jigsaw | 6120ecd92b2bb3b99e7dfff5e840e80ae2500fbfb8991913f7ebe1c79375d273

Analysis

max time kernel
797s
max time network
803s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff3.exe
Size

7.9MB
MD5

b1f1f050af21507b5bd62b480f4b9c34
SHA1

5504b18fff8a83d56b9e9e6632c9fd9c63504342
SHA256

6120ecd92b2bb3b99e7dfff5e840e80ae2500fbfb8991913f7ebe1c79375d273
SHA512

4947d0ee0ed239757091bed5e16a5df2b86115d9c3762467080a3dce6de47cf817389ab769c898a731beb9f7a8a5956f9cc84dadf4ecae83137a2d20b2a08b8a
SSDEEP

98304:qqW2snOP6yvIEr91XOi9oxuga+wCnmOQ30uABd/p8aOTRCSOB/hMoL7t0HvJzk7L:qqnkff+HoxJirP4

Score

10^/10

jigsaw persistence ransomware spyware stealer

Malware Config

Signatures

Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
ransomware jigsaw
Renames multiple (3710) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 1 IoCs

pid	Process
5060	drpbx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe"	jigsaw.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	drpbx.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	drpbx.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
85	raw.githubusercontent.com
87	raw.githubusercontent.com
98	raw.githubusercontent.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-150_contrast-white.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png.fun	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-down.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\ui-strings.js.fun	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr\ui-strings.js	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\ui-strings.js.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-96_altform-lightunplated_devicefamily-colorfulunplated.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupLargeTile.scale-400.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner.gif	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\LockScreenLogo.scale-400.png	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryResume.dotx	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-125_contrast-black.png	drpbx.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_filetype_xd.svg.fun	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-gb\ui-strings.js	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sv-se\ui-strings.js	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\ui-strings.js.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteLargeTile.scale-100.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageStoreLogo.scale-100_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-100_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\ui-strings.js	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-64_contrast-white.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_checkbox_unselected_18.svg.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_92.0.902.67_neutral__8wekyb3d8bbwe\AppxManifest.xml	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileMediumSquare.scale-200.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\es-es\ui-strings.js	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-sl\ui-strings.js.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WorldClockMedTile.contrast-white_scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-48_altform-lightunplated.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.contrast-white_scale-200.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-hover.svg	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-80_contrast-black.png	drpbx.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionWideTile.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\ui-strings.js	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt_get.svg	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-80.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SplashScreen.scale-100_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailMediumTile.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSplashLogo.scale-100.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCache.scale-125.png	drpbx.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Dark.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-16_altform-unplated.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sortedby_up_hover_18.svg	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-100.HCBlack.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W3.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\ui-strings.js.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\WideTile.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ShareProvider_CopyLink24x24.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jsaddins\locallaunch\locallaunch.js	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\new_icons_retina.png.fun	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\ui-strings.js.fun	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\tr-tr\ui-strings.js.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptySearch.scale-150.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-60_altform-unplated_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_altform-unplated_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml	drpbx.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	drpbx.exe
File opened for modification	C:\Windows\assembly	drpbx.exe
File created	C:\Windows\assembly\Desktop.ini	drpbx.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-983155329-280873152-1838004294-1000\{8E94BAC7-B8B5-4846-BDCA-B68306EF1D3E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
348	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
1076	msedge.exe
1076	msedge.exe
3680	identity_helper.exe
3680	identity_helper.exe
2944	msedge.exe
2944	msedge.exe
4476	msedge.exe
4476	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3244	7zFM.exe
3132	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeRestorePrivilege	4036	7zG.exe
Token: 35	4036	7zG.exe
Token: SeSecurityPrivilege	4036	7zG.exe
Token: SeRestorePrivilege	3244	7zFM.exe
Token: 35	3244	7zFM.exe
Token: SeSecurityPrivilege	3244	7zFM.exe
Token: SeSecurityPrivilege	3244	7zFM.exe
Token: SeSecurityPrivilege	3244	7zFM.exe
Token: SeSecurityPrivilege	3244	7zFM.exe
Token: 33	2068	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2068	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
4036	7zG.exe
3244	7zFM.exe
3244	7zFM.exe
3244	7zFM.exe
3244	7zFM.exe
3244	7zFM.exe
3244	7zFM.exe
3244	7zFM.exe
348	NOTEPAD.EXE
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2868	OpenWith.exe
2868	OpenWith.exe
2868	OpenWith.exe
2868	OpenWith.exe
2868	OpenWith.exe
2868	OpenWith.exe
2868	OpenWith.exe
2868	OpenWith.exe
2868	OpenWith.exe
2868	OpenWith.exe
2868	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
3132	OpenWith.exe
2940	OpenWith.exe
2940	OpenWith.exe
2940	OpenWith.exe
2940	OpenWith.exe
2940	OpenWith.exe
2940	OpenWith.exe
2940	OpenWith.exe
2940	OpenWith.exe
2940	OpenWith.exe
2940	OpenWith.exe
2940	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1188	1076	msedge.exe	90
PID 1076 wrote to memory of 1188	1076	msedge.exe	90
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 316	1076	msedge.exe	91
PID 1076 wrote to memory of 4980	1076	msedge.exe	92
PID 1076 wrote to memory of 4980	1076	msedge.exe	92
PID 1076 wrote to memory of 4676	1076	msedge.exe	93
PID 1076 wrote to memory of 4676	1076	msedge.exe	93
PID 1076 wrote to memory of 4676	1076	msedge.exe	93
PID 1076 wrote to memory of 4676	1076	msedge.exe	93
PID 1076 wrote to memory of 4676	1076	msedge.exe	93
PID 1076 wrote to memory of 4676	1076	msedge.exe	93
PID 1076 wrote to memory of 4676	1076	msedge.exe	93
PID 1076 wrote to memory of 4676	1076	msedge.exe	93
PID 1076 wrote to memory of 4676	1076	msedge.exe	93
PID 1076 wrote to memory of 4676	1076	msedge.exe	93
PID 1076 wrote to memory of 4676	1076	msedge.exe	93
PID 1076 wrote to memory of 4676	1076	msedge.exe	93
PID 1076 wrote to memory of 4676	1076	msedge.exe	93
PID 1076 wrote to memory of 4676	1076	msedge.exe	93
PID 1076 wrote to memory of 4676	1076	msedge.exe	93
PID 1076 wrote to memory of 4676	1076	msedge.exe	93
PID 1076 wrote to memory of 4676	1076	msedge.exe	93
PID 1076 wrote to memory of 4676	1076	msedge.exe	93
PID 1076 wrote to memory of 4676	1076	msedge.exe	93
PID 1076 wrote to memory of 4676	1076	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\ff3.exe
"C:\Users\Admin\AppData\Local\Temp\ff3.exe"
1⤵
PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb19346f8,0x7ffdb1934708,0x7ffdb1934718
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3436 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1308 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2236 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3949525100410053826,14581291004011088665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3008

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3504

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c 0x4ec
1⤵
PID:1600

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Ransomware.Jigsaw\" -ad -an -ai#7zMap24044:96:7zEvent15664
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4036

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Ransomware.Jigsaw.zip"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3244

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2868

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3132
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Jigsaw.zip\jigsaw
  2⤵
  - Opens file in notepad (likely ransom note)
  - Suspicious use of FindShellTrayWindow
  PID:348

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2940

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4872

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4316

C:\Users\Admin\Documents\jigsaw.exe
"C:\Users\Admin\Documents\jigsaw.exe"
1⤵
- Adds Run key to start application
PID:4736
- C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
  "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\Documents\jigsaw.exe
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Program Files directory
  - Drops file in Windows directory
  PID:5060

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
PID:4620

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c 0x4ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.fun

Filesize
720B

MD5
75a585c1b60bd6c75d496d3b042738d5

SHA1
02c310d7bf79b32a43acd367d031b6a88c7e95ed

SHA256
5ebbfc6df60e21044486a5df3cb47ccdcd7a4d5f197804555715ffd9bf6c5834

SHA512
663a302e651b9167f4c4e6ae30028307b4d8da0dda3a0e5fd414104951d50419862fc9396c5b39fe5c4b696efd3efbf0b575688983b1d341f3ef38becf500505

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png.fun

Filesize
7KB

MD5
72269cd78515bde3812a44fa4c1c028c

SHA1
87cada599a01acf0a43692f07a58f62f5d90d22c

SHA256
7c78b3da50c1135a9e1ecace9aea4ea7ac8622d2a87b952fc917c81010c953f7

SHA512
3834b7a8866e8656bbdbf711fc400956e9b7a14e192758f26ccf31d8f6ab8e34f7b1983c1845dc84e45ff70555e423d54a475f6a668511d3bcbdd1d460eeb4b0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_ie8.gif.fun

Filesize
7KB

MD5
eda4add7a17cc3d53920dd85d5987a5f

SHA1
863dcc28a16e16f66f607790807299b4578e6319

SHA256
97f6348eaa48800e603d11fa22c62e10682ad919e7af2b2e59d6bd53937618f2

SHA512
d59fa9648dc7cb76a5163014f91b6d65d33aaa86fc9d9c73bf147943a3254b4c4f77f06b2e95bb8f94246a982ea466eb33dac9573dd62f40953fd23de1c1b498

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_retina.png.fun

Filesize
15KB

MD5
7dbb12df8a1a7faae12a7df93b48a7aa

SHA1
07800ce598bee0825598ad6f5513e2ba60d56645

SHA256
aecde4eb94a19095495d76ef3189a9abd45bcfd41acbed7705d22b4c7d00aa77

SHA512
96e454ebb4c96573e8edc6822290c22d425f4c7f7adbab35e6dc4b3ce04a5916ae9254c2c312c98299835ecbf3c5aa95da2939b8408ac25fbae44ba87a3795dc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png.fun

Filesize
8KB

MD5
82a2e835674d50f1a9388aaf1b935002

SHA1
e09d0577da42a15ec1b71a887ff3e48cfbfeff1a

SHA256
904372666ca3c40f92b20317d92ca531678958affbc34591401e338146fe0ecb

SHA512
b10a8e384d0bd088443a5085f5c22a296f6f4d295a053d4526690ba65846e887daec47d01cf18fdf1160db98061a8b7c4040de56e6e604451a821fadccf32698

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons_retina.png.fun

Filesize
17KB

MD5
150c9a9ed69b12d54ada958fcdbb1d8a

SHA1
804c540a51a8d14c6019d3886ece68f32f1631d5

SHA256
2dee41184747742fbdc527b2023d67fecec1ccdfdf258439a06cd75d4fd33f43

SHA512
70193ee6f0919eb14311f43b5a5da041deacb568db55fc43290ee76e17af902ac468435b37a150630ea3b7871c724073915ae5dcba3c301ac42f2d68dd598e2f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.fun

Filesize
448B

MD5
880833ad1399589728c877f0ebf9dce0

SHA1
0a98c8a78b48c4b1b4165a2c6b612084d9d26dce

SHA256
7a27d891097df183fbf0031e3894bdac0ce77aef15d666ddd9f6a04e9836fb27

SHA512
0ddf247892a72a390437390d535debf6e41d12e51b31eb4f0353b710ec380c5fbc531a48e76935088063a41aca843287d3def9c1cd46be05b8dcb69f5017a464

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.fun

Filesize
624B

MD5
409a8070b50ad164eda5691adf5a2345

SHA1
e84e10471f3775d5d706a3b7e361100c9fbfaf74

SHA256
a91790b778026db625c9dedfe1c6d94b884818b33d7977e86b2f9c2f3c500796

SHA512
767a75edd37d29b3433040ce21cda849cd11ba549f27581f7edc6416c433ba7047c56908d40956422393ab0f35ede61617d4bd2aad0bde3d1ebd276584c858c7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.fun

Filesize
400B

MD5
2884524604c89632ebbf595e1d905df9

SHA1
b6053c85110b0364766e18daab579ac048b36545

SHA256
ae2facd997527426fc4def82e0db68be29b44499bfff86a28c36f7c31b177d4f

SHA512
0b506397627823a1768796129c6b37d146821471b89338b5f2d0fd3aea707fd46a8e197ee0e298ddfb3b50eef0a0b064946006346b060f733ef19cbd5d24fc90

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.fun

Filesize
560B

MD5
e092d14d26938d98728ce4698ee49bc3

SHA1
9f8ee037664b4871ec02ed6bba11a5317b9e784a

SHA256
5e8ec278a273be22199884d519a79f748801baa3a45b76e57569fdfffe96e7fb

SHA512
b2fcb5d46339cdf6b5a954f2a083cf913779e57cb6e8699bc5da1fba1c370c41117b7ddefb50075622067eb7b02a20268bc047171bd883bcda4a497c2ec64ea4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.fun

Filesize
400B

MD5
0c680b0b1e428ebc7bff87da2553d512

SHA1
f801dedfc3796d7ec52ee8ba85f26f24bbd2627c

SHA256
9433084e61062d2b709c1390e298ddaf3fb0226656662c04c0b7026a44dee750

SHA512
2d1399a6bf225b048d2b12656e941ad912636acae2dec387f92f33ac80629a1e504bca63580ba73a8ed073788f697274d5eb76ea1b089f0555fd397a8f5cbbff

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.fun

Filesize
560B

MD5
be26a499465cfbb09a281f34012eada0

SHA1
b8544b9f569724a863e85209f81cd952acdea561

SHA256
9095e9b4759e823e96984981af41b7a9915a5ecaa6be769f89c13484cef9e0f5

SHA512
28196e5de9670e9f63adcf648368bd3ea5926a03e28a13adc2fb69c567fba2f84e4f162637c487acb64eda2e30993f849806f2313820ba693c7e70303542d04f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.fun

Filesize
400B

MD5
2de4e157bf747db92c978efce8754951

SHA1
c8d31effbb9621aefac55cf3d4ecf8db5e77f53d

SHA256
341976b4fe312824d02512d74770a6df9e1c37123781655532bd9cd97ea65fa9

SHA512
3042a742c38434ae3ee4fe10f7137462cdebad5cae0f9a85fb61063d15a30e1b54ac878b1af65f699c6ca1a9d2c3e58d245e54bdebfadc460cbd060836734e11

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.fun

Filesize
560B

MD5
ad091690b979144c795c59933373ea3f

SHA1
5d9e481bc96e6f53b6ff148b0da8417f63962ada

SHA256
7805ac9d0e05d560023e5aabed960d842e4f3ec2aa3db45a9cfb541688e2edb1

SHA512
23b4c799a7b25f70962e8dd0ec7286ba7150053cab7c88f5fb1efc1095c2987bd6f3572e7fb3ee4b2238958e52a763de2c84a74615df7a6d3a19a034584fd687

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons.png.fun

Filesize
688B

MD5
65368c6dd915332ad36d061e55d02d6f

SHA1
fb4bc0862b192ad322fcb8215a33bd06c4077c6b

SHA256
6f9c7ebec5a707de439e3fd2e278fdfa07a39465d56157b70b24f091509bf76f

SHA512
8bb9a7690aeb3c0b9e14e1a6ebc5741536d354cf2324fd74ee0c3e4ef511718f7795039a94c8d2df94b6e6d0fb1762191cb649089d1def12abdf34003f0cdd0f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons2x.png.fun

Filesize
1KB

MD5
0d35b2591dc256d3575b38c748338021

SHA1
313f42a267f483e16e9dd223202c6679f243f02d

SHA256
1ca0cfc2df0354c8d886285ae5e743d9c7cc030e1afd68ac113c0f2ce43ad5fa

SHA512
f6c58c27bbde7508a866bd0e7fabadb13a4f020378cd8b8cfc0c9fa23f645d811d6cdea04b81afdf30c064c6248152e74b3e6a78ec7a3d1d19037a0db8897d7e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png.fun

Filesize
192B

MD5
b8454390c3402747f7c5e46c69bea782

SHA1
e922c30891ff05939441d839bfe8e71ad9805ec0

SHA256
76f8ed1dd50e50c7d62b804a0d6901a93e5534787d7b38467933d4c12ce98a0d

SHA512
22b26c62473e80d17c1f78df14757ccfb6c7175faa541705edc153c02baa7ab0982b5daabe8dd2c8c9efb92af81f55ccaeeecffe8ed9a0b3c26e89135ca50923

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png.fun

Filesize
704B

MD5
6e333be79ea4454e2ae4a0649edc420d

SHA1
95a545127e10daea20fd38b29dcc66029bd3b8bc

SHA256
112f72ef2bc57de697b82b731775fba3f518d1ae072120cd11b732bf4a782e36

SHA512
bed5906c7373814acc8a54c1631428a17f0aa69282920447a1575d8db826afd5dab262301dc6da610ff8bb81d24ec6babd3d9fb99fd6945f1aca9cb9c76ec2c9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png.fun

Filesize
8KB

MD5
3ae8789eb89621255cfd5708f5658dea

SHA1
6c3b530412474f62b91fd4393b636012c29217df

SHA256
7c5b1d8469e232a58359ccbcb89e619c81c20e6d2c7579e4292eb9a19849bc5a

SHA512
f6998dbae1a2fa56f962045261a11a50b8e03573d9d4cf39083da3be341cc104e0ecf5908076f03961bcdb1356d05a7450d69940ec3aaab73623a6fe180e7051

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png.fun

Filesize
19KB

MD5
b7c62677ce78fbd3fb9c047665223fea

SHA1
3218c7b6fd8be5e0a8b67d3953d37d5dbd0c71d8

SHA256
aa638be6e1107ed1f14e8430abedd6f6d0a837a31b1b63e6a7741d6d417eddc2

SHA512
9e0cc29835845f2a0260a6989c1b362bac22a8e0c2825bc18f1dde812ce7868503881d2deaf951429a80b5017b6ce31e785ff524883e08d730aa38b36a2fb074

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.fun

Filesize
832B

MD5
117d6f863b5406cd4f2ac4ceaa4ba2c6

SHA1
5cac25f217399ea050182d28b08301fd819f2b2e

SHA256
73acdc730d8a9ec8f340c724b4db96fc222bb1eaf836cec69dfe3fab8d6ac362

SHA512
e10883029c1e0fbc64bec9aac0a6957a8499af255e1790843717212077926474e02b2870c5dd04b057c956b97ad4bb1747fe73e731ea61b891f4b38dd80494d7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.fun

Filesize
1KB

MD5
433755fcc2552446eb1345dd28c924eb

SHA1
23863f5257bdc268015f31ab22434728e5982019

SHA256
d6c290e942ee665d71e288229423a1f1866842988eac01f886910b0ec383aa9b

SHA512
de83b580ce27012a7677e1da867c91e2a42dbc6b5872dcf756ace51c2862801814665ecca997171f2e550e8b9a3de19994d2516a4e5d4d57e16c7b4b823236c0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.fun

Filesize
1KB

MD5
781ed8cdd7186821383d43d770d2e357

SHA1
99638b49b4cfec881688b025467df9f6f15371e8

SHA256
a955039cd9e53674395f4b758218e4d59c89e99a0c4d2a909e49f6008b8f5dd4

SHA512
87cb9c4288586df232200f7bbacee3dee04f31c9444902dd369ad5c392d71e9837ebf8b3bb0fcb4a5db8a879cf757e97ce248939e3316c6bf3a3fe7cbe579534

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.fun

Filesize
2KB

MD5
51da980061401d9a49494b58225b2753

SHA1
3445ffbf33f012ff638c1435f0834db9858f16d3

SHA256
3fb25ddd378ab756ec9faa56f16b76691cf6d9c7405bb9a09ce542a6f5b94e44

SHA512
ecc5eb2a045ce2508d461b999f16caba6cce55aa0c00b34bd73a33e0458795f93a77caff5026212912684164057be016f51dc57ec83821c2a1f2e27417c47b2c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.fun

Filesize
2KB

MD5
2863e8df6fbbe35b81b590817dd42a04

SHA1
562824deb05e2bfe1b57cd0abd3fc7fbec141b7c

SHA256
7f1238332901b740cde70db622abcfb533fc02f71e93101340073552f4820dad

SHA512
7b2d95465ea66951ea05c341549535a0a939d26dbde365b212e3983e4047fa6912c37d737cb8054c41bb1a7d92586d968a0154c666572a70ebc59a4776897f38

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.fun

Filesize
4KB

MD5
79f6f006c95a4eb4141d6cedc7b2ebeb

SHA1
012ca3de08fb304f022f4ea9565ae465f53ab9e8

SHA256
e9847d0839d3cf1039bebdc49820ee7813d70941347ce420990592e5e3bd998e

SHA512
c143a4cf1ccfa98039b73214978722408188535ee4aa3dac08a34760b94bdf6d36ad0ff0de893da5b17fd69c96a6dfb25098ab7fec219fad1a77532113d0353e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.fun

Filesize
304B

MD5
b88e3983f77632fa21f1d11ac7e27a64

SHA1
03a2b008cc3fe914910b0250ed4d49bd6b021393

SHA256
8469b8a64e80d662eec71c50513f6d295ef4a3a9992763dbcac9d81253cef9d5

SHA512
5bf93d4f4250ca96169f3d27d4e648cc5d6e00b7558a3ef32e07edcbae36dadb8008d7ba5f83ac3ed812b72c9d52730e866191b4de7a339df57b5697e00df50d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.fun

Filesize
400B

MD5
f77086a1d20bca6ba75b8f2fef2f0247

SHA1
db7c58faaecd10e4b3473b74c1277603a75d6624

SHA256
cf10d2a22b638cf0978cf30ecaf39ecb5bb0e3ad78cd920afa433ad60cc1290d

SHA512
a77a897c0b41f4052cb9546d4cfd6e0856b288b6b8583a86d6c7e79059a05b19cc2593599251581e79107235e9d5cd589c392bf490452be04ff57e944cd19df3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.fun

Filesize
1008B

MD5
e03c9cd255f1d8d6c03b52fee7273894

SHA1
d0e9a9e6efd1746bc9ccb4eb8e7701c1cd707e2e

SHA256
22a34c8321384fc7682102e40d082e7812232a9109e4d4e8fa2152fda3f260f6

SHA512
d4bd002197b725316e1f1f2dd0a70ee44a82a53ac0dafa8c6b1166343adc406e147d0c4cca30d65a32aa545f1b327c6b69c0ec1d15330af48a6faa234dc4b5ac

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.fun

Filesize
1KB

MD5
62b1443d82968878c773a1414de23c82

SHA1
192bbf788c31bc7e6fe840c0ea113992a8d8621c

SHA256
4e96529c023168df8dde241a9acdbf4788ea65bc35605e18febff2b2071f1e24

SHA512
75c8604ea65e0cdd9ea74b4802930444dd16a945da1e7f0af4a9a3762259ee9eb41ea96973555d06f4814ee2f6b73ab662c6b314b97876e9628fa5d4536e771c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.fun

Filesize
2KB

MD5
bca915870ae4ad0d86fcaba08a10f1fa

SHA1
7531259f5edae780e684a25635292bf4b2bb1aac

SHA256
d153ed6c5ea8c2c2f1839f8dadcc730f61bd8cd86ad732bab002a258dea1d037

SHA512
03f23de6b0ae10e63c41e73308b3844d49379c55d2df75fa1dc00771b26253d832c21081d8289f04260369df996e31273b7c0788cf3b5c78a27ec909f14a283a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.fun

Filesize
848B

MD5
14145467d1e7bd96f1ffe21e0ae79199

SHA1
5db5fbd88779a088fd1c4319ff26beb284ad0ff3

SHA256
7a75b8ec8809c460301f30e1960b13c518680792e5c743ce7e9a7f691cfafc38

SHA512
762d499c54c5a25aba4357a50bb4e6b47451babeda84fa62cfbd649f8350bca55204ad002883b9147e78dda3dbabaae8da1dc94b716204226bb53326030772b7

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.fun

Filesize
32KB

MD5
829165ca0fd145de3c2c8051b321734f

SHA1
f5cc3af85ab27c3ea2c2f7cbb8295b28a76a459e

SHA256
a193ee2673e0ba5ebc5ea6e65665b8a28bd7611f06d2b0174ec2076e22d94356

SHA512
7d380cda12b342a770def9d4e9c078c97874f3a30cd9f531355e3744a8fef2308f79878ffeb12ce26953325cb6a17bc7e54237dfdc2ee72b140ec295676adbcb

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.fun

Filesize
160B

MD5
580ee0344b7da2786da6a433a1e84893

SHA1
60f8c4dd5457e9834f5402cb326b1a2d3ca0ba7e

SHA256
98b6c2ddfefc628d03ceaef9d69688674a6bc32eb707f9ed86bc8c75675c4513

SHA512
356d2cdea3321e894b5b46ad1ea24c0e3c8be8e3c454b5bd300b7340cbb454e71fc89ca09ea0785b373b483e67c2f6f6bb408e489b0de4ff82d5ed69a75613ba

Download Submit
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

Filesize
283KB

MD5
2773e3dc59472296cb0024ba7715a64e

SHA1
27d99fbca067f478bb91cdbcb92f13a828b00859

SHA256
3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7

SHA512
6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4018fe01-9025-476e-97e3-a715e534ff03.tmp

Filesize
12KB

MD5
e5cbed26a71e1ceffaf358e1454d2a9c

SHA1
00f3bdf87bf088768bfa3526d9c5a4f20de103df

SHA256
0544c31303a233edb2d1ae0aaaa0ba4051c02cb2853a3081410f8fbe12b73a15

SHA512
1d5057115d4f261517938032e6c502dc6101ce8298195df0f3cd64cd9058fcfd2e0bde142c4a9bfed734e816c6518f4f7c937cc02cc67748abc49a3399a7245f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\46facbe6-6c0e-45b0-9fe4-36160b8a8de4.tmp

Filesize
11KB

MD5
112298107ad5bb22836748f408fde0dc

SHA1
e2555b14356f34f501b256af250342c41ef8fef8

SHA256
3bd745dbcbcc5c0f22fb0bfcbe06583f1964067778827730aac9be8940cb88cc

SHA512
60d902ddefb54c3f9f0188ec1a122a271f9951564a0736951ac069442262afc961ab2ab8008191abd81e2cd55d7159b0981f96cf4c8f1e5347987597b8cbb049

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7740a919423ddc469647f8fdd981324d

SHA1
c1bc3f834507e4940a0b7594e34c4b83bbea7cda

SHA256
bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

SHA512
7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
34KB

MD5
821eb7c1fb19bf2b97e97a48e20b95cd

SHA1
f7f7a685e052fb6e7747b850c887f175a056dcff

SHA256
b02c2200ec701c63687524fd0ec9df3e6204618741597a62fb261d2c06e8b67c

SHA512
64107ff13086557a65663e10b681619a304eba64fc5168880715264c170da0cabd4947caedf57f39eb2dcb4f697ef354a1ab6f4344571fb2ada4b0b78912896f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
69KB

MD5
a127a49f49671771565e01d883a5e4fa

SHA1
09ec098e238b34c09406628c6bee1b81472fc003

SHA256
3f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6

SHA512
61b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
1.1MB

MD5
93feab00f76536d681c1b77eca2c7caf

SHA1
c48cbe893b3178a56357c132cae2fa63918d790f

SHA256
5da61564d6ae3fa4506522460d177f8b642b20bae63f81cee14b9ca71fd49226

SHA512
6276f945f1008c70bdc559a8d6a14c609a033af2fae6bd80c129da546e7df6cfb3fcdcc452508df8ee5be7a0a87a6f9930664b8b9726c4e52877802a9ceca5ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
32KB

MD5
bbc7e5859c0d0757b3b1b15e1b11929d

SHA1
59df2c56b3c79ac1de9b400ddf3c5a693fa76c2d

SHA256
851c67fbabfda5b3151a6f73f283f7f0634cd1163719135a8de25c0518234fc2

SHA512
f1fecb77f4cdfe7165cc1f2da042048fd94033ca4e648e50ebc4171c806c3c174666bb321c6dda53f2f175dc310ad2459e8f01778acaee6e7c7606497c0a1dea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
74KB

MD5
bc9faa8bb6aae687766b2db2e055a494

SHA1
34b2395d1b6908afcd60f92cdd8e7153939191e4

SHA256
4a725d21a3c98f0b9c5763b0a0796818d341579817af762448e1be522bc574ed

SHA512
621386935230595c3a00b9c53ea25daa78c2823d32085e22363dc438150f1cb6b3d50be5c58665886fac2286ae63bf1f62c8803cb38a0cac201c82ee2db975c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
36KB

MD5
01369d5062d49b270c8dd6ab535bc403

SHA1
39c654df64cd7386081da8108f23573f331debab

SHA256
ed672ed37bfdadddb835de8c346655a17b653094197a2d6080e6777fa59785ea

SHA512
de704934135717cb62e4d15ef1666e78b3d43c17ff5d50b279c21a5318ac2ce0cea88ebeb17b66f4668e1ca1a8801bdd6bab0194b157b1da6bd90c71b29da08e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\096fae0c49b6663b_0

Filesize
4KB

MD5
d32d018454cb16c04185faeb3769cfee

SHA1
d2e3e328f5e2059b90e63296d184778b9703fe16

SHA256
d0631efe69dd6b8169c50f3a666fd4e71c5a5d1ddb5374670158b5878dfb6bf2

SHA512
f67154b663cd0c5af55fd5790cde7cb1749ca21b9f66250c101dc0fdea8d5436fc48a8965cc49a54efaa37a217ce2213081187bff59f354cb5bea4fea388c882

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0ce6240506261827_0

Filesize
2KB

MD5
9728dca747259ab3bbabe90c4b5065b7

SHA1
e961fb9ce881b293b550f7f47b9fe14043cb4a8a

SHA256
11c9cc91bffe399020a5b5782c3ec5ea3d0d2331f7dff748210af786b72b1fac

SHA512
232ee84aa2c64d0892ec7fafc9ffb7816fb61f4c7ffa1fcd5cfba466e3e25f4795372f73c2ba8bd8db5335c91ac4ed031bd3f7f840103b2b6937dc0f3a772deb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1ac673f66e12ce14_0

Filesize
2KB

MD5
84ef7e017d1cb9146f738080eb06bd59

SHA1
a88147fba83d2c1955125261ee9518bf77f24229

SHA256
6094c0b1f49e4919d8bf1d42a6580e886d5efae09fe9255c8a3426add1afdf66

SHA512
2894e91b5f24c67ac4ace8faae94909f6b286841d2ccc0343475e7e88d734ef4d47db079bbe5c75e4362fb442e9f1a561ec504b520242216bfff9b1cb6af23e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0

Filesize
1KB

MD5
8b500636f1c19471a5ba8e1adf1bf55a

SHA1
4a9247e2bd857e8e9f0d7d720f7439b61193d069

SHA256
03ef097bd85010e96649a23068f4327fceaf72796c8f96d6b770d27333053211

SHA512
080ad2f1dec6c5b618c1258d7d15ede5640e75c3c131e863404bed8d00bc2c36eb18fc49a7253bf842490793f9391cd0fa7d27fe026ef9038f116c03c17227a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\33f0991b0c05bbe0_0

Filesize
2KB

MD5
7726027b773c1e55965be1a4a5f5bd5d

SHA1
adfa01c91c710e2ee1a1af2f999ae6c50ad619f0

SHA256
d315c167b7b6aa2a6569022e5cd1a9dde1ffefaae6de51dc543e51b342154227

SHA512
dcbcdee6622a35d0f72b8210185ce507199db278ddf67b94093f1eac7759208ec7295b7c977a1d50451939994db31c9bacaf546c98e286e38e5472c396e693f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3fd2be14abb3904c_0

Filesize
1KB

MD5
609fcfd51e2d18f324a4622dd4aa1ee4

SHA1
b0998c702a1f2a3dd1436b6d78a846180dc65b5d

SHA256
2d8938de63b2247fb4ae449119a0cce6842314e907d7c5242e8be52469078729

SHA512
03f4dcf6f2cde8bd31984217bac1b548ba672077d93faf9ec7d5fa104e848d1391b122c38101355114ade1a933321f944b3604e4c662148a877bbe430d1fae50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

Filesize
1KB

MD5
d002e1ef83468dd8c5562a3124f65599

SHA1
7329c1c4ea344771164abca81d605234875262e4

SHA256
9d89bce602a9d6511c509f21850c155dfd8def01a217ee920f4d270fa9cd6e58

SHA512
f3111acb227746000db2880512a0766b6a4362df74a6606b504ed6f4d2452305a42c4f6fe09315e1ed5e174dc98413f8e756bc58e820cd783653272095c3a8ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\62f20db8aae8f96d_0

Filesize
3KB

MD5
2912bd6d90ebfa6df3541e086f59e028

SHA1
2955dd6364b2147662acd2baf66ef4a2b78e8039

SHA256
b8a1ad99cd936cc2e615a3da46793753d2c8d82db10100b12354a199285631b7

SHA512
3b515ffa6897d57b6eeb641a7db7147c1b968e107efb0d96c4841500d57a39906e242942242143f8e0051dcf29300f9f104da6b89043d29ada63d5eaae75485d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\632e260441be7404_0

Filesize
4KB

MD5
4fe1f1e501fabee6b81d1c02d035e370

SHA1
716cfbeb94e3c3923997d13dacb77a6a3451ae07

SHA256
9b276cac520966e4aedc6f5299cf4e533d4b4715b0b6ca02b27f5d1e91152f82

SHA512
9c6d122721d8eb261223623fc873112b3fdcdbcc08772c0ff54c2a179e35fd65101bc11016a3932cc1753cfd4235799494f80463d823fd21993ee18fd1798fcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\64fa70d4ab69732e_0

Filesize
6KB

MD5
2a4a103722c2db603bacfde1c678018f

SHA1
ecc95571483f69161bf4ac50acd1a0f944142c95

SHA256
5396eddcd56d1f3cded75e8c355149899febfea3e9e36bef1adfec4aec9243bf

SHA512
0d0fb593f62f1a6f56be26190ad2b8ac823e712ff66f24f930205734aa29c47a62b9fb7999e9be4b09e512ad43df2ae066bef5cbd3deb2cd0656ad512cfbfd6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\65a17db215bfc27c_0

Filesize
5KB

MD5
f3ad830a4c10bb23061d60d942c9627d

SHA1
1e42a8a7bb26299c83fb00bfe436619616906c9f

SHA256
686b1362587881020b4e4efdbbf3347e160f00992b141c166fc37003d5a55c79

SHA512
cf04a0f73fc2f7467eef795338f7ebea71fd93bb323a74a8bdd44225eb675f1de0b52f6cfea3aa0ef0eb3c36aecebe7e34c62242b12fab3075a91a4d7382e698

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\733a2ebc15407e86_0

Filesize
3KB

MD5
811806736487b276d03025a17f8c4a08

SHA1
785ec439a43937f66ead9d5ad0d3bde64a80db8a

SHA256
a93c8e9314263e27e50d3dfe508e6f9d8625970708bcb36a50a25ee4805b49f3

SHA512
ff63bc5f53607bebab3563f6fcae932666d10bf962f2411b4b279d13e93601abc03cf6b5052ea062da7c531d6f10ffb35abd0a89f16e5bc326014fe3dd181628

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74b88724f60b0383_0

Filesize
1KB

MD5
c06ec6295a2c02060a8251440020d018

SHA1
e96f5ae83f0dffc905a6a8d0ea9a0ea130a69eba

SHA256
17437ba57c4718645c88a90fb7ee5061d85504f66bdaae3d1c01c01bc8f2be73

SHA512
1b973cece91ae9912544f6941040de9b3a8a6aabc0f2119a64a3b16f46ba10723cf1e1ecf7db5610df90219683d844f9a13404c1b513685ab6c13164980fdde4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9412c8b664751f90_0

Filesize
1KB

MD5
857d69edd70f3bf56d8f34fe515a02c6

SHA1
7b12acfc2851e366036ccd3037db2eb2d918c09a

SHA256
f91a13d1706f78563cabc0f8340214cb4031ebdd8359375beb941bfba9a1d6ae

SHA512
7f8c2c78f621c19d547925a083464be0cdebcb5c2a4faa381f00b997f5e9233e08e4bdebbbad84398584ceba6bba91af6df83026c2a4afef707fcf21f6d018b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\99110e9a19c3c06d_0

Filesize
4KB

MD5
b3d938b0fa2bc42fde7d0315a0827f10

SHA1
8ce7f704fba12d5bf47b0a57cd4d9e96afa4e184

SHA256
21698a9e1c499e65047da13d6d316aa5c14ba624aeae2d53727ccf8129a5a625

SHA512
190f8f9451c03f48fac3fc4bf9f968a0f1843a12683680743b8fc34563ff46b0966032b3646042ccef0e44b814d32cb3fafbbda51bb3c747fd3edf669a1a1bb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9aee5cd509922cea_0

Filesize
1KB

MD5
052ac393f25e0e775a6a8278118b34d1

SHA1
b70268360f00efdf4c36f3b0435d967c9d422f97

SHA256
3dae152a6a933c4e1d2bbdecf7f76afeab149b69a7eb2a4f9ff85bf9ce83b64e

SHA512
e73f221aa5f75644525031aefd3dbdad672982d9cc018d4ccf5e66f21a84d42dd28289fd8531cd0285fd173b3aaa1cf5ef303f6a45578af16d0f667f347a277e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ac9b40a0411376f7_0

Filesize
1KB

MD5
955e53b84800379660d3acf529fb402e

SHA1
f9b9eaabe6bc6b21a5c1cbff1034de89f42849c3

SHA256
d32344a88bf587655c2257679d1817b24d4f1c406aa647e431c935c4ab1c5f64

SHA512
c27ff6b2c18c92b986a5e3faf15f192a72d400fa77897178a94fcf8e30b99ecfb368982d86b0bef134625ec2f0fb2caa94dade180ec753a3e93bc2ebe04a76b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c6ad28a084c2cd20_0

Filesize
13KB

MD5
921b5fd92c2e6813cb29665d83bfa74c

SHA1
26ab42377d67c37ba2342b93d4666d95b002f6af

SHA256
d34a5412774125a61d665a6a83438449a91e35f64e24aaab60150e228055922e

SHA512
ad8949f62aaca5d7691825fc37aa617a16aac07ed55e9c5b2ad51fd3cf44644b9876090a1bd192c990d5d52a4bfd720d4c440622b96e6ee8288c1e171ecf6f2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2e4bbad99a372cc_0

Filesize
2KB

MD5
99917170a04c7650c2a5aa724742a947

SHA1
d1ece0b2a744c5fb97143dd74fbbbd3bfce0d7f3

SHA256
7a209b65cfbd5e80d1357e5df24adbedd097714bf1f87ecc74c819cd81704ec6

SHA512
b9a0bc78d212d92787141bca46bd3e44b4f145f9ee47204055d20492c7069374b3889378860b30ae54d2d1593d1c0f6d66a0c47cba620c8a044c7db15aef967e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f89251fac2b69325_0

Filesize
3KB

MD5
db7fafd411ba5a155494aabf7e370753

SHA1
32f220c389f0de073d68c87e1eda8e753e47e8e6

SHA256
4ab0de41c1b0ca7cd040fe3f02bf32eb2482c8ff29bed3e60f1711ee9f28c0f6

SHA512
10b21f38e224f3d61a3794f109407146f62fdd59a3257325351f1576cb9544a1d1d16941845e6a14df723346b25829b450e8f7845768212962a6b12d4d7e9de3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
82c2f78dd6ea8b9d0ecdece6862dc22e

SHA1
2be65298fc8aa5be31ea982ddfe3076faeeacc09

SHA256
612949bb323c448f3a295f7174823c301caf625b6fce41b6720246d315c5801c

SHA512
156128c3e828f177f81ec7e9e722f87729f8d678f92871059ec1f4ccfeb72fc45dd2c1bd553ec4cef9561e391c8f5476db7943b8ad1b1f4c2ed2f3cebaa229da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c5133ceaa07e01159d9c701391dec5d6

SHA1
2bde77372d9c1662160770363ae56adf426e5304

SHA256
9963d432fe2549ba0102787516fe83b2ed105bb0a7a6768d8abdb8c0334ece2a

SHA512
a76a7bf917177779ce4c72977b70d0a8846f51da97602dd62093a51296e132192ddf6f15b4ece51f4b143df2cb5a60ff73ef09a4aa7367ade351f642ec4e2f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
a2e169df61e8f9fbb230d88ffa6c961e

SHA1
a3dbeb2932327d9e45c54a36b2865220f4b52144

SHA256
da6d1838a465f1c93fcafda67b2bb8b33f06c5532c97dd23ccbd8bfe9f502cfc

SHA512
b899de05b621ba17c9eb126fcfb329fd76d66ad691ccda25eb004f0fa341b127312eb78770fca57bcb9131bc1d689385788621fd5b747eb907741c30e33461b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
cb63803ba2d3d3f127e1862ef81de169

SHA1
326dc443327fb4ebd8f277ddaea6fbbbad3a7ddf

SHA256
12dc8d9db5e565e56333e6cc6b9c98b6b564c436e6a34f094a37e54bb7140172

SHA512
ce8bb40a6b855f2e02e1c0e9dfa494435c2aa5750a1be40129ca67dfd3e222b448e69ee1a7384eb34f7c9d6ea5624dbf3838e542d394687391985bdf35f2f4c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
df8740abd57f9c12ca27730b4d39fee1

SHA1
91300df29d8684f6b5fa6f092d949486e737a400

SHA256
38ad2e02cac9fec7f11db4b93c3c8039a470bb2e2f07223ee01a94a7806bcdef

SHA512
5d63e033ffea439d0e58d76d8d6e68ef7c7b2febdff21e3b76076992bbfd259d2bf1b6e44b2149d20ca01d8b6e07a683a68186f5d21f976a73f990fec1acd632

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
3ce778d2c13d200a4f0226d2dbae5ba6

SHA1
a1e04659c919e26453f05c07097e5880ee75efdd

SHA256
c0b75e79710fd6ac1a4c4c9a7506eec0e784a2b62e773bc8e0b8012b7b98a0e8

SHA512
aa93750ad110a785bf5275345cdb8081f521db5c5532e6807fb8b369efc695d3074ac57cb65b36071ec511cd79ee564044914764574dad6be6c02b7f8ea809db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4cc0da379373e98dfa890fdf0efceed1

SHA1
fd06a53b43b15567025636455abc8a150b7b56b5

SHA256
e12debdeb12fb6480b76c7618317c9d757a9ba3a9662c1166aff6d794a1d9574

SHA512
7a4292493d47637800d097253c9280d9474d3ea89db86aef320e36ebf201be2cd35e675d3d253140b8b8a954a3270e90795e12f8b03a348fd53897c23de68b00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
77d2736ecaf8ecc84361b4744de08075

SHA1
86cda5f8f6629dc2f85cfd2d04d1bba412a5c926

SHA256
b644bddf4edf51ec413fc0d718c9293c8f31914ca373d26272ca05f71e3838c0

SHA512
062a8a03bb27db3b8cb5264ad286d5fe5305f6d98b5ec23be26f60e31e5f592685c7e5cb14329384f9b72b2cbfa1ebca7adbeadfb9b6f280793a628dae258b12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
dd2268438058b6c9ca9144e54f747b8c

SHA1
f2a2c4befdb46816852ed93dffc326f9c8591463

SHA256
5290645d2cb2142fea2d0d685c703753c0c39e45c9cee838c2339334851c6867

SHA512
a2d860a03eb8b3aa0be6b899b86221341c0a8558b54a3eca59e46e3c2c7d3bfa45b35db5b9cdc688ff0ebf1b2efebc88b82b75c2789e856f063c14ecb19cc4fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a7f4047f54a64e0766923daf5c948f64

SHA1
323c036bbf5e24e3a52b169203b7379f1e826f18

SHA256
9fa47f549e211c87b564bd8f91ef4308358388582891bf520a36ce71a00a3906

SHA512
14b8733635dfc70d7550a096bdb38a702cbad623de7830a818edaf49c6f19ed004aed8023c01cf6541db714d401223a552d1f801325b1e8a2d5af783b3a57733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
dabbd58947f03e24afbc7907fc0b0c9c

SHA1
950adce850d710326fa74abfa89e49d909259f14

SHA256
510c02c1c5c26dbceba331b2f0244c78a72f136dd6e29fadca4e0ad8f2992cd7

SHA512
9d7c785be4f0d8586c5a9286d6cbe5da0495445d8bd8f08f24a5bccd6c6a89f80d9cf3c85b9ba78479770ba8ce15f6d98f8c5d7f57091048c5316ddaf1985e9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fbd7ad240eb2c15def57bcb03ccac7f8

SHA1
6387b7e9f9d9095eab3a2a9821fb979d09326677

SHA256
cb281060f0a5dc684c5d250a4c9e0711a327f711a331ffe845add4a30c7a99bd

SHA512
de07b64611ef20b06c323a101ad411f7f2f4485f942238e1b208ea29a9c37ac83ca9b51087d3590a5f3cd7b6818d4c6705e450a3ffc288ddf28683cb02e2dd27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aca6d10a6c9eb09648b56a60355ba049

SHA1
0277b4b12e6a44af62f57880cd495d0b8d406b03

SHA256
e2bbf4a23dfb236ef24d1c0967e095e10f8fde66412e764c4ed364a3d4ca35b7

SHA512
6d2bf1cd4ac2a970cd1bdfbe458f0c5932c075aa4ea5c2f8e024e6f5c9e0a9203bb2f042e5e1fe9f78f90c89ec993d7e81b3c90800e5b72fca376a840a3723aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d961a5d8f48508b93d203c8ea6974261

SHA1
b15d5aac54647002aeca9878bd4b0ad0a30a3b6b

SHA256
908c119b26c6041381ecd3de73119f9f827e1a8d13fe3621145eef25da7199ef

SHA512
6bff886af2a2202f520510c5c769ef97f92ecd27f6e8f6385cc5c61edc38bfbae546b1c650b0265a3d008cdb092381280b7288d3442b96858e169c4beb7c791c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
00db33ab4a9a7624f6c6fdbe40e1f3e6

SHA1
347f621d0ba487a9b6690801919c6672015f217d

SHA256
24c3394c6ccd942a1361c3389bdb0119d045d2ef3fdd408357354834d889f7f1

SHA512
12d9c310da6ab4b4c3cd87210b97d0be0a3d1ea98858aa06b665a681bfd44dfa848b514c0c4ff8fb612de6ab2d75ae0614e74b3150d0f2d589c997d72b776053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c03ffe9c3ce7c0af3bb4f4cd3f499cce

SHA1
acfb17b73305d75d19652ed63ae8f820d8707e84

SHA256
063228fb9a1f0a773159ea2667f070ffe61f1e9962a37e939538533cbfbd001f

SHA512
f7cb8adba9ba18c517be28a57fc7554999cb1f8ff03eda2b4b9de0d236cf3b7ec92565fafeaaf6ba2b9d24d99541cae426a41501da7bf5bfc590216225720022

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ce190071088af3c81b80162353074f12

SHA1
a5430251273bf38f5fe3cd8165fe3fb4ecb909e1

SHA256
ad7b98e17c35c4ca072b1450799aadf43be09eae39506a7a07126c4d0a9d95ea

SHA512
1c577426930d7edaee2be17239b1d2e243d612eb9aa1b7c59284f1885fc29d02311163f19bdc3cae469555d137d76b336eed1318d7c8c1d70006c1ef079bbf7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f2cda0ecf18540c951ec4f80de5740fe

SHA1
f26f5abd74ab05f2121f95f01573c31cf98cc359

SHA256
46ca8d746640beb98732617241d09c1e04bc3e94701a69fe12c605fdce66eba3

SHA512
88ebbc893b0d3bcf08f4577c2eef44d2b32fe84a05539c3b1eef55399654dbac3d7c237f5482754d3c8482212527260c0a9f4b16ff2e867b09fd6b405c4da890

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7ef5e3c78ad1597643a2934f39b62240

SHA1
620591df5fbb7e8dcf7cb8e561bd8d89b32a380d

SHA256
49460058fceeaadd5a8b0bee6e0a4c6bfcb3b57b902f44b72c4305132b1f86be

SHA512
6f7816966f59225a0684a0c367249ece2cd9ac5aec51cf6b643e4e1a16cf91f791a5537e1eca671864b5726f606bb4e3a7e9734c90b980c6248dbf294e16f7d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
6a3821147a2172bfa5c742be56c6a40f

SHA1
21e86aa95a66574c91b4ce33607f0b6fc8faf7af

SHA256
018e76e789d2cc63410ca22b5757fa9eb6e7f98d385e5d4386dd5a6c16a1b56d

SHA512
61fbbc250c828b4561b5f4c777d675f9144dd76ac645348183c7f6f3f1cc6f907e1a9dd5e7025d2401df1e000a09bc9a2bed01ae5c04800186b574bd9457ea3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
447306e9f479e3267d00f7c988ad90c8

SHA1
2499bee49f23a0a04b7a42fb0f32c3e2c08ecd68

SHA256
40400797d87c828ccc4e292c19793a79f72d94b649866c03e89604407b99aef1

SHA512
b55e2a270c1fa2ddbd1a07abedc307e7ef7e532eace4b77fc197076b1db580baed5517380467883f8fe721b68f3ab5b6874883c62f5e8198365fac68e0504093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dc8fc79638d274540efa9cc6fc6b9f9a

SHA1
01a42c1d3391cf27dc1d0fb9cb61c75ce379c2ec

SHA256
dd732b8ceefa57102a365d6b7ceec1e740b02d73858e2cc4c18f5a60528638c9

SHA512
ca471dde4f87beff1e18888365a986ba923743d27fc5662fb2b49a099f9aa59eb5ca12bcbfe90ca5cb6b47b0dcceb3dc449350eb7a19eb2695b7b9a9bbecf85b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a119eaca4ecd3ca226ce7bf0ae3a77c6

SHA1
4310dd6bf5f41109767cbb0f3c7d6c33008f9a57

SHA256
bb5ab4fe704f515a6f224667fe9b4e2d30ec29b9dc7e5e08f0eb00bc28287ab8

SHA512
af704dca74b2ab86dc3b70d961f208a79c7dce78c7473c0f3820ff209c0f131fce0ffa37f9f416034aa9f9e69aeef1ec27bc9825abbbdf2ddd7ea8728fb8030c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c3b7432542bc150ee1f8e26b67915c06

SHA1
13cdc127bf02878142ae532141eced94b92fef1c

SHA256
6119eabe7c4979afc2f4e8f4745885e5971fa70d52ecc5632b4f07a3789ee9d7

SHA512
f2e5aab2425086d9750d58940d32b82f78b6cc68b04947645b086c80cf87d7b9018bd61665b8b0aec4c02dfc9b19df4de6891b80c57e00fb7df5d31e977764e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
40b4ea91f076ae73a708543027cb7fa7

SHA1
5cd099173a6ce9fbb4da3287f5c6c6ab0878259d

SHA256
0a70137e293930d7e5c2397404f2f530c45b23f9c2fe09b5dd02a08f60f7421f

SHA512
c28ed5f5dffb447c2facbfb7e7c71b80bd39ab0e46a1acf380b35e4dfb60afdee41cbd2ea6462c96ab132b8aec90c41d70446af96b979ec651bbd0ec34f8b14e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c0f43e3411931c981b6c773371057b30

SHA1
cdd3b7dfd78554d9c01a1b418b3bb6015bc69588

SHA256
d7bc8034a27aa70a0e76f5be36657ab61a5c4e17356e1be184d680f6ea5988ba

SHA512
a7b6281aa67a1c2a54deddebade43a25751870089b2c505560013b742b69d7dc67e1ff67f522db22c8fd2f741969943362dd765404d2e8c4451d86f6154cc0ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
47920090960918afbd3319089a39467c

SHA1
3db9505d644a152005b0106c5f294c69b9bd8ad2

SHA256
5355b845c52af2b224188eed46671046ac0914326b8fc352091b51e6946caae4

SHA512
1ea27a15998c272bffabc88155321993d3a3f4ba2877b0b3d0d424d6f1bf789ed917f3575c2a06c90e206b3f8db5c738ae6bb4d83a05c28fc79764311ef789dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f9d9c5de8b3065fc3dddb90684317648

SHA1
02101f2eea2eb7596c8a6eee354e554c37d3c105

SHA256
6bc4aef62902baf8f9f1dec99725a1d46ddbaffe8677aa36b85f366c51d370e3

SHA512
7da3352183de4ca7d83824bc7701318e61b0a670839e8782380dbb9a7a2265edf137454f0a803936103cdfa6c5ceb879cf97b6d55d7d1f7449ace7e11b8f5246

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
28d61fa22e47296f7973f1fe2c03f905

SHA1
34cd35110300bf223d451ee128ffd2c9baf3a8eb

SHA256
05670dcefe927a50c451b764255212c58459eae7b97fef27242d6d3682809244

SHA512
1c3dcc293d3f9f4649da5cc2bd50601be815d089adef7e6cb942d05790fc6a88b269a46c3f834eb8c0e653e2bed90947482a86961ea150e52709969b213dda5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
eec6323a2afc4d4d4fa3fdbe2698d868

SHA1
8b809f5ce5e314bc00bdca458f05ccb9131c7137

SHA256
a0049b22204424a5aeeb13d6297aaedad289b2496cc0c94fcb652efc4e4e5470

SHA512
06541d69feedc66bc41a01c11e598ac83c45a9ee22889e1d42dee8f899fca3e055d14485e8ad63778aa1d184e1a65d85b3136e0e8e4b644326aca884a21cd6b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
67ef882b2e6d12848f97ac41e3e53c4c

SHA1
8636a4231be518fc49435f82e3591e773aa790ce

SHA256
d412f6a2b06bb83cb714d9ec4ed5cc3fb59528b12842ed2820b63cda8f41b5a8

SHA512
dc5af4eafc8a0825214c78cf1b411c85f1385a39eb3bf3f7a132b76b99052a3cc3969dd10fb9f4f8468917408c642a0978cfa64b76b9249666b1bca9e7b7e2f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
df334c80308bb6e86fe1e516611a963d

SHA1
e16c037dd87214cd93ca00461ac102419dce2186

SHA256
fe87efcf3bc2608bd543bc953cfbada696db2766b6acb6bda279fc8c99bbbe30

SHA512
fc08032f1e89388424ffdd33dbeeb6282ffdd69253c0cab6f649b4cd4888a88a18327237083fd576696ba7d2ba3eacafb789ee2f25be12336fb7c6fa922643d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9d29ab7f771826dd5f8f5e843d15cd1e

SHA1
d8610eb4b0ce7428a7eb1c804338937f205a93e1

SHA256
3552b65dcd4f860b66b0a63943a84c6be81eabf18b471ba5329fca8f8982d171

SHA512
582b0fb72077cf9da995c35772ea6f2e020584d0ca6895d915a27ae97ec657f4b7a4636f3df8b739f4604d99e77e313b9e7d4bdcfd7dc6e2b5a7229ae9d24204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c83a3eca823f17c8f15dfa90a1bec71e

SHA1
950f73dd8bb58ef141c94e24327d9d994cd559f7

SHA256
e3fe6555d5a862f07681ba8d400e2c150dc328553198f7cb7bfd2777d6645a91

SHA512
0cb0340304b73f3b7b16992bf73b710e64074419c59fea0432fb169b067a9406fd3904dece883e6ee712a8a31bdb56c38112ff995f03e3f76d421248423f9618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4cfddcb2d1f9393bb92c5a7b1f96889e

SHA1
157e7a1ffdd06a99a4250b30cb47931b8f096c34

SHA256
3c7ea67c12e766a2abe21581a166d23b6ae36121123d1167dbb43a9c63b30283

SHA512
6f4287c67c455ad07ead1d099648e688571c5b9523eee807048d09b048ace6fa36c6c8ffae08089067475d810671bde3ab3575db3a81899668946feac29c5655

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d8979a6e6d6e40a9827b387fa5741f34

SHA1
a5dc50100d6a0c513e3be392ab0598b4f51b038c

SHA256
6c59a1b0441fbcf0cc25802228d95e37e0c709944e35a879630c0d1be3752526

SHA512
b4d903322b28a505696434cd32f11a3a6a8d118aae07028e1df16d7e00e14b32e2528b448631ce0152158cfc4c975a4dada6b4f2ec9006add624918322642ddf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9ac7baceb0f15dc9dbfea76e4849f444

SHA1
0877f47a689ab59477d55f5720ba831ddbee91ab

SHA256
f81038e943929f656a4b011d7fabd3ff83ee5aa16017370099e6fbfdb495e61d

SHA512
b6e2be6a18471dc747b29f499126be876c80c74183732900ccd448dfde2972b27a37362208edccdb7f400b9ae8112b79c55f3c21175302d623eef4df347339a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a790cb5ee2f740b8779168ed3fe09add

SHA1
93dbe774ea93d2e4923a51a82d89912192cfa5ab

SHA256
47b8f121c73f8fd78f98c03e6292f296fe4180d945087bfa247599271bf42732

SHA512
aa67a3a1813fb87c1218251f964f7bb81dca658b13c0bf604cd463edc256f7c3b288958c4c1dfa35b4dae987fcc60acd0c76b2c91ba2ca411310df64c91339f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
5e6481f2f62b535e38f608ea88c22248

SHA1
888d36dfa521d648c703ac3cb071f72b52f2c017

SHA256
2479cb017300922410bc48b06cbfd3dad3bc5c03c2d07efd071de1c6c1cd61b3

SHA512
34d247153ae666a6aada85d789257552a67be38f253a0cda7b73bd4be9abb38e0e561cbd5633883c4a61dd1415f943399fe5040c98deafac9b85fcfea1967d50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c5b065f97e97eff5a567a2b98aa8d6ce

SHA1
f00ad43781f291de44a8846164f82b7d8e07edd9

SHA256
757e18416f53eda27953334d8281a0e528847fd4e552f17fad9a585ce8552810

SHA512
a637be0933b51afa22dd9f51793a6686e02041054fd05c2db92321a097a160ed5ab56f5ec441cbf684461960349b209712ba883c8d4f94885a9948e84389aabf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
5facbcf5400daf4510953e79ac521332

SHA1
e866d852950725374d607259520c4ad202c2f2ba

SHA256
9452744b4b145be9cc4e1e424f38d220d3ffc3bd7c615bb58558d89b68c03dd4

SHA512
baf7ca380ddad4bcff20efdef480b3c8676effc3d0e2a1278a6672bb0d5e445dec68f2c19de0a48a2b363bc0704beaea9be433335a4ee333b29ad60ef2f876b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e966.TMP

Filesize
538B

MD5
92113f4b51e9f5ca1deb2997d27ecf7e

SHA1
3442373ca0d2f07677ed641e85487841dc2b962d

SHA256
043fff76e04a8a54ec662aa36ec2b9b44b7fc33737d8ba659f047d54e9d81277

SHA512
43d676a0a78d3c981a343d6223fe7af388951b2cd8f131fd7daefa6231caa4668cb9ce51c6c0c5f6d3186035f99c7ca299b70f31929c703aa96bf8083d761dec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0ee4933274def04b9cd5adc772a2c6a9

SHA1
a37639139d838cb3876fe22f074f8ec2300a8154

SHA256
c717cf51d24fd44d9fa38f9d67bfb7ffa7828ec22a893f3f83e0ca1a50d0db3f

SHA512
bd99d8b945ac83ecb4b3aa061b2f5dd254846c3cba80ff07769374659911ebae5755defee7cde9b774daae8168b07a675ff54f9dd285811a97d7344b09a7f870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c7e8f64fde5f61f9935526f0b0a45431

SHA1
4d65721d2c28c08d672f433e1902f14f2338ff00

SHA256
636a6af3fec8609cd49eebc1f92c1920b15d88e7b594ee52faae0628875b4192

SHA512
c868db5bb69cb18f500d489a6b986397cb8e32f41c6f39d29b17f646196fd831827d4710d4042800bcdae1676b7c91c71f66341c0d26d611162ced2d79952d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1124b5f75464f17a4692893fd436dcf1

SHA1
53ef8360aee83b8b92a1f92bcaeba08be8f1419f

SHA256
03311bb012a583a17f919577bd3ee9a1889adc1bb4fff5bd474c8ca2e86707ba

SHA512
e13425f961b655b3ee05e13fd88801edf48a68e33281a19ba3784a4edbac21b4e9b4aa2a535ebf659c78446641f3a23c0c668bb6865ee4b8c8e62fef9099be0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d6bbdf08276438d8553c6e151db0f447

SHA1
9f57f7eee7612041bea6d9bf68c61dd66b56877b

SHA256
e8da04e4f9869ab4793f9cfad00587b8858880d17627a129c1e95911a9858618

SHA512
eb32830d0c13d3a117b0a5f73ebc88ed156c65c423141d3ce110556fb311a21f75b694a1578040faef35962b567df83411943251c888205ddaf5ff4913a7d48e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a266edd89d41b8bbbdeecfbcacbcb0a5

SHA1
03d345d187bdd1209903b2bde668eea30a076327

SHA256
a26f13291bd9540ae3dee5aef212278c0f7b8048f12f710eb706b253134d987c

SHA512
37beda269e4df72bb442d381d7ca8293f55aad35bc8bda0f198410cb1f89be3ba1969a49d59373a18c00a07a389c54fc288606b7e1cecae3c5605c4d34e63329

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
8d80b9f0daf1c39b854dd40f030fd127

SHA1
4d3da9dbd43bc83e98c01c8f6159dfee6dfd63de

SHA256
593a7c7bd43597dfdbc4354d026dbf82f4ab9b673682586b2319a22c37a404b6

SHA512
65cee0e682b6532d49a216484fc3e5ecc710c8202d698943ad882caeb219b80d2602ef0087fe554b8db624b075252065e5fd384979a5973453cba8a11958e3b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\EmieSiteList\container.dat.fun

Filesize
16B

MD5
8ebcc5ca5ac09a09376801ecdd6f3792

SHA1
81187142b138e0245d5d0bc511f7c46c30df3e14

SHA256
619e246fc0ac11320ff9e322a979948d949494b0c18217f4d794e1b398818880

SHA512
cec50bfc6ad2f57f16da99459f40f2d424c6d5691685fa1053284f46c8c8c8a975d7bcb1f3521c4f3fbdc310cf4714e29404aa23be6021e2e267c97b090dc650

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.fun

Filesize
8KB

MD5
f22599af9343cac74a6c5412104d748c

SHA1
e2ac4c57fa38f9d99f3d38c2f6582b4334331df5

SHA256
36537e56d60910ab6aa548e64ca4adafdcabde9d60739013993e12ba061dfd65

SHA512
5c8afc025e1d8342d93b7842dc7ef22eca61085857a80a08ba9b3f156ee3b814606bb32bc244bd525a7913e7915bdf3a86771d39577f4a1176ade04dc381c6d4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{6f9e445e-10de-4ee8-a189-ca8b5372fa7e}\0.1.filtertrie.intermediate.txt.fun

Filesize
16B

MD5
1fd532d45d20d5c86da0196e1af3f59a

SHA1
34adcab9d06e04ea6771fa6c9612b445fe261fab

SHA256
dae6420ea1d7dbe55ab9d32b04270a2b7092a9b6645ed4e87ad2c2da5fdd6bae

SHA512
f778cd0256eda2c1d8724a46f82e18ab760221181f75649e49dd32e9a2558bec0e9c52c5306ad17b18ab60395d83c438742103fe9adddf808e40c3d8384ea0b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{6f9e445e-10de-4ee8-a189-ca8b5372fa7e}\0.2.filtertrie.intermediate.txt.fun

Filesize
16B

MD5
f405f596786198c6260d9c5c2b057999

SHA1
f8f3345eb5abc30606964a460d8eef43d3304076

SHA256
58e3090edb9316d9141065ac654a08169f2833091e6eb3a53b5a774a61b7e30a

SHA512
a0b3573dae218ade265709a6fdee5f7700c9754eb10747de5af34af340ae95909d0a8902159a735e82eb5d7091f50a7997113661a7ec3fcc2b408fb6c78a4c39

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534368390558335.txt.fun

Filesize
77KB

MD5
361e78cd6ff4f55ec4a3e5f6e2547cb0

SHA1
a5d0a500659b248adf3f62d53e4fdea20e89136a

SHA256
aed5a69dbd47a0826c707bd0e976e885f75904b6888328aa9613d8b239b409f3

SHA512
734ee8ea5395b9bf1996a1cccb4e9c89c88ee4ee7c96089d315dc518eebf6585402032a72171c2c71734f2857d990cdc9662e8a9d56b320441a93438bb847f56

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534370011333363.txt.fun

Filesize
47KB

MD5
2127f812e3d73b06efd875d1d9b6b8ab

SHA1
49f42176267c5bdd4d2d0800612fd7bb0d48bb9a

SHA256
88a4f6754ce1cbab34bcd3c1f37c0561f6ad98309e934c25be3e25b5207accff

SHA512
d0b08c5fcd39bea659e22f6efac10069148931021ac78397f902758d8578bb8e2e874e1baf18539bf6e339c9b186b06dc956d8cea8d3100b24e09f21fd62e31d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534376866592134.txt.fun

Filesize
66KB

MD5
26cb9d1899685fb9fbac6621b8c5e903

SHA1
1bcff3250ce72630b15328096d62be381b99e2ab

SHA256
74c9b18a34d84a79daeea8ab09e47f10721bf2bd2d9c0a423bb9ded9bc6c04f0

SHA512
4574237c82f9464c108a204af1d3966d7db99ff6605988235d34a291ca17fc2b90bf3371d08d289b377ccaffb0a0e110552f1fe32add45a5b45970dbf83ecd8c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534392328153072.txt.fun

Filesize
74KB

MD5
ba6a265766dc1582681b211120e2b838

SHA1
9a523a73e9199d8d75e87fbae8ada8c0636fa6b6

SHA256
d06b633a705801fb5723f077db5c87c9ec677e25cb4b50e84007b17b03cf32c1

SHA512
ea5743d7ba47c367557c717cbf1b414b0807ee35e4d89b7969d6619ed71e546e31314c1474e599d9c31ce53d259109939c41b785584348b62f56551450adb0fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\.ses

Filesize
53B

MD5
0366976ae94555136cade1d996a4f687

SHA1
716efe2acf90646b31ab055ef162c378f532cd14

SHA256
60f12ae4c622ad3626250b6d818731af44825d3097b0d942e1c59adc870b45c9

SHA512
ee465d68b336b5695a1d01f107bfbd2d513784103d9ce78d8a2dee10f29f32bd280d29d2b655e1edddf64df8ee02abce10b32fbf83fe756fe136d8e0bd5f40de

Download Submit
C:\Users\Admin\Downloads\Ransomware.Jigsaw.zip

Filesize
239KB

MD5
3ad6374a3558149d09d74e6af72344e3

SHA1
e7be9f22578027fc0b6ddb94c09b245ee8ce1620

SHA256
86a391fe7a237f4f17846c53d71e45820411d1a9a6e0c16f22a11ebc491ff9ff

SHA512
21c21b36be200a195bfa648e228c64e52262b06d19d294446b8a544ff1d81f81eb2af74ddbdebc59915168db5dba76d0f0585e83471801d9ee37e59af0620720

Download Submit
memory/4736-1669-0x000000001B2B0000-0x000000001B34C000-memory.dmp

Filesize
624KB

Download
memory/4736-1666-0x00007FFDADEE0000-0x00007FFDAE881000-memory.dmp

Filesize
9.6MB

Download
memory/4736-1664-0x00007FFDADEE0000-0x00007FFDAE881000-memory.dmp

Filesize
9.6MB

Download
memory/4736-1683-0x00007FFDADEE0000-0x00007FFDAE881000-memory.dmp

Filesize
9.6MB

Download
memory/4736-1668-0x000000001B960000-0x000000001BE2E000-memory.dmp

Filesize
4.8MB

Download
memory/4736-1665-0x0000000000CE0000-0x0000000000CF0000-memory.dmp

Filesize
64KB

Download
memory/4736-1667-0x00000000009D0000-0x0000000000A08000-memory.dmp

Filesize
224KB

Download
memory/5060-1687-0x00000000008F0000-0x00000000008F8000-memory.dmp

Filesize
32KB

Download
memory/5060-5700-0x0000000000A50000-0x0000000000A60000-memory.dmp

Filesize
64KB

Download
memory/5060-1684-0x00007FFDADEE0000-0x00007FFDAE881000-memory.dmp

Filesize
9.6MB

Download
memory/5060-1922-0x00007FFDADEE0000-0x00007FFDAE881000-memory.dmp

Filesize
9.6MB

Download
memory/5060-1923-0x0000000000A50000-0x0000000000A60000-memory.dmp

Filesize
64KB

Download
memory/5060-5892-0x0000000000A50000-0x0000000000A60000-memory.dmp

Filesize
64KB

Download
memory/5060-5893-0x0000000000A50000-0x0000000000A60000-memory.dmp

Filesize
64KB

Download
memory/5060-5696-0x0000000000A50000-0x0000000000A60000-memory.dmp

Filesize
64KB

Download
memory/5060-5912-0x0000000000A50000-0x0000000000A60000-memory.dmp

Filesize
64KB

Download
memory/5060-1686-0x00007FFDADEE0000-0x00007FFDAE881000-memory.dmp

Filesize
9.6MB

Download
memory/5060-5935-0x000000001BD50000-0x000000001BDC2000-memory.dmp

Filesize
456KB

Download
memory/5060-1924-0x00007FFDADEE0000-0x00007FFDAE881000-memory.dmp

Filesize
9.6MB

Download
memory/5060-1685-0x0000000000A50000-0x0000000000A60000-memory.dmp

Filesize
64KB

Download