=q():"function"===typeof define&&define.amd?define(q):N.React=q()})(this,function(){function N(a,b,d,g,p,c,e,h){if(!a){a=void 0;if(void 0===b)a=Error("Minified exception occurred; use the non-minified dev environment for the full error message and additional helpful warnings.");else{var n=[d,g,p,c,e,h],f=0;a=Error(b.replace(/%s/g,function(){return n[f++]}));a.name="Invariant Violation"}a.framesToPop=1; throw a;}}function q(a){for(var b=arguments.length-1,d="https://reactjs.org/docs/error-decoder.html?invariant="+a,g=0;g<b;g++)d+="&args[]="+encodeURIComponent(arguments[g+1]);N(!1,"Minified React error #"+a+"; visit %s for the full message or use the non-minified dev environment for full errors and additional helpful warnings. ",d)}function t(a,b,d){this.props=a;this.context=b;this.refs=ba;this.updater=d\|\|ca}function da(){}function O(a,b,d){this.props=a;this.context=b;this.refs=ba;this.updater=d\|\| ca}function u(){if(!x){var a=c.expirationTime;C?P():C=!0;D(ta,a)}}function Q(){var a=c,b=c.next;if(c===b)c=null;else{var d=c.previous;c=d.next=b;b.previous=d}a.next=a.previous=null;d=a.callback;b=a.expirationTime;a=a.priorityLevel;var g=f,p=E;f=a;E=b;try{var n=d()}finally{f=g,E=p}if("function"===typeof n)if(n={callback:n,priorityLevel:a,expirationTime:b,next:null,previous:null},null===c)c=n.next=n.previous=n;else{d=null;a=c;do{if(a.expirationTime>=b){d=a;break}a=a.next}while(a!==c);null===d?d=c:d=== c&&(c=n,u());b=d.previous;b.next=d.previous=n;n.next=d;n.previous=b}}function F(){if(-1===k&&null!==c&&1===c.priorityLevel){x=!0;try{do Q();while(null!==c&&1===c.priorityLevel)}finally{x=!1,null!==c?u():C=!1}}}function ta(a){x=!0;var b=G;G=a;try{if(a)for(;null!==c;){var d=l();if(c.expirationTime<=d){do Q();while(null!==c&&c.expirationTime<=d)}else break}else if(null!==c){do Q();while(null!==c&&!H())}}finally{x=!1,G=b,null!==c?u():C=!1,F()}}function ea(a,b,d){var g=void 0,p={},c=null,e=null;if(null!= b)for(g in void 0!==b.ref&&(e=b.ref),void 0!==b.key&&(c=""+b.key),b)fa.call(b,g)&&!ha.hasOwnProperty(g)&&(p[g]=b[g]);var h=arguments.length-2;if(1===h)p.children=d;else if(1<h){for(var f=Array(h),k=0;k<h;k++)f[k]=arguments[k+2];p.children=f}if(a&&a.defaultProps)for(g in h=a.defaultProps,h)void 0===p[g]&&(p[g]=h[g]);return{$$typeof:y,type:a,key:c,ref:e,props:p,_owner:R.current}}function ua(a,b){return{$$typeof:y,type:a.type,key:b,ref:a.ref,props:a.props,_owner:a._owner}}function S(a){return"object"=== typeof a&&null!==a&&a.$$typeof===y}function va(a){var b={"=":"=0",":":"=2"};return"$"+(""+a).replace(/[=:]/g,function(a){return b[a]})}function ia(a,b,d,g){if(I.length){var c=I.pop();c.result=a;c.keyPrefix=b;c.func=d;c.context=g;c.count=0;return c}return{result:a,keyPrefix:b,func:d,context:g,count:0}}function ja(a){a.result=null;a.keyPrefix=null;a.func=null;a.context=null;a.count=0;10>I.length&&I.push(a)}function T(a,b,d,g){var c=typeof a;if("undefined"===c\|\|"boolean"===c)a=null;var e=!1;if(null=== a)e=!0;else switch(c){case "string":case "number":e=!0;break;case "object":switch(a.$$typeof){case y:case wa:e=!0}}if(e)return d(g,a,""===b?"."+U(a,0):b),1;e=0;b=""===b?".":b+":";if(Array.isArray(a))for(var f=0;f<a.length;f++){c=a[f];var h=b+U(c,f);e+=T(c,h,d,g)}else if(null===a\|\|"object"!==typeof a?h=null:(h=ka&&a[ka]\|\|a["@@iterator"],h="function"===typeof h?h:null),"function"===typeof h)for(a=h.call(a),f=0;!(c=a.next()).done;)c=c.value,h=b+U(c,f++),e+=T(c,h,d,g);else"object"===c&&(d=""+a,q("31", "[object Object]"===d?"object with keys {"+Object.keys(a).join(", ")+"}":d,""));return e}function V(a,b,d){return null==a?0:T(a,"",b,d)}function U(a,b){return"object"===typeof a&&null!==a&&null!=a.key?va(a.key):b.toString(36)}functio
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This appears to be a legitimate cookie consent management script. It contains standard cookie handling functions, policy management, and event dispatching. While it uses DOM manipulation and handles cookies, these are expected behaviors for consent management. The code interacts with known domains (wix.com, editorx.com) and implements standard privacy control features." }
!function(){var t={231:function(t,e,n){var o=n(40);t.exports=function(t,e,n){return(e=o(e))in t?Object.defineProperty(t,e,{value:n,enumerable:!0,configurable:!0,writable:!0}):t[e]=n,t},t.exports.__esModule=!0,t.exports.default=t.exports},27:function(t,e,n){var o=n(501).default;t.exports=function(t,e){if("object"!==o(t)\|\|null===t)return t;var n=t[Symbol.toPrimitive];if(void 0!==n){var i=n.call(t,e\|\|"default");if("object"!==o(i))return i;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===e?String:Number)(t)},t.exports.__esModule=!0,t.exports.default=t.exports},40:function(t,e,n){var o=n(501).default,i=n(27);t.exports=function(t){var e=i(t,"string");return"symbol"===o(e)?e:String(e)},t.exports.__esModule=!0,t.exports.default=t.exports},501:function(t){function e(n){return t.exports=e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof Symbol&&t.constructor===Symbol&&t!==Symbol.prototype?"symbol":typeof t},t.exports.__esModule=!0,t.exports.default=t.exports,e(n)}t.exports=e,t.exports.__esModule=!0,t.exports.default=t.exports}},e={};function n(o){var i=e[o];if(void 0!==i)return i.exports;var r=e[o]={exports:{}};return t[o](r,r.exports,n),r.exports}n.n=function(t){var e=t&&t.__esModule?function(){return t.default}:function(){return t};return n.d(e,{a:e}),e},n.d=function(t,e){for(var o in e)n.o(e,o)&&!n.o(t,o)&&Object.defineProperty(t,o,{enumerable:!0,get:e[o]})},n.o=function(t,e){return Object.prototype.hasOwnProperty.call(t,e)},function(){"use strict";var t=n(231),e=n.n(t);const o=["wix.com","editorx.com"],i="consent-policy",r="specs.cookieConsent.PolicyByGlobalPrivacyControl";function s(t,e){return void 0===t&&(t=""),void 0===e&&(e=""),e===t\|\|e.indexOf("."+t)===e.replace("."+t,"").length}function c(t){return e=o,n=t\|\|location.hostname,e.some((t=>s(t,n)));var e,n}function a(t){var e;const n="[;\\s ]?"+t+"=([\\S]+(?:;?))",o=document.cookie.match(n);return(null==o\|\|null==(e=o.pop())?void 0:e.replace(";",""))\|\|void 0}function l(t,e){try{"function"==typeof t&&t(e)}catch(t){console&&console.error(t)}}const u={essential:!0,functional:!0,analytics:!0,advertising:!0,dataToThirdParty:!0},f={essential:!0,functional:!0,analytics:!0,advertising:!1,dataToThirdParty:!1},d={essential:!0,functional:!0,analytics:!1,advertising:!1,dataToThirdParty:!1},y={func:"functional",anl:"analytics",adv:"advertising",dt3:"dataToThirdParty",ess:"essential"};function p(t){const e=h();if(e&&!e.defaultPolicy){const{path:e,host:n}=function(t){let e="",n="";if(o.forEach((t=>{s(t,location.hostname)&&(e="."+t,n="/")})),!e&&!n){e=location.hostname;const o=t.split(location.hostname);if(n=o[1]?""+o[1]:"/","/"===n){const t=e.split(".");t.shift(),e="."+t.join(".")}}return{host:e,path:n}}(t);return document.cookie=i+"=; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain="+n+"; path="+e+";",!0}return!1}function h(){const t=a(i);if(!t\|\|"string"!=typeof t)return!1;let e;const n={};try{const o=JSON.parse(decodeURIComponent(t));return Object.keys(y).forEach((t=>{if("number"==typeof o[t]){n[y[t]]=1===o[t]}})),e=function(t){let e;"number"==typeof t&&(e=new Date(1e3t60));return e}(o.ts),{defaultPolicy:!!o.temp,policy:n,createdDate:e}}catch(t){return!1}}function g(t,e){const n=h();if(n)return n;const o=function(t,e){if(n=r,"function"==typeof(null==(o=window)\|\|null==(i=o.wixTagManager)?void 0:i.getConfig)&&"true"===(null==(s=window)\|\|null==(a=s.wixTagManager)\|\|null==(l=a.getConfig())\|\|null==(y=l.experiments)?void 0:y[n])&&c(t)&&navigator.globalPrivacyControl)return d;var n,o,i,s,a,l,y;return m(e\|\|(c(t)?f:u))}(t,e);return{defaultPolicy:!0,policy:o}}function m(t){return JSON.parse(JSON.stringify(t))}function P(t,e,n){let o;!!document.documentMode?(o=document.createEvent("CustomEvent"),o.initCustomEvent(t,!0,!1,n)):o=new CustomEvent(t,{detail:n,bubbles:!0}),e.forEach((t=>{t&&t.dispatchEvent&&t.dispatchEvent(o)}))}const v="consentPolicyManagerReady",b="consentPolicyInitialized",x="con
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This is the Sentry/Raven.js error monitoring library, a legitimate and widely-used tool. It sends error data to Sentry's servers (+2 for external data transmission), but it's a trusted service used for application monitoring. The code is minified but not maliciously obfuscated, and it follows standard error tracking practices." }
/! Raven.js 3.24.2 (26fcb59) \| github.com/getsentry/raven-js / !function(a){if("object"==typeof exports&&"undefined"!=typeof module)module.exports=a();else if("function"==typeof define&&define.amd)define([],a);else{var b;b="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:this,b.Raven=a()}}(function(){return function a(b,c,d){function e(g,h){if(!c[g]){if(!b[g]){var i="function"==typeof require&&require;if(!h&&i)return i(g,!0);if(f)return f(g,!0);var j=new Error("Cannot find module '"+g+"'");throw j.code="MODULE_NOT_FOUND",j}var k=c[g]={exports:{}};b[g][0].call(k.exports,function(a){var c=b[g][1][a];return e(c?c:a)},k,k.exports,a,b,c,d)}return c[g].exports}for(var f="function"==typeof require&&require,g=0;g<d.length;g++)e(d[g]);return e}({1:[function(a,b,c){function d(a){this.name="RavenConfigError",this.message=a}d.prototype=new Error,d.prototype.constructor=d,b.exports=d},{}],2:[function(a,b,c){var d=a(5),e=function(a,b,c){var e=a[b],f=a;if(b in a){var g="warn"===b?"warning":b;a[b]=function(){var a=[].slice.call(arguments),h=d.safeJoin(a," "),i={level:g,logger:"console",extra:{arguments:a}};"assert"===b?a[0]===!1&&(h="Assertion failed: "+(d.safeJoin(a.slice(1)," ")\|\|"console.assert"),i.extra.arguments=a.slice(1),c&&c(h,i)):c&&c(h,i),e&&Function.prototype.apply.call(e,f,a)}}};b.exports={wrapMethod:e}},{5:5}],3:[function(a,b,c){(function(c){function d(){return+new Date}function e(a,b){return q(b)?function(c){return b(c,a)}:b}function f(){this.a=!("object"!=typeof JSON\|\|!JSON.stringify),this.b=!p(Q),this.c=!p(R),this.d=null,this.e=null,this.f=null,this.g=null,this.h=null,this.i=null,this.j={},this.k={release:P.SENTRY_RELEASE&&P.SENTRY_RELEASE.id,logger:"javascript",ignoreErrors:[],ignoreUrls:[],whitelistUrls:[],includePaths:[],headers:null,collectWindowErrors:!0,captureUnhandledRejections:!0,maxMessageLength:0,maxUrlLength:250,stackTraceLimit:50,autoBreadcrumbs:!0,instrument:!0,sampleRate:1,sanitizeKeys:[]},this.l={method:"POST",keepalive:!0,referrerPolicy:I()?"origin":""},this.m=0,this.n=!1,this.o=Error.stackTraceLimit,this.p=P.console\|\|{},this.q={},this.r=[],this.s=d(),this.t=[],this.u=[],this.v=null,this.w=P.location,this.x=this.w&&this.w.href,this.y();for(var a in this.p)this.q[a]=this.p[a]}var g=a(6),h=a(7),i=a(8),j=a(1),k=a(5),l=k.isError,m=k.isObject,n=k.isPlainObject,o=k.isErrorEvent,p=k.isUndefined,q=k.isFunction,r=k.isString,s=k.isArray,t=k.isEmptyObject,u=k.each,v=k.objectMerge,w=k.truncate,x=k.objectFrozen,y=k.hasKey,z=k.joinRegExp,A=k.urlencode,B=k.uuid4,C=k.htmlTreeAsString,D=k.isSameException,E=k.isSameStacktrace,F=k.parseUrl,G=k.fill,H=k.supportsFetch,I=k.supportsReferrerPolicy,J=k.serializeKeysForMessage,K=k.serializeException,L=k.sanitize,M=a(2).wrapMethod,N="source protocol user pass host port path".split(" "),O=/^(?:(\w+):)?\/\/(?:(\w+)(:\w+)?@)?([\w\.-]+)(?::(\d+))?(\/.*)/,P="undefined"!=typeof window?window:"undefined"!=typeof c?c:"undefined"!=typeof self?self:{},Q=P.document,R=P.navigator;f.prototype={VERSION:"3.24.2",debug:!1,TraceKit:g,config:function(a,b){var c=this;if(c.g)return this.z("error","Error: Raven has already been configured"),c;if(!a)return c;var d=c.k;b&&u(b,function(a,b){"tags"===a\|\|"extra"===a\|\|"user"===a?c.j[a]=b:d[a]=b}),c.setDSN(a),d.ignoreErrors.push(/^Script error\.?$/),d.ignoreErrors.push(/^Javascript error: Script error\.? on line 0$/),d.ignoreErrors=z(d.ignoreErrors),d.ignoreUrls=!!d.ignoreUrls.length&&z(d.ignoreUrls),d.whitelistUrls=!!d.whitelistUrls.length&&z(d.whitelistUrls),d.includePaths=z(d.includePaths),d.maxBreadcrumbs=Math.max(0,Math.min(d.maxBreadcrumbs\|\|100,100));var e={xhr:!0,console:!0,dom:!0,location:!0,sentry:!0},f=d.autoBreadcrumbs;"[object Object]"==={}.toString.call(f)?f=v(e,f):f!==!1&&(f=e),d.autoBreadcrumbs=f;var h={tryCatch:!0},i=d.instrument;return"[object Object]"==={}.toString.call(i)?i=v(h,i):i!==!1&&(i=h),d.instrument=i,g.collectWindowErrors=!!d.collectWindowErrors,c},install:function(){var a=this;return a.isS
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This appears to be legitimate invoice/business configuration data. While it contains customer information and business details, it's structured as a static configuration object without any malicious indicators. The script doesn't perform dynamic code execution, data exfiltration, or suspicious redirects. The only minor concern is exposure of internal business data and customer information in a window object (+1) and potential use of customer data (+1)." }
window.__INVOICE__ = {"number":"49019005","currencyCode":"USD","customer":{"contactId":"a372c75f-fc8d-41dc-ba4f-ccae1a7acc7b","name":"a1293@avmc.shop","email":{"address":"a1293@avmc.shop"},"phone":{},"company":{"id":""},"firstName":"","lastName":"","billingAddress":{}},"dates":{"issueDate":"2024-11-26T00:00:00Z","dueDate":"2024-12-26T00:00:00Z","timeZoneCode":"America\u002FNew_York","lastSeenDate":"2024-11-29T04:23:30.578Z"},"lineItems":{"lineItems":[{"id":"812aab7c-5f2c-49b3-a45a-09b0a2cdce0a","name":"McAfee Total Care","description":"","price":{"serializedValue":397.99},"quantity":{"serializedValue":1},"source":{"sourceId":"13ee94c1-b635-8505-3391-97919052c16f","sourceType":"ADMIN"},"metadata":{}}]},"locale":{"language":"en"},"totals":{"subtotal":{"serializedValue":397.99},"total":{"serializedValue":397.99},"taxedAmount":{}},"metaData":{"notes":"\u003Cp\u003Eif you did not authorize this transaction or wish to cancel, please contact our support team promptly at \u003Cstrong\u003E+1 818 732 9850\u003C\u002Fstrong\u003E. To avoid charges, cancellations must be completed before the renewal date. Thank you for being a valued customer, and we are here to assist with any concerns.\u003C\u002Fp\u003E","legalTerms":"","source":"13ee94c1-b635-8505-3391-97919052c16f"},"dynamicTotals":{"paidAmount":{},"balance":{"serializedValue":397.99}},"title":"","customFields":[{"id":"ff147c8f-c85a-414c-b274-ce213ecd8a94","namespace":"invoices","group":"FOOTER","value":{"value":"\u003Cp\u003Eif you did not authorize this transaction or wish to cancel, please contact our support team promptly at \u003Cstrong\u003E+1 818 732 9850\u003C\u002Fstrong\u003E. To avoid charges, cancellations must be completed before the renewal date. Thank you for being a valued customer, and we are here to assist with any concerns.\u003C\u002Fp\u003E","valueType":"STRING"},"originCustomFieldKey":"invoices.footer.notes-a"},{"id":"af6060ef-2fe3-4c64-8dfa-70e5ae28e578","namespace":"invoices","group":"FOOTER","value":{"valueType":"STRING"},"originCustomFieldKey":"invoices.footer.notes-b"}],"deductTaxes":false} window.__FOOTER_LABELS__ = {"notesLabel":"","legalTermsLabel":""} window.__INVOICE_NUMBER_LABEL__ = "" window.__RECURRING_INVOICE_VIEW_ENABLED__ = false window.__STATUS__ = "Sent" window.__BUSINESS_INFO__ = {"email":"cs-help@mcafee.com","phone":"818-732-9850","logo":"\u002F\u002Fstatic.wixstatic.com\u002Fmedia\u002Fdeade9_c0186c6befa84e95934f452443ce9d40~mv2.png","address":{}} window.__INVOICE_ID__ = "9b27124a-a130-45dc-b81f-e5675b538826" window.__INVOICE_VERSION__ = 170 window.__INSTANCE_ID__ = "2d5e7023-6014-4f5e-ab31-c1e25d999b96" window.__TOKEN__ = "56c18155-b636-4505-b95c-630f3d19901a" window.__HAS_PAYMENT_METHODS__ = false window.__URL_PREFIX__ = "https:\u002F\u002Fwww.wixsite.com\u002F\u002F_api" window.__CONSENT_POLICY_ENABLED__ = true window.__DATA__ = {"msid":"369aa7cd-4412-499e-a8a5-42fc20911594","experiments":{"experiments":{"specs.invoices.SwapRecurringInvoicesArtifactId":"true","specs.chat.ChatroomParticipantsUpdated":"true","specs.chat.UnreadMessagesButtonDesktop":"true","specs.woa.IsInvoicesPaymentsSectionEnabled":"true","specs.chat.ChatroomParticipants":"true","specs.ident.OwnerApp2FA":"true","specs.ident.ShouldActivateNewColorBrandingForMembersPermissions":"true","specs.crm.RemoveAscend":"true","specs.ident.UsePasswordPolicyOnResetPassword":"true","specs.crm.PriceQuotesNewExternalChat":"true","specs.home.new_page":"false","specs.crm.SkipMigratedRulesOnRuntime":"true","specs.accountSettings.UnlockWithoutAuthentication":"true","specs.invoices.PremiumBlockUoU":"true","specs.ident.newDeleteAccount":"true","specs.chat.LazyLoadEmojiPanel":"true","specs.ident.platformizedNotFound":"true","specs.ident.NewCardsUi":"true","specs.invoices.ThankYouPageUoU":"true","specs.premium.UseRelativeUrlsToSupportEditorX":"true","spec.wos.NewWix2XWizard":"true","specs.ident.deleteAccount
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This appears to be a legitimate webpack bundle containing error tracking/monitoring functionality. It includes standard promise implementations and client-side error capture methods. While it does communicate with external services (likely for error reporting), this is typical for monitoring solutions. The code is minified but not maliciously obfuscated." }
(self.webpackJsonp_price_quotes_server=self.webpackJsonp_price_quotes_server\|\|[]).push([[264],{97008:(e,a,t)=>{"use strict";t.d(a,{u:()=>V});var s,l=t(3968),o=t(87856),i=t(53884),n=t(22300),r=t(9936),c=t(5240),d=t(63904);!function(e){e.PENDING="PENDING",e.RESOLVED="RESOLVED",e.REJECTED="REJECTED"}(s\|\|(s={}));var u=function(){function e(e){var a=this;this._state=s.PENDING,this._handlers=[],this._resolve=function(e){a._setResult(s.RESOLVED,e)},this._reject=function(e){a._setResult(s.REJECTED,e)},this._setResult=function(e,t){a._state===s.PENDING&&((0,c.Oe)(t)?t.then(a._resolve,a._reject):(a._state=e,a._value=t,a._executeHandlers()))},this._attachHandler=function(e){a._handlers=a._handlers.concat(e),a._executeHandlers()},this._executeHandlers=function(){if(a._state!==s.PENDING){var e=a._handlers.slice();a._handlers=[],e.forEach((function(e){e.done\|\|(a._state===s.RESOLVED&&e.onfulfilled&&e.onfulfilled(a._value),a._state===s.REJECTED&&e.onrejected&&e.onrejected(a._value),e.done=!0)}))}};try{e(this._resolve,this._reject)}catch(e){this._reject(e)}}return e.resolve=function(a){return new e((function(e){e(a)}))},e.reject=function(a){return new e((function(e,t){t(a)}))},e.all=function(a){return new e((function(t,s){if(Array.isArray(a))if(0!==a.length){var l=a.length,o=[];a.forEach((function(a,i){e.resolve(a).then((function(e){o[i]=e,0===(l-=1)&&t(o)})).then(null,s)}))}else t([]);else s(new TypeError("Promise.all requires an array as input."))}))},e.prototype.then=function(a,t){var s=this;return new e((function(e,l){s._attachHandler({done:!1,onfulfilled:function(t){if(a)try{return void e(a(t))}catch(e){return void l(e)}else e(t)},onrejected:function(a){if(t)try{return void e(t(a))}catch(e){return void l(e)}else l(a)}})}))},e.prototype.catch=function(e){return this.then((function(e){return e}),e)},e.prototype.finally=function(a){var t=this;return new e((function(e,s){var l,o;return t.then((function(e){o=!1,l=e,a&&a()}),(function(e){o=!0,l=e,a&&a()})).then((function(){o?s(l):e(l)}))}))},e.prototype.toString=function(){return"[object SyncPromise]"},e}(),p=t(28064),y=t(71296),m=t(86864),f=t(23592),h=t(68172),N=t(60744),g=[];function k(e){var a={};return function(e){var a=e.defaultIntegrations&&(0,o.KQ)(e.defaultIntegrations)\|\|[],t=e.integrations,s=[];if(Array.isArray(t)){var l=t.map((function(e){return e.name})),i=[];a.forEach((function(e){-1===l.indexOf(e.name)&&-1===i.indexOf(e.name)&&(s.push(e),i.push(e.name))})),t.forEach((function(e){-1===i.indexOf(e.name)&&(s.push(e),i.push(e.name))}))}else"function"==typeof t?(s=t(a),s=Array.isArray(s)?s:[s]):s=(0,o.KQ)(a);var n=s.map((function(e){return e.name})),r="Debug";return-1!==n.indexOf(r)&&s.push.apply(s,(0,o.KQ)(s.splice(n.indexOf(r),1))),s}(e).forEach((function(e){a[e.name]=e,function(e){-1===g.indexOf(e.name)&&(e.setupOnce(i.e,N.WS),g.push(e.name),d.Q.log("Integration installed: "+e.name))}(e)})),a}var v,b=function(){function e(e,a){this._integrations={},this._processing=0,this._backend=new e(a),this._options=a,a.dsn&&(this._dsn=new r.W(a.dsn))}return e.prototype.captureException=function(e,a,t){var s=this,l=a&&a.event_id;return this._process(this._getBackend().eventFromException(e,a).then((function(e){return s._captureEvent(e,a,t)})).then((function(e){l=e}))),l},e.prototype.captureMessage=function(e,a,t,s){var l=this,o=t&&t.event_id,i=(0,c.od)(e)?this._getBackend().eventFromMessage(String(e),a,t):this._getBackend().eventFromException(e,t);return this._process(i.then((function(e){return l._captureEvent(e,t,s)})).then((function(e){o=e}))),o},e.prototype.captureEvent=function(e,a,t){var s=a&&a.event_id;return this._process(this._captureEvent(e,a,t).then((function(e){s=e}))),s},e.prototype.captureSession=function(e){e.release?this._sendSession(e):d.Q.warn("Discarded session because of missing release")},e.prototype.getDsn=function(){return this._dsn},e.prototype.getOptions=function(){return this._options},e.prototype.flush=function(e){var a=this;return this._isClientProcessing(e).then((function(t
URL: https://www.wixsite.com/_api/invoice/2d5e7023-6014-4f5e-ab31-c1e25d999b96:9b27124a-a130-45dc-b81f-e5675b538826/view?token=56c18155-b636-4505-b95c-630f3d19901a Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Download PDF", "prominent_button_name": "Download PDF", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://www.wixsite.com/_api/invoice/2d5e7023-6014-4f5e-ab31-c1e25d999b96:9b27124a-a130-45dc-b81f-e5675b538826/view?token=56c18155-b636-4505-b95c-630f3d19901a Model: Joe Sandbox AI	{ "brands": [ "McAfee" ] }
	{ "brands": [ "McAfee" ] }
URL: file:///C:/Users/user/Downloads/Invoice.pdf Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: file:///C:/Users/user/Downloads/Invoice.pdf Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: file:///C:/Users/user/Downloads/Invoice.pdf Model: Joe Sandbox AI	{ "brands": [ "McAfee" ] }
	{ "brands": [ "McAfee" ] }
URL: file:///C:/Users/user/Downloads/Invoice.pdf Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: file:///C:/Users/user/Downloads/Invoice.pdf Model: Joe Sandbox AI	{ "brands": [ "McAfee" ] }
	{ "brands": [ "McAfee" ] }

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.193024528717761
Encrypted:	false
SSDEEP:
MD5:	662FF101A451D65A57CC8DBC92B51514
SHA1:	A48B1F3619DCA6E394B4B61350DF907A6286E68A
SHA-256:	BB3C81F3E5547D43A0D4C74C449912401DEB72201A49CA500EACA1BEA0EA0149
SHA-512:	96BA3B4455FFE0980A2F319ADD19056FD3A2DD0C9DBAF8C4BC9BCE3F454B99AB4999366FFE0D8D78E8AB7F98C1F839FC30186F8E5E28716C2BBBAB91569CDE98
Malicious:	false
Reputation:	unknown
Preview:	2024/11/28-23:26:28.606 db0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/28-23:26:28.609 db0 Recovering log #3.2024/11/28-23:26:28.609 db0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.186864889552928
Encrypted:	false
SSDEEP:
MD5:	E13BC49B4D9D03087830BF2655379A16
SHA1:	4CEAF626B80F2CD3A2DAFC4ED43D61CF9015C412
SHA-256:	C386C3544D56EF7F3CD68CD72B90A7957BBE53AB494AA018ACEC2E7CA494BE30
SHA-512:	148528EF6DC067FE199DB227F633767F460C8B8D431798D0974854CA34C7564B82B0DE430FB306966F33B1E66B8CE20999560A1F9DB372ECEF97A5C8C167A0F0
Malicious:	false
Reputation:	unknown
Preview:	2024/11/28-23:26:28.512 f60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/28-23:26:28.515 f60 Recovering log #3.2024/11/28-23:26:28.515 f60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.236334191867247
Encrypted:	false
SSDEEP:
MD5:	CF7C492B176989A8450DBCD875E23737
SHA1:	4CEF0D562B5A9B07FEDDFFF14DA0D2CB25A1D6A7
SHA-256:	21BC3C866ECB1BADE603A502602BE2C633CFF8109913819C2EFA1F0E481AD0FE
SHA-512:	BCBBCC46DB2D2F0C11F8DD1B17FD7ACD6F8B75D4B8F1C4C4CE2005D3FE07543C08404D0500C55ECCB78DD4D356E70F4158BE85429EAE959903E65EBAA51F23A6
Malicious:	false
Reputation:	unknown
Preview:	*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.178751376933146
Encrypted:	false
SSDEEP:
MD5:	2097FE57B6D6DE65B7CE9402AC25C668
SHA1:	35739DAD8FB4CA36C6E01F927F13A9AF0C921D52
SHA-256:	B3C17ABDFB07E43327CB519E036F11F74CBE04E013CB2BE59108D4AEE1D212EC
SHA-512:	5A0131EE6F9085B7DDE109FD4B60014F0EBEE411853D369A76CB1C4DFB3FA12DE374EBF11520A1C4412C68B791F3190C8BFAB522021E9FBB70CF0FEF514C278F
Malicious:	false
Reputation:	unknown
Preview:	2024/11/28-23:26:28.640 f60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/28-23:26:28.641 f60 Recovering log #3.2024/11/28-23:26:28.643 f60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241129042632Z-180.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
Category:	dropped
Size (bytes):	71190
Entropy (8bit):	1.2363875764724648
Encrypted:	false
SSDEEP:
MD5:	543BE9CFFE85FB723F87E32ED735130F
SHA1:	467E0AB3CE660EF3AE59B468BE39B37D2E8E9536
SHA-256:	1CB52CA0EFDA3E0265DB955EBABCAE1D3BC42EAAB67804A5D62BFA95A368D6E7
SHA-512:	8D36C8A8EC1023AD424CBA72194607430186A263AF9B5AFFFA07917D6CC402EC485DDAEB051BD3F100F14E32CC36E518A58ADE2E97D2CF4BE476685CADF228EF
Malicious:	false
Reputation:	unknown
Preview:	BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.291927920232006
Encrypted:	false
SSDEEP:
MD5:	A4D5FECEFE05F21D6F81ACF4D9A788CF
SHA1:	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
SHA-256:	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
SHA-512:	FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	16928
Entropy (8bit):	1.215195758896828
Encrypted:	false
SSDEEP:
MD5:	6E6115BC6EE7C42C66BE6368B0BD2449
SHA1:	A9C5BB5B276965471A49E857AF4AEF13994E8603
SHA-256:	17155398641F54117303B823CEE5C178A8741186024E4B3397BE6B6C8FC45F3B
SHA-512:	9D5C71310A3830EEC291293E622DDDA829B9136707713B26A298277BFEF408FFB423C411E67D131BE24EF41328203B216E51A6528AF526B17895038CA468DD87
Malicious:	false
Reputation:	unknown
Preview:	.... .c.......y........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Reputation:	unknown
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	unknown
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7686775296558497
Encrypted:	false
SSDEEP:
MD5:	79A0E4DBAF2794C7BC08C17790130088
SHA1:	F8BC443FB8E44399998FB4DFA9530B67BCFEB2ED
SHA-256:	8CD3E366698AA7C2E0B10E16697DF84052A8409B7ADFF1B687532E5FBECA965A
SHA-512:	5999553C15CB0EC90AF62036F09CF73A275E0EE57964AE7AA090934F89F67F4DD1CC9AE385A87D78EDE5EED4EB70D0F78B4DFFC72313595BE3D188E9CD59FA17
Malicious:	false
Reputation:	unknown
Preview:	p...... .........b...B..(....................................................... ..........W.....-..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2539954282295116
Encrypted:	false
SSDEEP:
MD5:	BB7A7FBCECE8835C87B7EA579833F7D8
SHA1:	19E76415B0AB7BE0EA14EA2A08D402823A4BEA72
SHA-256:	C234B4AA291F5069450B1643ADDB452325AAD04ACBC04B0F0B489EABDFC7EC27
SHA-512:	4AD5911C120C1046E2F681D2EE286CFA7AED029CA4467016E6B3CA66595A71F77C4B6FA301B794E17E16B5FD469C382961DA8D6178EB796AF5E6529D981A3CB6
Malicious:	false
Reputation:	unknown
Preview:	p...... ........Y...B..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Reputation:	unknown
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6860

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Reputation:	unknown
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Reputation:	unknown
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Reputation:	unknown
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6860

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Reputation:	unknown
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.385055136801943
Encrypted:	false
SSDEEP:
MD5:	083B04DD3E28EBB6DA41B438BB471F55
SHA1:	F244191BC614A2606D3921605558A4CEAF6A8DB7
SHA-256:	5841AD3D80032F1EB05F9B70F67CE3F94A9E4027F40AEF293D3BD0FC60DD215F
SHA-512:	C06D2ED50593C5F15BCDA53597DDF695960884D0BC1042E24811540A98A10120605EE1A881FB37E60442745C74D797AFDFE1CDAD590406E4CCBAEC79250EDA6B
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"30fc8a31-9f84-4d30-b0f3-b9007fd9650d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1733029643152,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.334499738679078
Encrypted:	false
SSDEEP:
MD5:	E039F628CFF94008DC182C0BC37016CF
SHA1:	3C10310F14A10658198019078091F34B69F508D8
SHA-256:	5CF8448392D87E929AA3E7DD2E086AC598A2D8AB559DCC0B685171B3076EC8DD
SHA-512:	3EE67E96CF1CC034292FA98B4E2567524CDAF107B51AC71D41A816C314897B34D42AD1B3A1CA63C142A82BF929CE98641C29A0A5DC5B5A786FC733501B6D055A
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"30fc8a31-9f84-4d30-b0f3-b9007fd9650d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1733029643152,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.312899057547509
Encrypted:	false
SSDEEP:
MD5:	3B97F0E4AAFFAB813E314EFB1AE2B184
SHA1:	4543E999CDC1C8D3EE8A4966D2F42CE5D64721E7
SHA-256:	43927EA9133472EFBF848E2ECEFB08B9A47EC1CB62383EAC755ECCB180E0CDCE
SHA-512:	1527D7DB3CB9D7F5EB952F3ADB077557FC4740D2672C6548836E3B18E9E45BB165066004F05A62EAD84FE352ED6A9A4FB65505B2D721F6343DDBC2D495C7B733
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"30fc8a31-9f84-4d30-b0f3-b9007fd9650d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1733029643152,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.374196439595035
Encrypted:	false
SSDEEP:
MD5:	ADAB79BFCD817BA332A0657534B44F6B
SHA1:	64BA1EC29495087B27E4DDA13E8076AC66079900
SHA-256:	5F42C88AF635E9121CC0FB6169B7358484B2A9F1CFBE84B7E03C5C30DDAC3E1E
SHA-512:	66F3BB5D7670287C072301B0E56E79F8A7435F948B4DA1958106BC49D537F65C32AE1B246345C3BDF6967985E48A9F43DF2E3C4FF3EE25F7DBA58476CF6A1BA4
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"30fc8a31-9f84-4d30-b0f3-b9007fd9650d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1733029643152,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689919344655719
Encrypted:	false
SSDEEP:
MD5:	4382768924B645D4730B5BBD5681C80A
SHA1:	3817674DC9C770D17C4C22EA7612D66EE0AA04F6
SHA-256:	9D9C29022902BA6C564120F81F91617BACA577F6CA5410BBC02C5AF9E176B03E
SHA-512:	FAD65B2DF5A6DA8B62094CB07B06F13A8FEC84A44BFBEE6F64B0657FDFF570DB9E27E7C7833AF6BE76FEFE1A058F1E94C074379A836541E8821F4153568B0420
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"30fc8a31-9f84-4d30-b0f3-b9007fd9650d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1733029643152,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1122
Entropy (8bit):	5.683834404134344
Encrypted:	false
SSDEEP:
MD5:	B1716E07462A0599FEDE96E8B13D4005
SHA1:	B4AA59BA096BFAEAC091FA8D89B3D7DAF8E1C7CA
SHA-256:	3FBEBC9A454FD2D8FB661991F39AAF99F2359F9C7008F8166866C9410213A33C
SHA-512:	0E5BD26F4F3079F57BAC69DE0CA10405F34DAF54E9773E1C3B8E9B95B88194E665726B39C5B1B1D310FD163C59060B0BB9ADB2D2025CF3C30802C7FA22AEDC83
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"30fc8a31-9f84-4d30-b0f3-b9007fd9650d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1733029643152,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_0","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"1aad653c-ef44-43f7-be1c-3a2ba2cf2cfc","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuIFBERiBmb3JtcyAmIGFncmVlbWVudHMuIn0sInRjY

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.325797796400662
Encrypted:	false
SSDEEP:
MD5:	89E87B4DAB4D5B4D79A95C146EFDAA10
SHA1:	92E8D4A74D37656B8CBAD613669A8CB846670F09
SHA-256:	125A86BAE063544A0FA4E766C92950BF08CFE6C34CE329C21762630234AC8E6F
SHA-512:	93A3002D93DC0A774A241AF3F67A99B2DDBCB3AD583EDFEBBFF12A018E8075766D57E9CFC18EC6D75574F8D5E23AC238F13BC1E04E8FC76D92B7ABB49894F502
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"30fc8a31-9f84-4d30-b0f3-b9007fd9650d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1733029643152,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	5.673938211389714
Encrypted:	false
SSDEEP:
MD5:	156E056E79491E1F40458B06A2568919
SHA1:	73DF6073BA49CC671FC23052261A76F25F009E65
SHA-256:	03232EA08F6E5E41AF790D8CF63A1723F16890B7E6B439674636F08763CA371E
SHA-512:	40414C6B3D6E39C9F3AC67BCBEBBCFB380E93A042DCD96318C420008C7D0BF45BE86C420EBAFC74C69C28B5B0546DC494897BDBFE678F60B702FC6D6244ECE8C
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"30fc8a31-9f84-4d30-b0f3-b9007fd9650d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1733029643152,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_1","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"533ab5eb-b236-4889-89a5-ac002261d71e","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkVkaXRQREZSZHJBcHBGdWxsIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTRweCIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTJweCIsImZvbnRfc3R5bGUiOiItMSJ9LCJ0aXRsZSI6bnVsbCwiZGVzY3JpcHRpb24iOiJFZGl0IHRleHQsIGltYWdlcywgcGFnZXMsIGFuZCBtb3JlLiJ9LCJ0Y2F0SWQiOm51bGx9","da

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	5.703336743632868
Encrypted:	false
SSDEEP:
MD5:	45FCAE67D4ADA2F700F5D5EFB381668C
SHA1:	CB6C7D507D04D0E8E5D5A7B6A510B92260AC5D81
SHA-256:	B74D8C86A3DC9BE3E44322B8E82F51551E2789CF470E0FBB5B43FB8585EB8879
SHA-512:	0AAE5E2DF91518CF3D40876CCC7A2A01634173EC52243C4964097267B28E1963AF2F954356C3221DD0E438AB83A0B18DC5684BCCA1A8B72BA6445B69594D661C
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"30fc8a31-9f84-4d30-b0f3-b9007fd9650d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1733029643152,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.329488657477424
Encrypted:	false
SSDEEP:
MD5:	AF5A509E515CB6AFAE1AE32802E5DAEE
SHA1:	94A2B1D69B75F01B744185BCB56D0E80370BAA5B
SHA-256:	9FF3FF8E558F0C202F8B1FDC628BFCD65FCCEBF17F0CA0E4DD008559153D92F4
SHA-512:	1F497E9D6838D03CC204DF85972FB885C424E63A47727986AABE1AE905A7F3CF14A4416773AE21F6CA745386436C6C912241F13F0AC74AEFA565E09815FB187B
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"30fc8a31-9f84-4d30-b0f3-b9007fd9650d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1733029643152,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.3157404952721405
Encrypted:	false
SSDEEP:
MD5:	91D21DF97DF1E2ED46983262772E0356
SHA1:	55B7DBAE8377547499DB2CEC8A39013C22D928A0
SHA-256:	EA1BAA010E4D51EC5B2FA17EC2F82E5AD99DB761A90396880F8A1C9B6EACAAA9
SHA-512:	D81CEC0B34ED0BF49DA6C96D9B7CEC9209E0EEBB6AE89E29B84C07C16D8624143B702F379078B8BD6F44EB38F730B068EC5C5F97CAA8C38D92EC861EA3CD61B9
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"30fc8a31-9f84-4d30-b0f3-b9007fd9650d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1733029643152,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.3128330839658755
Encrypted:	false
SSDEEP:
MD5:	FA33996753FE9965153757DCCDC29E86
SHA1:	ABF3712A7C64EB299280AF3BA1F5CD7AD0BE93AA
SHA-256:	09BFAEB3D67D91DF185E59BF9F6846AA79A8FB638358CA01203CE709EFF2F10E
SHA-512:	9DF00B19CD6C725AA90E8D5B1557026487F9751CA2A7DF2BA335AE75C142FDE3300FA72610A7E430A1986A8947BE079988022D5AE56BB3D85A1F3A3FC439116D
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"30fc8a31-9f84-4d30-b0f3-b9007fd9650d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1733029643152,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.316308190724693
Encrypted:	false
SSDEEP:
MD5:	CA5502F9A6E2D0DE41F198EFD94B0FBE
SHA1:	34D6BF2C4B1AE01A2458951EDD9BD6B0D998B956
SHA-256:	8C04AD55C629141FFF29CA8E6E724F4B12014F3CADDF415A2056357C5EF29973
SHA-512:	FEEB017FE3BA7D6BEDC7E1774B3440DB7A448F9851B3FA4BA8497CCBDFEA974768B3E8A632B9763E4669CD64E23D8138D44DAB648A35858CB73CD2772166EDE1
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"30fc8a31-9f84-4d30-b0f3-b9007fd9650d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1733029643152,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665523314133721
Encrypted:	false
SSDEEP:
MD5:	385240007837F87B675F1ACC186123EE
SHA1:	8F94CC5644103D7CF1531A6084135824A6B7B444
SHA-256:	CA8E234F0E8C4513573A8C506F8B3BC44AD211AD095A00A8F4B938CCA0708361
SHA-512:	4FAE907935E87AC5C9AAE57EE0CA57A73F77BF563214215A9AC2F78CEF990DE130B2730D8B687442BA1F1114C365C6D59FBA7AAA3D1A0C8E97AE97426BA79F0B
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"30fc8a31-9f84-4d30-b0f3-b9007fd9650d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1733029643152,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.290906254526122
Encrypted:	false
SSDEEP:
MD5:	CD8194C85A7D7316B8B776DC87F80246
SHA1:	C2EEEAB75533A7D001C017BB96946EDCF29BD3A7
SHA-256:	DAFBA6C764056B31A5E552927DD1BF6C460D15BBFB22FF2116E03DBCE7994F64
SHA-512:	A38001D5C5F7FA962AC7004B66432793EF35FB95BCB133C15F07A3DB8557D3F2B1436307F39291EC5D4B79486BB2B6EACB035E3417C9AAE77A57C03E510FA8C9
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"30fc8a31-9f84-4d30-b0f3-b9007fd9650d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1733029643152,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.295923346155939
Encrypted:	false
SSDEEP:
MD5:	C360ADEE42C7B9A890F139B568FF95AC
SHA1:	5BD039FD88F2E3C2EC8438F191AF3B8FC73B3403
SHA-256:	3E791F5170B023A51C7DC9507EE09B68E635AE86D87FB8C5C8E0DCF775E07BDE
SHA-512:	C52FC92CDA2A8D9CC321C60AA36A9E3E3C335359F362AFBC34F63CD0A54989CF1D4024D3D0699FC4427C2336D2736C6FBB574A8980939EE28338AC95C09A64C7
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"30fc8a31-9f84-4d30-b0f3-b9007fd9650d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1733029643152,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Reputation:	unknown
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2817
Entropy (8bit):	5.146863074658427
Encrypted:	false
SSDEEP:
MD5:	B8E7E1EB98C1EBFCEB68AB6B2FF7CD1B
SHA1:	18E104EA4746DD56B3D410B9D336EA69A3B1AA5A
SHA-256:	4A7B644754E40EB54EFADA4D74019D850DA62B0733BFFE423E8D262A255E3945
SHA-512:	D38B368B667AE9D42B6C4873423C94EAF6AEE76569AB5F39B8740A59684BC4D98EB903045E61DC1E3C9B037564839A562CD2873C3DA86C22C4BC3C9CB4D66967
Malicious:	false
Reputation:	unknown
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"83269443c25ab36d1dbfcc602fb8b47e","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1122,"ts":1732854397000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"366ccd35a2b7933bf37e430dfebc7c45","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1732854397000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"75c28ece153ebe52a783e7a10679813a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1732854397000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"1d127838da5ea90cc95b490972d8772a","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1732854397000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"b78b6a7500824dc6e23f1f9ac627ddd7","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1102,"ts":1732854397000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"7e37c69ad62aa389b303831d5162e5bc","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9875230850361824
Encrypted:	false
SSDEEP:
MD5:	07ED142A65CA788250907FF414F10DF8
SHA1:	9CFBB1C98525039509B04ED334D0837492CB0C7C
SHA-256:	FA6B9D1350604341D295DDFC41DC615A736776F729E092EC4B4C5CA45149F377
SHA-512:	A5F97288CC7204492481B0555060AF5BF11015468D17709C3B3CADDB54B1DB857ED7B7EA69F260F0ADCC635DCD830FCE3CEDE0154107F64EE63145D39A219AFF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.344438063950462
Encrypted:	false
SSDEEP:
MD5:	053FF57CBABF92BBB142A8ED285FADEE
SHA1:	46F5972BC687C211CEF759F2ACCA2F12746FE925
SHA-256:	5F8B2E03AA9DA4ECA572676B59ED19EBE7003DC14EDCEAD19CF14663D4CB70FA
SHA-512:	317E83E7E821D7472BFB24F1C19AADAA6B6060183AE3B3B8B612408326A04DF4C7FEA73F5029D3C490E15F5F814659ECAF96C983E51F7CB3A15ABD2C3D091632
Malicious:	false
Reputation:	unknown
Preview:	.... .c.....H.."......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:
MD5:	DEA5500FC5CA46F4FD4F678BE5A7B10D
SHA1:	5551F6B69D0E44A156BF211D9200734F4659DF9C
SHA-256:	FED41E76233633FB5D412277410551D059192F486DB3B2E005E9F4A73BD819F6
SHA-512:	EEC4EA3116695B081A57FDB3A7AF0B64DF36BDD52362157E6420F5C0916D5EF215B545311B56E654B1E80C60ABA3AFA34035D591E400E0A4BB4671EBE7F9E0D2
Malicious:	false
Reputation:	unknown
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\MSIfa620.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5278731006694652
Encrypted:	false
SSDEEP:
MD5:	71EB3BE67C4101D91F24CA926D5AA4B7
SHA1:	48439494BF8B8D8735CC7401EFDDA1C2F14CFC0E
SHA-256:	EF966BAFF89A3E4134584ECB1AC4DD96726618D19B4565650F05920FB96EDF53
SHA-512:	9D37686EE2D22CD0B21F87527A19B4C35FDE82C14F02D8D1EF83EF026E50F17F4A6EC9E931A48A31B3B42A203C094F8DC386D0E1B7FC82A077E9790DC7C70F3D
Malicious:	false
Reputation:	unknown
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.8./.1.1./.2.0.2.4. . .2.3.:.2.6.:.3.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-28 23-26-31-032.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.353642815103214
Encrypted:	false
SSDEEP:
MD5:	91F06491552FC977E9E8AF47786EE7C1
SHA1:	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
SHA-256:	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
SHA-512:	A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
Malicious:	false
Reputation:	unknown
Preview:	SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15100
Entropy (8bit):	5.321856983999561
Encrypted:	false
SSDEEP:
MD5:	8750C2830B8175BE74408A88C6B71214
SHA1:	47BB47874AC4A2ED1FE5014B149E9F3C3C4D1321
SHA-256:	CB5E02CDD0E375CCB6D399BA7C9DDF498E0BC55C24FB4775F47DB57BA438E911
SHA-512:	F3354058230A203B0737AB89BB112A467F999517061215904A9089ED405421E3956B0809E3F1569C0903D2D482F7EC4DD7058124CFBE3212EE93D79EDEB80232
Malicious:	false
Reputation:	unknown
Preview:	SessionID=b8b2c4e3-061e-445c-8280-10623c703245.1732854391043 Timestamp=2024-11-28T23:26:31:043-0500 ThreadID=2184 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b8b2c4e3-061e-445c-8280-10623c703245.1732854391043 Timestamp=2024-11-28T23:26:31:045-0500 ThreadID=2184 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b8b2c4e3-061e-445c-8280-10623c703245.1732854391043 Timestamp=2024-11-28T23:26:31:045-0500 ThreadID=2184 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b8b2c4e3-061e-445c-8280-10623c703245.1732854391043 Timestamp=2024-11-28T23:26:31:045-0500 ThreadID=2184 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b8b2c4e3-061e-445c-8280-10623c703245.1732854391043 Timestamp=2024-11-28T23:26:31:045-0500 ThreadID=2184 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.419053616513847
Encrypted:	false
SSDEEP:
MD5:	92DD05E6DFB89FFEBC2578C1F944DF24
SHA1:	9B2A7D1EA44DAD747165E0ABA5001CE11869114F
SHA-256:	53A729DC7E445B1ED74810B71CCE48DCC676E271DDDDF0839CB4558F7525A7A1
SHA-512:	1CE9C3FDC8C9CC8B8D65A4D2403F0404180493A8B39B585A4479C769CFB1D5A840A529AA28E3B9EBF53F9185842502BDCD22804127DFB857C7DDBA719896A862
Malicious:	false
Reputation:	unknown
Preview:	06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : *************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***********************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0bdb4038-1b2f-4ccc-a78e-4c991b0806aa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:
MD5:	0A347312E361322436D1AF1D5145D2AB
SHA1:	1D6C06A274705F8A295F62AD90CF8CA27555C226
SHA-256:	094501B3CA4E93F626ABFCAE800645C533B61409DC3D1D233F4D053CE6A124D7
SHA-512:	9856C231513B47DD996488DF19EEE44DBB320E55432984C0C041EF568B6EC5C05F5340831132890D1D162E0505CA243D579582EDB9157CF722A86EC8CE2FEAFE
Malicious:	false
Reputation:	unknown
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\1df436fc-e527-43ca-994f-2b538e1c8aaa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Reputation:	unknown
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7adc084d-b6b4-4a75-99c8-309bbf2f7b14.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Reputation:	unknown
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e81b3deb-11ed-4462-bf92-2e14108ee35e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Reputation:	unknown
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 29 03:25:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.98805194076879
Encrypted:	false
SSDEEP:
MD5:	89BF848BE07066805D6C5FAA95E89309
SHA1:	8713079520C7EBBCB16352D3B584BC91CF0235B2
SHA-256:	35189A5E6EAE3CF3729AAF1AF33BD92F46C277BA6545AFC7D27383EC9328292D
SHA-512:	BA8C1758A6A589FF3177B9EA8277A79ABAEBAFAAA745599B17947F6EF48A6FC77712AE73D04278F40FBC1F31E1DE3898E73AC0EFC509FB7958C4C1C2121574D2
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....r...B..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I}Y'#....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V}Y/#....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V}Y/#....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V}Y/#..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V}Y0#...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........=.z......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 29 03:25:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.004949959405258
Encrypted:	false
SSDEEP:
MD5:	DE0547B2E168EF5B9D351D448C59C137
SHA1:	91F82F8156A04AA738E0AC39E4D9B2DE63430731
SHA-256:	0D7348CECD37AD7F7924B1A3CBDDA6B5865791F87FB2EFE53ABA9D3AD228BFA4
SHA-512:	ADC3DFCFF767AFBB056045240E9723DB559025AF5AF281C281FA7CDDE11D77666693E2805689BDFDBD544AEBAD183B79B2EBF8E154576B461D24037F5A756604
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....K..B..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I}Y'#....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V}Y/#....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V}Y/#....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V}Y/#..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V}Y0#...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........=.z......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.0137828627902294
Encrypted:	false
SSDEEP:
MD5:	7AA452FED59DE72CAADAE43E2E91C4F1
SHA1:	09E0DE68F747D6C64116AEE9B668852053000CDB
SHA-256:	9B0DC521190CCD03BCBD971E6CFEC47FC05D865C7D22CEC4FC9C7482BF21F7AC
SHA-512:	40B258C9D0D1E778877A9034602A1C3A597F84583405C406FC606B7D1B9AAB23B71C9CB04D94AF412CD7245F472CB74034C3DB092D98796A44C087CAE3898259
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I}Y'#....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V}Y/#....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V}Y/#....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V}Y/#..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........=.z......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 29 03:25:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.001712368285865
Encrypted:	false
SSDEEP:
MD5:	E5DCA0FA543B857519DC37D1A6DE1493
SHA1:	AD542339B15C89912A3895EA60207C457851B5B9
SHA-256:	7878A92BFA457FC78720C94D6604DFDED3B4041C6D40DB96E8F1BACB40B48C85
SHA-512:	32280B6BC22D6BBB6BBF08FC900B7D9A9D554CAF947BC60A90776711C8BB14B0F724F86E873E46298CFC15F627D0DFDB866B0A1CBB242A6FD967F7171D0889E5
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....W..B..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I}Y'#....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V}Y/#....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V}Y/#....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V}Y/#..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V}Y0#...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........=.z......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 29 03:25:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9895259160928456
Encrypted:	false
SSDEEP:
MD5:	7F8BB7359CE1621C3A21BA26821F8980
SHA1:	F7851B6D07A71C7969EF6D14A776B33F82779C1D
SHA-256:	C1B20A18C5C5958022E99BA9AC15282D68A890BC88343D53890924AA57ECC84E
SHA-512:	ABE2674537D19BAA439F9DE244F937F00D8CDC6A2144DE1DF2C234B1F2AD1ADB54F72FF8551CE4E66FE31594070A3DC51E8DA22A922ECCC35EF90425845DFF60
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....b...B..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I}Y'#....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V}Y/#....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V}Y/#....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V}Y/#..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V}Y0#...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........=.z......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 29 03:25:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.002287419902563
Encrypted:	false
SSDEEP:
MD5:	9D2E740C38B3B3BBB93C14DCC30F486C
SHA1:	A28D0B413E7E51A8FEBCA47C26BDC190017EB7DA
SHA-256:	80C30B12210BD06D35F020D038EC094672B1F2BFF31F66E3E6CE5D30A1469D9C
SHA-512:	378E64C27F036C752B46BEA59D55EDB5D19469302750359AF663FF2DA5AADD5B1EF24AA1C4C7798812D57A79105147960EFF60BCEFCBAFEADC6EDCD5CEABFC39
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....Q...B..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I}Y'#....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V}Y/#....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V}Y/#....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V}Y/#..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V}Y0#...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........=.z......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\06fc45f6-a708-4ad8-97f1-2289490e7112.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.4, 1 pages
Category:	dropped
Size (bytes):	144566
Entropy (8bit):	7.517452442120425
Encrypted:	false
SSDEEP:
MD5:	D25BFB174F06BA273860DD861E8051C6
SHA1:	41779D99BA0680D89765FB2F849B51580CD9D1BD
SHA-256:	6ADA27B7F50D7F57085857189ED093FBDD039BB16A7F128A0B69AC04AB47C2D4
SHA-512:	A47D1840279A197D301ED018FA709C7EE792C90F0A30A405E113004793E16B3E796F1B503F15C350BACFA0DC5565FCA03BA4368267B2849D26034D5D80957A84
Malicious:	false
Reputation:	unknown
Preview:	%PDF-1.4.%.....1 0 obj.<</Title (Invoice #49019005)./Creator (Mozilla/5.0 $X11; Linux x86_64$ AppleWebKit/537.36 $KHTML, like Gecko$ HeadlessChrome/131.0.0.0 Safari/537.36)./Producer (Skia/PDF m131)./CreationDate (D:20241129042603+00'00')./ModDate (D:20241129042603+00'00')>>.endobj.3 0 obj.<</ca 1./BM /Normal>>.endobj.12 0 obj.<</CA 1./ca 1./LC 0./LJ 0./LW 1./ML 4./SA true./BM /Normal>>.endobj.18 0 obj.<</N 3./Filter /FlateDecode./Length 293>> stream.x.}..J......(.....28.h..iRpi"..V..S..A.OHS..tspu+....c(....#....AR.x.......@.....?..F..[V[..G@`...dK..$...O.K..o...@...6..`.O.,f'..O. .a.sx.0A..6..vf...8....{c7..%op..Z.:u.....Q.......0Q.F.........(.S....DGACAa..j.g.rx....]..s...PxM.......c...vhO.<..v....-X}...b3~.......mDJH.T~...K..endstream.endobj.16 0 obj.<</Type /XObject./Subtype /Image./Width 252./Height 200./ColorSpace [/ICCBased 18 0 R]./SMask 17 0 R./BitsPerComponent 8./Filter /FlateDecode./Length 17110>> stream.x..}io#.z.M.!A.{......"..E...J.q.....\|....a.w...5.3.s

C:\Users\user\Downloads\Invoice.pdf (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.4, 1 pages
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	D25BFB174F06BA273860DD861E8051C6
SHA1:	41779D99BA0680D89765FB2F849B51580CD9D1BD
SHA-256:	6ADA27B7F50D7F57085857189ED093FBDD039BB16A7F128A0B69AC04AB47C2D4
SHA-512:	A47D1840279A197D301ED018FA709C7EE792C90F0A30A405E113004793E16B3E796F1B503F15C350BACFA0DC5565FCA03BA4368267B2849D26034D5D80957A84
Malicious:	true
Reputation:	unknown
Preview:	%PDF-1.4.%.....1 0 obj.<</Title (Invoice #49019005)./Creator (Mozilla/5.0 $X11; Linux x86_64$ AppleWebKit/537.36 $KHTML, like Gecko$ HeadlessChrome/131.0.0.0 Safari/537.36)./Producer (Skia/PDF m131)./CreationDate (D:20241129042603+00'00')./ModDate (D:20241129042603+00'00')>>.endobj.3 0 obj.<</ca 1./BM /Normal>>.endobj.12 0 obj.<</CA 1./ca 1./LC 0./LJ 0./LW 1./ML 4./SA true./BM /Normal>>.endobj.18 0 obj.<</N 3./Filter /FlateDecode./Length 293>> stream.x.}..J......(.....28.h..iRpi"..V..S..A.OHS..tspu+....c(....#....AR.x.......@.....?..F..[V[..G@`...dK..$...O.K..o...@...6..`.O.,f'..O. .a.sx.0A..6..vf...8....{c7..%op..Z.:u.....Q.......0Q.F.........(.S....DGACAa..j.g.rx....]..s...PxM.......c...vhO.<..v....-X}...b3~.......mDJH.T~...K..endstream.endobj.16 0 obj.<</Type /XObject./Subtype /Image./Width 252./Height 200./ColorSpace [/ICCBased 18 0 R]./SMask 17 0 R./BitsPerComponent 8./Filter /FlateDecode./Length 17110>> stream.x..}io#.z.M.!A.{......"..E...J.q.....\|....a.w...5.3.s

C:\Users\user\Downloads\Invoice.pdf.crdownload (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.4, 1 pages
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	D25BFB174F06BA273860DD861E8051C6
SHA1:	41779D99BA0680D89765FB2F849B51580CD9D1BD
SHA-256:	6ADA27B7F50D7F57085857189ED093FBDD039BB16A7F128A0B69AC04AB47C2D4
SHA-512:	A47D1840279A197D301ED018FA709C7EE792C90F0A30A405E113004793E16B3E796F1B503F15C350BACFA0DC5565FCA03BA4368267B2849D26034D5D80957A84
Malicious:	true
Reputation:	unknown
Preview:	%PDF-1.4.%.....1 0 obj.<</Title (Invoice #49019005)./Creator (Mozilla/5.0 $X11; Linux x86_64$ AppleWebKit/537.36 $KHTML, like Gecko$ HeadlessChrome/131.0.0.0 Safari/537.36)./Producer (Skia/PDF m131)./CreationDate (D:20241129042603+00'00')./ModDate (D:20241129042603+00'00')>>.endobj.3 0 obj.<</ca 1./BM /Normal>>.endobj.12 0 obj.<</CA 1./ca 1./LC 0./LJ 0./LW 1./ML 4./SA true./BM /Normal>>.endobj.18 0 obj.<</N 3./Filter /FlateDecode./Length 293>> stream.x.}..J......(.....28.h..iRpi"..V..S..A.OHS..tspu+....c(....#....AR.x.......@.....?..F..[V[..G@`...dK..$...O.K..o...@...6..`.O.,f'..O. .a.sx.0A..6..vf...8....{c7..%op..Z.:u.....Q.......0Q.F.........(.S....DGACAa..j.g.rx....]..s...PxM.......c...vhO.<..v....-X}...b3~.......mDJH.T~...K..endstream.endobj.16 0 obj.<</Type /XObject./Subtype /Image./Width 252./Height 200./ColorSpace [/ICCBased 18 0 R]./SMask 17 0 R./BitsPerComponent 8./Filter /FlateDecode./Length 17110>> stream.x..}io#.z.M.!A.{......"..E...J.q.....\|....a.w...5.3.s

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3477
Entropy (8bit):	7.62062671084744
Encrypted:	false
SSDEEP:
MD5:	F4FEB61D53BC0DE67557513853FA54F1
SHA1:	C1219A3DA6D6130C9CA4F3E52F96A91077B16041
SHA-256:	295A1F6F927FD11A3842A4C9F508B4152ECA150CB4C54D6CFB64736FAD659B80
SHA-512:	20CE839D90305E05F2EC9EC322AE660F8D43DDD2705F67269B2231F0150575A168B7B33B22C813609BCB7E111F0B97ECC475BCCB53DB0283ACC4A9FB2774E833
Malicious:	false
Reputation:	unknown
URL:	https://manage.wix.com/favicon.ico
Preview:	.PNG........IHDR.............R.l.....sRGB........OIDATx^...8..C.@...`....h.x..5.R.K................s..B&...8...4....._>..v.S..n......2.....{...'.....t.m..p.H{..H.........t.m..p.H{..H.........t.m..p.H{..H.........t.m..p.H{..H.........t.m..p.H{..H.........t.m..p.H{..H.........t.m..p.H{..H.........t.m..p.H{..H.........t.m..p.H{..H.........t.m..p.H{..H.........t.m..p.H{..H.........t.m..p.H{..H.........t.m..p.H{..H.........t.m..p.H{..H.........t.m..p.H{..H.........t.m..p.H{..H.........t.m.:..?........>}.ts.......[....?../_.4.?~...m..k.\...>..T...y.\|.....{.....~..}.....'O..{.........wstt....."...{..../&.Q.._....E..w..iNNNJ\2u.u..A0~.!._.z. )K../_6..?.L.\.....s..#.7n.....}/^..'.TC...6....\7o.\.k<z.:6.?...........S.x.\w..........t.N.7..I.@_.zu.>@75..\|..`.......J...f../....cO.:....T.=_......K.q@2 )..o.Y". ...].7d..t..ec....8..B.y.\|.yKJB.........V.>mw...W;s.LR.@&..J20.h...qn.}..^.N......(..X...]D...._.6..J..W.>....v..!...c*(.q....r..o

Chrome Cache Entry: 181

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (43869)
Category:	downloaded
Size (bytes):	1612741
Entropy (8bit):	5.424240422200886
Encrypted:	false
SSDEEP:
MD5:	CC4FA69A22962A792C226AFBF4612FDF
SHA1:	DCB3813369F0977537209D58B44018873B6E9AC9
SHA-256:	C650E147BAC515C38A5CC7CE5D98312A45CF5579FCF53F2E5AED54F2E35CE14B
SHA-512:	B5E440B9408B5FBA9C3C69D1C452115623AAE82561ADA8692105D0A4A3B525F2ECFA9B744564AC78A3551C8469FBE474E8382E47E6195A97B6D996B334B83319
Malicious:	false
Reputation:	unknown
URL:	https://static.parastorage.com/services/price-quotes-server/1.1331.662/commons.bundle.min.js
Preview:	(self.webpackJsonp_price_quotes_server=self.webpackJsonp_price_quotes_server\|\|[]).push([[264],{97008:(e,a,t)=>{"use strict";t.d(a,{u:()=>V});var s,l=t(3968),o=t(87856),i=t(53884),n=t(22300),r=t(9936),c=t(5240),d=t(63904);!function(e){e.PENDING="PENDING",e.RESOLVED="RESOLVED",e.REJECTED="REJECTED"}(s\|\|(s={}));var u=function(){function e(e){var a=this;this._state=s.PENDING,this._handlers=[],this._resolve=function(e){a._setResult(s.RESOLVED,e)},this._reject=function(e){a._setResult(s.REJECTED,e)},this._setResult=function(e,t){a._state===s.PENDING&&((0,c.Oe)(t)?t.then(a._resolve,a._reject):(a._state=e,a._value=t,a._executeHandlers()))},this._attachHandler=function(e){a._handlers=a._handlers.concat(e),a._executeHandlers()},this._executeHandlers=function(){if(a._state!==s.PENDING){var e=a._handlers.slice();a._handlers=[],e.forEach((function(e){e.done\|\|(a._state===s.RESOLVED&&e.onfulfilled&&e.onfulfilled(a._value),a._state===s.REJECTED&&e.onrejected&&e.onrejected(a._value),e.done=!0)}))}};try

Chrome Cache Entry: 182

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13591)
Category:	downloaded
Size (bytes):	13643
Entropy (8bit):	5.530779023236662
Encrypted:	false
SSDEEP:
MD5:	EBED1C9BD2B1D334238978989D119612
SHA1:	4A2C2455DCDC0FD0A0E5DFF12066F902E04C7E51
SHA-256:	1C7D0CE85E01EC833522F8195DCFA350C4E1DD1B67D79FC25B32CE9ECD6CAEF9
SHA-512:	43F9972B9E41844F3E854802EFF6B70D95C1C46414A177E58F7B539BAADCE594D40FB45D9F9949AA65207AFA0FB42BFCF18494946BE43635672533166B733413
Malicious:	false
Reputation:	unknown
URL:	https://static.parastorage.com/services/price-quotes-server/1.1331.662/invoice-view.bundle.min.js
Preview:	(()=>{var e,t,n,o,r,i={62572:(e,t,n)=>{"use strict";var o=n(6376),r=n(39944),i=n(81792),a=n(36512),s=n(58144),c=n(14296),l=n.n(c),d=n(55424),u=n.n(d),p=n(64764),m=(n(35850),n(97772),n(93360),n(7872),n(43004),n(94840),n(65752));const v="_1TAv0",w="Sr7Yhm",_="L685tl",f="invoice-view",h="P7v1x_",E="H0h62A",y="j1aiI9",b="I0Tzc2";var I=n(31036),g=n.n(I),O=n(12832),P=n(34952),x=n(94738),T=n(54468),N=n(32848),k=n.n(N),S=n(19964),L=n(46672),C=n(30048),D=n(46956),j=n.n(D);const M=new(n(17208).K),A=()=>{const e=document.cookie.indexOf("XSRF-TOKEN"),t=document.cookie.indexOf("=",e),n=document.cookie.includes(";",t)?document.cookie.indexOf(";",t):void 0;return document.cookie.substring(t+1,n)},F=e=>e.title?o.createElement(P.c,k()({priority:"secondary"},e,{prefixIcon:o.createElement(j(),null)}),e.title):o.createElement(S.c,k()({priority:"secondary"},e),o.createElement(j(),null)),R=e=>{let{token:t,text:n,pdfUrl:r,onDownloadPDF:i,onDownloadFail:a,newMobileViewEnabled:s=!1}=e;const[c,l]=(0,o.useState)

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 252 x 200, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	23125
Entropy (8bit):	7.947179248326407
Encrypted:	false
SSDEEP:
MD5:	8B10C6358D74781835B0642C64E68700
SHA1:	50C40E0EDA37449BD82D7A061CADF8EDB11F1CC5
SHA-256:	EFC765163596FD1E7A644005405F2CFB5562ED3319DAAC4307E7591451E2F9DC
SHA-512:	8D9CFEA0BB5F97F5C25EF240485137E0763FD6454D19BC4BF0DF363E2E945AD12D128703A21E736025DF997B647063C68DF85619F2E46AF6B417D1F04BB69A2A
Malicious:	false
Reputation:	unknown
URL:	"https://static.wixstatic.com/media/deade9_c0186c6befa84e95934f452443ce9d40~mv2.png/v1/fit/w_622,h_200,al_c,q_80,usm_0.66_1.00_0.01/deade9_c0186c6befa84e95934f452443ce9d40~mv2.png"
Preview:	.PNG........IHDR..............@......eXIfII...........................V...........^...(.......................i.......f.......8c......8c................0210....................0100........................................^.......pHYs..........{Rk.. .IDATx..}..\Wu...u.M..;..7.+m.l.....I.B......?..ve.d.+.........z.v...$$K..`c.tSb..m.s.9..].-........y..{.....z.S.....2A........h....O...-J..8..tw.w........E.d....zocc=..........?..].\|.ip...;......,t..-FR........U.vC{..wF....^...;..=....{..........O..#..2K.s...4.:..^74../.k....=.-....q.h..;k=......F..p..p..>.............(.8.?.@.G`.G.2..t..}.qy....w.@S..........8....A..8.;...Dz.\|.G..x.!...r...Sh.V.....8\|.Z.....c.........<._.N"..........B.g......G.s#.........G..u....$...x.E{.<p...F.^.........C;K}'..F'.?1..{.......=r.....=...u.$....)...S7.x..P....l....d.8....8]o.......".x-.#...C.#....)..............].xo0...-..o.....S..Y.. E.....>....q.z....?.v.......z.l...Zy*....v....G.^sw.w..]..lq..P]G.o...T.D.....

Chrome Cache Entry: 184

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7019)
Category:	downloaded
Size (bytes):	7062
Entropy (8bit):	5.2260928005257075
Encrypted:	false
SSDEEP:
MD5:	E61D1AE3BC37D487E556CDC4A95A657F
SHA1:	434870A5D077C3F56A6B22AEF76A82855AAEC212
SHA-256:	562F0470DDC66283957C23BB1F9AFFDC88DE8AE5DE28FEA75A45AFD86C87B1E3
SHA-512:	E62987A9014F045462DFC37C23B64FD395083AA2AD9D381CEF7E4A0E1D0C885E9033EF9E17FB1CBC6723B2233FFE4C12BD97EA27A3E13E1D91269422D47FDADD
Malicious:	false
Reputation:	unknown
URL:	https://static.parastorage.com/services/cookie-consent-policy-client/1.866.0/app.bundle.min.js
Preview:	!function(){var t={231:function(t,e,n){var o=n(40);t.exports=function(t,e,n){return(e=o(e))in t?Object.defineProperty(t,e,{value:n,enumerable:!0,configurable:!0,writable:!0}):t[e]=n,t},t.exports.__esModule=!0,t.exports.default=t.exports},27:function(t,e,n){var o=n(501).default;t.exports=function(t,e){if("object"!==o(t)\|\|null===t)return t;var n=t[Symbol.toPrimitive];if(void 0!==n){var i=n.call(t,e\|\|"default");if("object"!==o(i))return i;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===e?String:Number)(t)},t.exports.__esModule=!0,t.exports.default=t.exports},40:function(t,e,n){var o=n(501).default,i=n(27);t.exports=function(t){var e=i(t,"string");return"symbol"===o(e)?e:String(e)},t.exports.__esModule=!0,t.exports.default=t.exports},501:function(t){function e(n){return t.exports=e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof Symbol&&t.constructor===Symbol&&t!==Symbol.

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (593)
Category:	downloaded
Size (bytes):	107874
Entropy (8bit):	5.36988759294908
Encrypted:	false
SSDEEP:
MD5:	84EC5322BA3B6DFF3FCA9A71832E3F1D
SHA1:	ED5EE8823B6C31785AD91B74738C37C210328FB2
SHA-256:	07FEE28413513B371DA11925D4D94ACC6BE36694299784AD51BA8AF2C519C5B1
SHA-512:	53A7857448BA478C3B5290F4EA045A6EC52B41241FCF2B195211CDEC194125213AAF86DB3B1FEE7BDAE672BF87F8E2479A42FAF7FC8F8A36DCC6A2F150D51187
Malicious:	false
Reputation:	unknown
URL:	https://static.parastorage.com/unpkg/react-dom@16.8.3/umd/react-dom.production.min.js
Preview:	/** @license React v16.8.3. * react-dom.production.min.js. . Copyright (c) Facebook, Inc. and its affiliates.. . This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. /./. Modernizr 3.0.0pre (Custom Build) \| MIT.*/.'use strict';(function(da,pb){"object"===typeof exports&&"undefined"!==typeof module?module.exports=pb(require("react")):"function"===typeof define&&define.amd?define(["react"],pb):da.ReactDOM=pb(da.React)})(this,function(da){function pb(a,b,c,d,e,f,g,h){if(!a){a=void 0;if(void 0===b)a=Error("Minified exception occurred; use the non-minified dev environment for the full error message and additional helpful warnings.");else{var l=[c,d,e,f,g,h],k=0;a=Error(b.replace(/%s/g,function(){return l[k++]}));.a.name="Invariant Violation"}a.framesToPop=1;throw a;}}function n(a){for(var b=arguments.length-1,c="https://reactjs.org/docs/error-decoder.html?invariant="+a,d=0;d<b;d++)c+="&args[]="+encodeURIComponent

Chrome Cache Entry: 186

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32015)
Category:	dropped
Size (bytes):	35465
Entropy (8bit):	5.467896381119657
Encrypted:	false
SSDEEP:
MD5:	F1BA4F93C0582BA936494FA7A5D84908
SHA1:	181BDBF41E5309D898CC8638D4563E7CB4EEF806
SHA-256:	69070BFE524596A5E8681F08529AA9DB58E953E4808D49BD585471266AE840A7
SHA-512:	CC50E600A6BC4D1F5356F83863A6EDED103309480E6D9CEDB798924FAB5C2D253A92FE179EA7D91B44DFE44F16BFA66179CB121CCC97DB3B1BCF9A6D9B0DA42A
Malicious:	false
Reputation:	unknown
Preview:	/! Raven.js 3.24.2 (26fcb59) \| github.com/getsentry/raven-js /.!function(a){if("object"==typeof exports&&"undefined"!=typeof module)module.exports=a();else if("function"==typeof define&&define.amd)define([],a);else{var b;b="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:this,b.Raven=a()}}(function(){return function a(b,c,d){function e(g,h){if(!c[g]){if(!b[g]){var i="function"==typeof require&&require;if(!h&&i)return i(g,!0);if(f)return f(g,!0);var j=new Error("Cannot find module '"+g+"'");throw j.code="MODULE_NOT_FOUND",j}var k=c[g]={exports:{}};b[g][0].call(k.exports,function(a){var c=b[g][1][a];return e(c?c:a)},k,k.exports,a,b,c,d)}return c[g].exports}for(var f="function"==typeof require&&require,g=0;g<d.length;g++)e(d[g]);return e}({1:[function(a,b,c){function d(a){this.name="RavenConfigError",this.message=a}d.prototype=new Error,d.prototype.constructor=d,b.exports=d},{}],2:[function(a,b,c){var d=a(5),e=function(a,b,c){var e=a[b],f

Chrome Cache Entry: 187

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65535), with no line terminators
Category:	downloaded
Size (bytes):	871465
Entropy (8bit):	5.219921178295756
Encrypted:	false
SSDEEP:
MD5:	98F0C73B765546FFD2E3F6D1397BEA7C
SHA1:	F11F29385170B16C398B949CDE77C4F8C1781F8E
SHA-256:	DD0CE16025AB434CB3139714DA4E18BE42084E783C890F1E60AE6C4CDDDC9718
SHA-512:	E079603856DB2425AD08FB4076FE864DBAEC31BC386D3534774F2BD1306782823C9BB09C2F692FD8DE4F9E62231A3397E95C057B75DE87D09C552659EBA2BAAA
Malicious:	false
Reputation:	unknown
URL:	https://static.parastorage.com/services/price-quotes-server/1.1331.662/commons.min.css
Preview:	@media print{.spwrTH{display:none}.v0r2LX{padding-bottom:0!important}.Kzwmc1{width:100%!important}body{overflow:visible!important}.Z3bSRL{width:auto!important}.c7UtsM{display:none!important}}.Z3bSRL{width:867px}.tvYFRs{margin-bottom:20px;width:771px}.yHZvmn{margin-top:-12px;transform:translateY(12px) translateX(45px)}.Kzwmc1{background-color:#fff;border-radius:8px;width:100%}.iLJsa_{padding:42px;padding-top:57px}.iLJsa_ .SXD2wr{margin-bottom:6px}.v0r2LX{margin-top:16px;padding-bottom:26px;padding-left:48px}.v0r2LX .estvJA{display:inline-block;margin-left:5px}.v0r2LX .estvJA img{margin-bottom:-3px}.SdtFQJ{display:none}@media screen and (min-width:0px) and (max-width:867px){.lVj9X0{display:none;height:0}.SdtFQJ{display:block}.Kzwmc1{border-radius:0;width:100%}.iLJsa_{padding:20px}.iLJsa_ .SXD2wr{margin-bottom:12px}.iLJsa_ .SXD2wr span{color:#474747!important;font-size:16px!important}.iLJsa_ .hp7Lhz:last-child{justify-content:flex-start}.iLJsa_ .h951Zk{direction:rtl;margin-bottom:21px}.hp

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1875), with no line terminators
Category:	downloaded
Size (bytes):	1895
Entropy (8bit):	5.2722112501758245
Encrypted:	false
SSDEEP:
MD5:	903D7478E784EC5CBEAAD14CE34A9490
SHA1:	FBAB638B07104166A2087AB90326F57A6B722A2E
SHA-256:	2D8AC4781F0E335C9941BC00A5DB6C09F49D2C3E6AB9E3C94AA480B6845FD43C
SHA-512:	B6EB5B9F330E2F3FB115163D82E442F8A1956B92748D92DA5C1C68565C223C74CA7BFFCD2AC91FF92C8C8DCD9DF83AE85D904BF0036DC7ADAEB1F692DFE4A0BA
Malicious:	false
Reputation:	unknown
URL:	https://static.parastorage.com/unpkg/@wix/wix-fonts@1.9.3/madefor.min.css
Preview:	:root{--wix-font-stack:Madefor,"Helvetica Neue",Helvetica,Arial,"....","meiryo","...... pro w3","hiragino kaku gothic pro",sans-serif;--wix-font-weight-regular:400;--wix-font-weight-bold:700;--wix-font-weight-xbold:800}@supports (font-variation-settings:normal){@font-face{font-family:Madefor;font-display:swap;font-weight:400 800;font-style:normal;src:url(media/WixMadeforTextVF_W_Wght.9b7def89.woff2) format("woff2-variations")}@font-face{font-family:Madefor;font-display:swap;font-weight:400 800;font-style:italic;src:url(media/WixMadeforTextItalicVF_W_Wght.d6461449.woff2) format("woff2-variations")}}@supports not (font-variation-settings:normal){@font-face{font-family:Madefor;font-display:swap;font-weight:400;src:url(media/WixMadeforText_W_Rg.c2836926.woff2) format("woff2"),url(media/WixMadeforText_W_Rg.8acdda57.woff) format("woff")}@font-face{font-family:Madefor;font-display:swap;font-weight:400;font-style:italic;src:url(media/WixMadeforText_W_Rg_It.328cf320.woff2) f

Chrome Cache Entry: 193

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from Unix, original size modulo 2^32 556
Category:	downloaded
Size (bytes):	311
Entropy (8bit):	7.439070498406088
Encrypted:	false
SSDEEP:
MD5:	2E469B1055AC2EF9E2B5134882830C88
SHA1:	22CDF2E1B6FA1500952EFC491FBD7363D7501175
SHA-256:	89AF2CB914702ED5C82089FBED0D74AF01865795605B6935752E0BB251FB7C50
SHA-512:	631A61F72A391253DE8A31320E1A1A6F457C3291CF3831C786FEB450B5A12CE8C95DD1E425B47FA8CA8E865627296B42EE127A6A666926CC5C7F9FB3B4641BD0
Malicious:	false
Reputation:	unknown
URL:	"https://static.parastorage.com/polyfill/v2/polyfill.min.js?features=default,es6,es7,es2017&flags=gated&unknown=polyfill&rum=0"
Preview:	............1O.0.....K.."W...u@bD..1!.:..9..qREm.;v..."&?..ww...f.&.I.5.h[U ..../B.Q."...2J.B8E...Z.......Jx{y.J.]..,.d......Q.dc..d5j.Ac.(..m..%..,y..t.=.v........G....T(....%G...}.....U..B7.g.6X.Vp...4..?._X8>DY[...k6.&N.C/.g./...4.......*7.Sz.:.,.~n.a...$...>$.....p.@.....\.@..s.?..+1j.,...

Chrome Cache Entry: 195

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (331)
Category:	downloaded
Size (bytes):	13849
Entropy (8bit):	5.278716113160299
Encrypted:	false
SSDEEP:
MD5:	338855569759CA44A0734EC4435BCBD0
SHA1:	828F9CA385E37E9F362B89F16D72115D7D658EAB
SHA-256:	9CD04D1A84368FA539B48CC09D3721091127B9EB2858FF5E4863D6C127CCEDAE
SHA-512:	689083EB69F878FE098038B998E41AA89C10F51CF0E8233594DB5FD8D166B12CF39C511E7AA82A42DC12E917A456E58D87609D862C11A0CB5D3804ADD2D7B391
Malicious:	false
Reputation:	unknown
URL:	https://static.parastorage.com/services/third-party/fonts/Helvetica/fontFace.css
Preview:	/* fonts helvetica /../ Original old fonts */..@font-face {. font-family: "Helvetica Neue";. src: url("Fonts/b7693a83-b861-4aa6-85e0-9ecf676bc4d6.eot?#iefix") format("embedded-opentype"),. url("Fonts/bcf54343-d033-41ee-bbd7-2b77df3fe7ba.woff") format("woff"),. url("Fonts/b0ffdcf0-26da-47fd-8485-20e4a40d4b7d.ttf") format("truetype"),. url("Fonts/da09f1f1-062a-45af-86e1-2bbdb3dd94f9.svg#da09f1f1-062a-45af-86e1-2bbdb3dd94f9") format("svg");.}..@font-face {. font-family: "Helvetica Neue Thin";. font-weight: 200;. src: url("Fonts/56be84de-9d60-4089-8df0-0ea6ec786b84.eot?#iefix") format("embedded-opentype"),. url("Fonts/50d35bbc-dfd4-48f1-af16-cf058f69421d.woff") format("woff"),. url("Fonts/278bef59-6be1-4800-b5ac-1f769ab47430.ttf") format("truetype"),. url("Fonts/2e309b1b-08b8-477f-bc9e-7067cf0af0b3.svg#2e309b1b-08b8-477f-bc9e-7067cf0af0b3") format("svg");.}..@font-face {. font-family: "Helvetica Neue Medium";. font-weight: bold;. src: url("Fonts/

Chrome Cache Entry: 197

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (543)
Category:	dropped
Size (bytes):	12682
Entropy (8bit):	5.37561256927412
Encrypted:	false
SSDEEP:
MD5:	698114F22DB5A3585658C1C2489BE390
SHA1:	CAEAA36E7714DBC0B0701D4F3ED7093199E486FD
SHA-256:	6F527DDE8B4EDC9D347102FCB41E17D26CF00AFF727693EA9140F7FC2A298842
SHA-512:	A9EE48A388E65FF25B1CA5621649D131FBC03A127CCF6FE8B623D51F21314F02FAA80D85B4C3363900685A6C62B034CC0D35F27C4646E95E19E715D6E17B0DC4
Malicious:	false
Reputation:	unknown
Preview:	/** @license React v16.8.3. * react.production.min.js. . Copyright (c) Facebook, Inc. and its affiliates.. . This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */.'use strict';(function(N,q){"object"===typeof exports&&"undefined"!==typeof module?module.exports=q():"function"===typeof define&&define.amd?define(q):N.React=q()})(this,function(){function N(a,b,d,g,p,c,e,h){if(!a){a=void 0;if(void 0===b)a=Error("Minified exception occurred; use the non-minified dev environment for the full error message and additional helpful warnings.");else{var n=[d,g,p,c,e,h],f=0;a=Error(b.replace(/%s/g,function(){return n[f++]}));a.name="Invariant Violation"}a.framesToPop=1;.throw a;}}function q(a){for(var b=arguments.length-1,d="https://reactjs.org/docs/error-decoder.html?invariant="+a,g=0;g<b;g++)d+="&args[]="+encodeURIComponent(arguments[g+1]);N(!1,"Minified React error #"+a+"; visit %s for the full message or use the non-

Chrome Cache Entry: 199

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1151), with no line terminators
Category:	downloaded
Size (bytes):	1151
Entropy (8bit):	5.342553694033612
Encrypted:	false
SSDEEP:
MD5:	421078D81DB2BF3F29D282775FA629AA
SHA1:	4C807FB1EBB20EC4EA270E65D0EEAD2B47B380F0
SHA-256:	6FCF7A944FA241AB164B38DF88CD3A901DB847F1C37D57ECD5A9AEB8E1FF8EF0
SHA-512:	C1A2B6916616CE92199A0223585B9BA7FC58ED00EBE12830085D2881A5024F84FEA22E6839B4347A335EE8D936D557DA8E59120714168628B3E9BF73A63DAE97
Malicious:	false
Reputation:	unknown
URL:	https://static.parastorage.com/services/price-quotes-server/1.1331.662/invoice-view.min.css
Preview:	._1TAv0{background-color:#f0f4f7;margin:0;padding-bottom:60px}.Sr7Yhm{align-items:center;background-color:rgba(240,244,247,.94);display:flex;justify-content:center;left:0;position:fixed;top:0;width:100%;z-index:5}.L685tl{margin-top:72px}@media screen and (min-width:867px){._1TAv0{align-items:center;display:flex;flex-direction:column;justify-content:center;padding:30px}.Sr7Yhm{padding-top:30px}.L685tl{margin-top:66px}}@media print{#wR3syq{display:none}._1TAv0{background-color:#fff!important;padding-bottom:0!important}[id^=external-chat-widget]{display:none}.L685tl{margin-top:0!important}.F3bZOp{display:none!important}}.P7v1x_{display:flex;justify-content:space-between;margin-bottom:30px;width:867px}@media print{.P7v1x_{display:none}}.H0h62A{align-items:center;display:flex}.H0h62A button{margin-right:18px}.j1aiI9{align-items:center;display:flex}.j1aiI9 button{margin-left:18px}@media screen and (min-width:0px) and (max-device-width:867px){.P7v1x_{display:none}.P7v1x_.I0Tzc2{display:flex;j

Chrome Cache Entry: 200

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 25092, version 1.6619
Category:	downloaded
Size (bytes):	25092
Entropy (8bit):	7.991369778175634
Encrypted:	true
SSDEEP:
MD5:	9B7DEF89FA82E98FB48B6164EB40A540
SHA1:	A5AEBF2362E05DC91925018FA369499431CEA93D
SHA-256:	D6E943F160827DFF7AC2D43F54F3729D5C8B1C8B163ABAFFBBCCD347EF9169C4
SHA-512:	1E0F226F52266AD05D01C6D2C8B1DAFCE020B2EF03B0F2DD4FD9BEE2D842D0E500B4C4DF022CF1102812C6884EA8C8DEAE63EACF8D219D8A5ED82C142B0D7A08
Malicious:	false
Reputation:	unknown
URL:	https://static.parastorage.com/unpkg/@wix/wix-fonts@1.9.3/media/WixMadeforTextVF_W_Wght.9b7def89.woff2
Preview:	wOF2......b...........a...............................X..h?HVAR.f.`?STATd'...X/<.....\..%0.".6.$..h..6.. .... [..q.9..h.t'...Z...[c.C#ki)M.1..q....4.....d#..C=.~..tV....!.."C..r.d.......v..\...8.:r.....#f#..F9bX.n.8<T].....H.#q%9....;vC..?..2....Z.vM....8Nv5.CK.1...;o..ITZt......Y... ...d.BB.\|.s.oCi.;kb.g..G\|.3EE.=.MU?.uF....f".^\..3...\....sh.....^.6.c$+.%.,GM.m...........J.rF.)9c...%..'%....^......0.v.).....KL.J.w.......?.!...a.J{V.%....D=.U8...v......@8.........i..>.>=.BK...-.-.Hq..u..6.....Y....p..qg..1..)..4.y~n....c....#rcnd.Q..%.L..lD.......+1.....Og.aHb.\|...L.2/M....T.G.I..kY.:-I..c.@. .......b....?.R..4.hx..e.t.1A....".;B%..B..U.v...v?...Y....t..U;U{...=o.Q....H....L.<.5.v(In.5i.IJ/.,2...2..^.......;......q....>.....c..3.-.U....D.Od."t....4..B.>mq............8L.FKv.G.O.>..D..F...7....)......S.*..?.w...U(Y@.....z..>}O...=@BBBB......sKa[.I..I....M5............^\:.ROZt..5...?......(i.(,qiIJ.2....@i@.o.p....>H...IG..9S.!U!6e..KW...j.M....^..

Static File Info

⊘No static file info

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://www.wixsite.com/_api/invoice/2d5e7023-6014-4f5e-ab31-c1e25d999b96:9b27124a-a130-45dc-b81f-e5675b538826/view?token=56c18155-b636-4505-b95c-630f3d19901a

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241129042632Z-180.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6860

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6860

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Windows Analysis Report
https://www.wixsite.com/_api/invoice/2d5e7023-6014-4f5e-ab31-c1e25d999b96:9b27124a-a130-45dc-b81f-e5675b538826/view?token=56c18155-b636-4505-b95c-630f3d19901a