jigsaw | a375201f22b6e71d8ea0f81266242e4638e1754aeee14059e9c5e39026d6c710

Analysis

max time kernel
130s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirusShare_3bee1d24189d4941f68b96da6e207be4.exe
Size 436KB
Sample240607-xprt7sdb78
SHA256 a375201f22b6e71d8ea0f81266242e4638e1754aeee14059e9c5e39026d6c710
MD5 3bee1d24189d4941f68b96da6e207be4
SHA1 dce911b1c05da965c8733935723b88bc29d12756
SHA512 a40b01c630ff2c4b90a2e1bbf285c5d558193ee0fba79a3210a56408087ca828292269945e3202f65b8eb038a565b1ea8a18d185864ba9dc4073a3633c86ca29
SSDEEP 12288:5l9mnmYK1bcy9oNm3/oK14MfZGLBddXLA:cqzONmQrBM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

jigsaw persistence ransomware spyware stealer

Malware Config

Signatures

Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
ransomware jigsaw
Renames multiple (3764) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	VirusShare_3bee1d24189d4941f68b96da6e207be4.exe

Executes dropped EXE 1 IoCs

pid	Process
4844	drpbx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe"	VirusShare_3bee1d24189d4941f68b96da6e207be4.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-60_contrast-white.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\check-mark-2x.png.gws	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\1.jpg	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-100_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\StoreLogo\PaintApplist.scale-100.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\ui-strings.js.gws	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\uk-ua\ui-strings.js.gws	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\IC_WelcomeBanner.scale-150.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ArchiveToastQuickAction.scale-80.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_organize_18.svg.gws	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\66.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\FileAssociation\FileAssociation.targetsize-64.png	drpbx.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoDev.png.gws	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\ui-strings.js.gws	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\Square71x71Logo.scale-200.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-30_altform-unplated_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\nav_icons_myGames.targetsize-48.png	drpbx.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.gws	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeWideTile.scale-100_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TimerMedTile.contrast-black_scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeMediumTile.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-36_altform-unplated_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\ui-strings.js	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Protocol.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-32_altform-unplated.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-si\ui-strings.js	drpbx.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.gws	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_download_audit_report_18.svg.gws	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-40.png	drpbx.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.gws	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-36_altform-lightunplated.png	drpbx.exe
File created	C:\Program Files\Microsoft Office\root\vreg\dcf.x-none.msi.16.x-none.vreg.dat.gws	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\ui-strings.js	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sv-se\ui-strings.js.gws	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png.gws	drpbx.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml.gws	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteMediumTile.scale-200.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.scale-150.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\MedTile.scale-100.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\ui-strings.js	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-200.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionWideTile.scale-150.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Doughboy.scale-250.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-32_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\vi-VN\View3d\3DViewerProductDescription-universal.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-64_altform-unplated_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\RunningLate.scale-80.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\ui-strings.js.gws	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\ui-strings.js	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72.png	drpbx.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\index.html.gws	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\Doughboy.scale-100.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_backarrow_default.svg	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\ui-strings.js	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-il\ui-strings.js.gws	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-72_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_PigEar.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-200_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\shaded.dotx	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubAppList.scale-125_contrast-black.png	drpbx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 4844	1584	VirusShare_3bee1d24189d4941f68b96da6e207be4.exe	83
PID 1584 wrote to memory of 4844	1584	VirusShare_3bee1d24189d4941f68b96da6e207be4.exe	83

C:\Users\Admin\AppData\Local\Temp\VirusShare_3bee1d24189d4941f68b96da6e207be4.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_3bee1d24189d4941f68b96da6e207be4.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
  "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\VirusShare_3bee1d24189d4941f68b96da6e207be4.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

s_remove_18.svg.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.gws
Size 720B
SHA256 7deeb653bfe38b620d6fc6ca0fbdc4574f2a037ab7068f185d92d9b730f2f031
MD5 9195babb88903ec828fafe337b76d0f2
SHA1 e0e39add32fb44fc9bd3cf4b4a3ac4638a7339de
SHA512 0fd753ebad66626ff28eb2d948aa5d3162da26071c5b90cc460c7d4e1cabd0263108b4bf65007c43a7b005809b15a79dd9186c7def9921bcc67c9fea41ae8f26
MD5 SHA1 SHA512

Submit Download

icons.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png.gws
Size 7KB
SHA256 dea0b77cb4040e8bedce0b979dfa1a1e8fc5062d699961c78be9b51a293e79c8
MD5 2e258399eb4eb1a929c90bf2e3e90259
SHA1 90e9186422f3eacb47066431f233182becb663d6
SHA512 64270a446608e86361a1b3d3998c6e17f18a3d90614f11608c04462e601ce0dcb18687ea63dcf9419a674bfc8397dc069b38549bb2b3cabd2dbbbf47d3ea8779
SSDEEP 192:0HiWHwQy/MAxTg+tQLJ21ppPAgA0rQRJC8zBbOS:0HiWQZhg+tQLJ2Haoe0iBiS
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_ie8.gif.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_ie8.gif.gws
Size 7KB
SHA256 afc755d89dbc70dc27eeb13ab80ff4ee7009c0135885864ffabd107e0318f56f
MD5 b302ff685a7fbe2d5fa113ea3c4887ba
SHA1 ad401e158a4a13980b95d6af041f93832f9d4694
SHA512 a9966f7afc89585dacff48b1f58b66f2a1c490cf620dad87d0100cd60fcb40cf73ce70daa311e8bd97f4cf18646b6242ba0994e661ded3a48d4dd29ae1897cb3
SSDEEP 192:C4hRHrEUxKklq6Ae2lAubr1z8wUHEKPkk6GL0LsdnMmo8oniL+iCtRw:CeTxKkMVe2PbZz8hHz8a0oJNTsiL+nfw
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_retina.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_retina.png.gws
Size 15KB
SHA256 df4236744db8166320d833091b964e8db7dff969c31c38d8b070848161c90358
MD5 0e8b8abfd04a1668040d20e24dc9c51c
SHA1 f1ccc10cb526227dbc8bdf081c73460ead02243d
SHA512 1399afd668efe263462cc88072dfb128730eeac253635af6561efb46df8f97e557727b6c826dde39215a7430d7fbe15405f0a8b4a5a2273e4166f23d89884a3d
SSDEEP 192:74an25FVCVeVQVoyqwX5XnUYLZZeD77l/tYyXwWHT0ACxwhq/P4DFdJfe4Mq1vc8:32fVCVeVGoy9v077jGxgA4x3fv1vBiw
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png.gws
Size 8KB
SHA256 d116262eae4db29fee337dd8888e0ab5bd54cd5080bd6e1b78653546926376d3
MD5 6461793e4d9ce8147f404890cb75f69b
SHA1 b7db8d5a202340af9e988c81e2cdc6f34d286e94
SHA512 88bbff83a9331017b624e74a66daac47981e96aa12fc86793a514e0d1495f4965720e8443532959ea95ad04dcf9055ca4d3ad759d1c41bcd62071ac644f4c1ed
SSDEEP 192:dQi723+u5z1mJJxe6A0+F5lFmmPImckkCZ8VOOa:dQg2uuiheC+F5lFGmcWeAJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons_retina.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons_retina.png.gws
Size 17KB
SHA256 31b9d9de8dd7fb2d594f6576cb1acbf14b5a977858f22765d7b4d88be6bd4a2c
MD5 b3cf517679639deb3c21ff8fd2d2c6bc
SHA1 6ca03f7cb27bcee1b950953294b72f159fbe9a2e
SHA512 e812fcaa58f7aada8444dac583c09cd399921a2d0cd1852af16ae01d19539949f2a382f1f4f1427d656e73aa141106a54f4f66b5221f0535f20863e2dc9a27de
SSDEEP 384:ICT5sumv2JOdkxSUZvniWeqxQsY9dHwDM5hR7diZQ3i2GHqlGXek:ICT5sunOd1URnUsY9tsMBA2jIqlGX5
MD5 SHA1 SHA512 SSDEEP

Submit Download

rhp_world_icon.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.gws
Size 448B
SHA256 5edf5ddf0e1014223ffcb1c59c92df6b8141b67e47d91cf246ca4a95f94dee6a
MD5 22248b1821cf5dbe8c49c0cc98d1341d
SHA1 cb2c50d0a6c9a9b310f729fbeab62b6f281f4244
SHA512 02c23004cd3c84ad08ed2516586c752a0a5bfe1c67efd7308b6b8c6d9fc199b1600d893b927ee6a3f9d833de1ddadfeadabcd4de5f2bbd64aad98f838288944a
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.gws
Size 624B
SHA256 99dbfd770693af4b6abad1d2ccbfb05b16df49a9f208d68f7ae7e1f6ecc88946
MD5 62a95a98a94edf4ad7b9d0bcd0ff7259
SHA1 e83683f0f49b6b274aff6d73c1447daa937135b7
SHA512 9ea6c8452028ab929b2e614cd7bb48e70fd493a114065fdc8a9d5aca91c8f923bbd440765cc17f7ea346c627342b2fe411b4aa7f7aaa20bf26055641cce321ec
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.gws
Size 400B
SHA256 c6ebf7bae976762bea7d3bfcc0b5c4edb5cd3edf274aa769b571376816baf08d
MD5 62bc1d19fcda5c6662f9243c113ad342
SHA1 d07e29f8bc79b97b88348080ef97a46bd2cba354
SHA512 16b083eb6447db1f55ce978eb2e6e561e7fcf8b2ec6eddc13b2f77127961cdfdc7e057fe2deee9fd48ecaddc33e7fe3a8be5e2b923a0c8e8d6799cde885980f2
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.gws
Size 560B
SHA256 914f07c24cd5d64559c04ea01bb1167ac6d676f002de57ea1c6bb74ed35e80f3
MD5 0b321dd2b5189902c72e6bc9f52ebf6f
SHA1 35b51e0af30cbe53e3549052d72c0a0e53c7ed11
SHA512 f7bd79e2ebb0c75a89778a712d01c044e66e0cb1ef448e22357429d60f9b8a88d133fea275a4064c525dffc7f036d0fcf4e73d5a39e1bf91160f665b43833cf3
MD5 SHA1 SHA512

Submit Download

rhp_world_icon.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.gws
Size 400B
SHA256 f3f5d4df195d8aacd187e73c3462923d539de1aa2b340c76acc48285389ffc84
MD5 d8ba28a1a8f4e3d61ca028274823aed8
SHA1 5b89830cb539349de30354c7fc2c940f184fa24e
SHA512 26cdd584a2054209aa3c6632f0e13a838f99448c299ff1028b08392f817be2cb536c4b1383c6784e0072227ab9d67421ae42ee7f3aa2ffaf1f58b981387144b7
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.gws
Size 560B
SHA256 61ba3593b4e99ca4264d61520af7043fd306d90789757dcb1cd13dc134ec419f
MD5 5cb13824a91c20fe5a896db95ad0db3d
SHA1 8308c3774c94c10697f97ebe1bbd69b89de6e03c
SHA512 8743927af311913a89a0247ec9e9b1ee2fb2dca43484ae7a12c5cc0bf36ffc953ee3189687e5dc915fcabb5744d5db31d58b1a09a028d61fe5f74767180dd89c
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.gws
Size 400B
SHA256 3aeb5965e29e9c4b7c707f4df94314fc679d750d834e2668b755ffc4a0e534c0
MD5 76a0cae76df925d676aa0a66edb49d41
SHA1 24f80cf554a6bf04cf122f363721ccd163665244
SHA512 02a35bd3770d1b65eeb77ce37f313d454e4cc47273b69e8a5e5443c5ca10ab3f4e97188a99111b23a76c2eb9a0452f5cd0e86df99a093a7d89b0f5d0f940f122
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.gws
Size 560B
SHA256 75ca63c5a1f618d7a6ce1adcb50515188e4be822189ffd7a8a7b776db4c6397f
MD5 13236effc7ba5c135e80417317c47a24
SHA1 a3c54d456f6d895fc8cfa6701235b873aaeca845
SHA512 56fe2c7a78b79a07ca15ef791fcc6861eb0d47033740286786498705504f16a170a3be5154a43b2e603dc9b1700826588ef5e023a27be90d2d9b50832f91699a
MD5 SHA1 SHA512

Submit Download

example_icons.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons.png.gws
Size 688B
SHA256 176f86db5673cdb183673e78653793af1cb9f045355f741d3ecaefc8e1a46425
MD5 48427442e0177f8cdaf8d1e9ddfb21f6
SHA1 78c02b52a6d0d668d2bfd1e8a479ff43e66c0713
SHA512 90ae974e8860fe20db37771a2e4cdbada4160bd759b0ebca058b5669e4299614487fc88acf2e46649590b857e8a47efe806f96e83c9e7b3ef66be730b017487e
MD5 SHA1 SHA512

Submit Download

example_icons2x.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons2x.png.gws
Size 1KB
SHA256 1c5547c483a251bc3a89ab4cc3c9dba027e9d9372d5e8115a948015c4efac10c
MD5 7e285d75b28652fdf6b881c072d6b89d
SHA1 fe9acebb06aeeb7e98d1974c4198df592104ac17
SHA512 df5e1638d9acc9ca5cb125b067b35c6a73d0593de12bee5bf75eeb11242f6216ba5ad2e0601678ddd9d14231d4b7d2ccb2abef7b5a6c1c40f35515f13256f733
MD5 SHA1 SHA512

Submit Download

bg_pattern_RHP.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png.gws
Size 192B
SHA256 2dad421ee2f1ae878de8e09287e1074a50ddd9143d86f04a1ec640bee5363e58
MD5 e8562f0ca25ac1b165e9061176f3a9fd
SHA1 b4fcf4b0244720b5bd441c5e6b5fd9982d5cdb65
SHA512 1333ad5c91b27bbfa00199c16610be604c0600a3afa1babff8933e00e88d07c340dbdb1659144bd2ab1566afe33dfdbedede59b17121fb495abbe1a72c9d0ab5
MD5 SHA1 SHA512

Submit Download

bg_patterns_header.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png.gws
Size 704B
SHA256 7468618a4d4263671c03e6517d492b7692d37664e5f3bb00feccd827d33bbb4e
MD5 5565bc8bc1ab266bb7d5eae4a73ceef4
SHA1 afafa00b294b5d77fc529b51661d0ded91ceba2f
SHA512 299e961e147a93636b8308c2b38f2f6ff87f98c70a906a74ec5726c6468528393c91ad465ffbf817b4f716908c4c60345f5e7464ceecdbe506b836d494b28024
MD5 SHA1 SHA512

Submit Download

illustrations.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png.gws
Size 8KB
SHA256 97521de7a9139433f8ee9ed7548fe1a37772ab983982c065bffb9d4b56064d9c
MD5 bde7908ce88d492fb59d3c3bda22e4f2
SHA1 0b3712d8311402d90c716690696b311bcfbc8e03
SHA512 9c2a455e544634a0a77ac55a5ac35e5fccc70092e5e813dafb8b88f5b6b00e2369a546a288616d5372e1a6a3face0e53d4ac80a462fa6f23ca282ad15999ddac
SSDEEP 192:H7vnLNjN/OyKHntoB2Yc2qUctgnvK1p/DxQ7XFcg:bvLNjN2ylBWdUcEvIp/upcg
MD5 SHA1 SHA512 SSDEEP

Submit Download

illustrations_retina.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png.gws
Size 19KB
SHA256 db7409ddb4e3d494a5885628cfa0ed5f827b0b591b527ba22d4da828d03bb3b0
MD5 011c5d91fb53cedaa1549c56cec838de
SHA1 36338d82eed00905ce689945fe8c8f04ccf437b0
SHA512 c9f4c26930df21497df3aff3bf8495989bb439e04c98e5ee9becd8107a6a498c1101016be13ffec7a1e4e41d7bd559cfb0fb83e23ac6132d6e27bd89b98cd5f3
SSDEEP 384:Dld+IHz4rWzwi3Wp5pqFqfBmlTXO6ugXWA1R96ONBed3w2T:LlB3WDpqs5mlTXOiXL1R0twk
MD5 SHA1 SHA512 SSDEEP

Submit Download

ui-strings.js.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.gws
Size 832B
SHA256 cb5ae253bd31d0bc80a494049627347dfae43be10f0ce03787d36d07b3a88b13
MD5 5db32fe374f7ce1e7ff5bd66941f6694
SHA1 512353068c8ab1fbd99dc0b1344df2133ca4f064
SHA512 532d788a2dd32e106aabd8104204972c1f60f1edbe8c74de3a7d219fc82d00bde43ea212e749eb858408db028c9387f6863c84e83b3245966ac6e35e52e82117
MD5 SHA1 SHA512

Submit Download

ui-strings.js.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.gws
Size 1KB
SHA256 cf28f076254df0547a0c57f56720d7dd0a6777459245e9250e7f737b8b67566e
MD5 3b3f035afc1a1134b77e5440a3d90de4
SHA1 99695d2bd5e5b641325ea6d3fd8ed9607f0fe79a
SHA512 6936e4edc53afe1c5c73cba5fc2c16ea53d611685b26beffa894c109085ac8b9468dd8cda647d655053402415bbf5a7fe8db76931100bd4e42aaa1cc46fbe273
MD5 SHA1 SHA512

Submit Download

ui-strings.js.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.gws
Size 1KB
SHA256 bfb856384d589ce55f860463d822e40ea9c09e1c26acd45473ef7b5abbdb6f72
MD5 aafaf4da622af921e65db18aff47b94e
SHA1 a2ddec0206196c9f10bee3c0e8cba2630986cfc7
SHA512 c3f3ceca051a3599168b6b65d7624fa6089a3aaaab097787754b40fd4fb11494c5b9663c84d2ca519856203bf045e08ff19f3237132a253451ae4df337a559be
MD5 SHA1 SHA512

Submit Download

bun.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.gws
Size 2KB
SHA256 8c01439e436fbfdfc1ace7426dc41fd16107f41d788c41c22c1e87d51b89f6d5
MD5 47471ed13f58e0c7fd240c0b8a26db6f
SHA1 bfd84b3bf8078a1e4c11520f7de3b91bcaa30eec
SHA512 1456e7c0aed0c585786fedd961fb76c36f7614a661390e514c99106379ecc47c8504b603be33d66d4f7245e1f1786de4549f8000fb17fcea8227ecb262b63532
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.gws
Size 2KB
SHA256 b91ec2edcdb6bf6f110b66667497fa2c1a4146014acbb8e148f0fc22bffa9f54
MD5 dc8504577cfd34a04d2330919131de61
SHA1 0fa4d4d0e17492a11a8fab720fcac79c95b9c7d1
SHA512 59455d1d395c6b14c15a99256cd6931ed43d381f390769e6ccbbbf9d0579b1c7765b32645e4d8e642cff4f747c37581e5b59ce35c7d7d4e54942a02880be45a6
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview2x.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.gws
Size 4KB
SHA256 b674ac346d9812a166f1ece75744c02c1d9c77495413d75d15b3874f4a1a90ad
MD5 6e6016bc84deba55074da787c9d84427
SHA1 00954733451fba0c6214b7915d5463ee5c22be2c
SHA512 0a15ac8a0b54a44b022c0a6e5e72bb75b38caa865987a0b903a874df2c05f3c5bbc0edfee46f642191a55de0c540eb52a23d9da1cf10e80069c6be242b13c3c3
SSDEEP 96:yNUe7ezR4q+3T76IKe4wVS6uHR9m9sqJV4qFHrBy8Z72KyC:yUewcD2lyS6ux9gJnFs8ZyC
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_arrow_small.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.gws
Size 304B
SHA256 9fca2c44154dcd3163f34f9e3cb65ce79eae9319fc027d022beabf075d1fd5f8
MD5 28acecd51ca758dfe88cd646b12e93fb
SHA1 95343fd5639cbc36e46781a58f5e81c43661fc9b
SHA512 a1803b49358c2547295782683c1cb4d5352d356cabf83857b0f86d7872a4403ad3bb1ee1d4584708336634a26e5252b38d446bbc78a4a351867228c4ef0acbf9
MD5 SHA1 SHA512

Submit Download

dd_arrow_small2x.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.gws
Size 400B
SHA256 fa48c4dc49de8be4f7b935ae9ed31eacf07af890430a2598e13ac2dae5c06ae0
MD5 e38b4af75143cf8788410ccb04d5b729
SHA1 215bf41e75ff8afc7d48f2193e087b5bfe305411
SHA512 ecdbd98f15f446c0e5cfa3c6718459c1df9b075c6f987ce278d0a17028e549096d7fad53bbf2da4e9c68750aec6be4c1229ceed6c281ce28d4c2c0ca0d393b6c
MD5 SHA1 SHA512

Submit Download

nub.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.gws
Size 1008B
SHA256 34acd0127e4229f709236a7f97641ec46f3984fa3b83adabb01534f5e9049366
MD5 e399a057a31531a39bd6a4ffedf4977a
SHA1 d0cb7011364cbece4d61f7a775a302d92569815f
SHA512 b0be132e28bdd45e9ab1150fe0551eff52f2315c353bce31afe89993212732c993f22887a50ef9b9c36f752ff488a594fba14489b070d03bd336d7b638376038
MD5 SHA1 SHA512

Submit Download

share_icons.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.gws
Size 1KB
SHA256 dc1945093eda6a7b0ddb12b22e0e1237c2f707a04370f52cf419bf648d1d98be
MD5 dc5f49c3c6ae80a8dd9d0543b7aecf6e
SHA1 fdd5d859c980dccf41a5af18b4761a585d5eecbb
SHA512 2cc57851ca05f35d9073d1cf70622aea0f6b917321b7312d0fb670b48e9e04ba6d70d748e4ac132c9e80674047ab7ab9b1a8cd07d12d171041b4fdb015b5f537
MD5 SHA1 SHA512

Submit Download

share_icons2x.png.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.gws
Size 2KB
SHA256 1441606a323724753c6edfbda12eca06bb26042c1e2b9ad5bb1ed21b5246c29f
MD5 300eee88fe682535cca98094250f4696
SHA1 8b545844de4afd84082da0615fc6647e7731ad9d
SHA512 307e1537429d85895d8d86e606ad227bc44d7d3f4742b36b66c9d97f4492c5a56d9e13eb1433d5f06a108160f4fa03b5db5a8a1231cc817e9c2af14faddcffc2
MD5 SHA1 SHA512

Submit Download

ui-strings.js.gws

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.gws
Size 848B
SHA256 6029aaed6b91cbb63ec0bed01bddd5288b53a1271bd3327c1005f96a62b9ee54
MD5 15bf1ecfe6789eaa851d0f1abb7398b0
SHA1 797715eafb8dfd2af57a9d078422525daaa83085
SHA512 0211838b895defa302aa206803e0df8811ea243053cd671129e5000d81de5700759f72c095a6f0e7bb09894a06b0e8f76df2214bd12d87190c14372148d41ccd
MD5 SHA1 SHA512

Submit Download

DisplayLanguageNames.en_US_POSIX.txt.gws

Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.gws
Size 32KB
SHA256 2602bd92230180ce6746824e1c0e2266b1ed1643e6cbed712e23af1c88f5b811
MD5 ad8a20c3354cc9e1e977e15465823344
SHA1 ebccef3db400c7cef2996b3657f349a381cd807a
SHA512 950f82cc355f6bbf01e581af6627d3dab31cb893fb9a036e0a7c8d0c3f097ba47ceef5b12be915d7164b69c5b1f2e1c52dfd6bb1304ec8eee33dd6b28a9eb62c
SSDEEP 768:/gajEuQF2OYaf1cRhp5vHQ+loEPWuNuA1HXkOIe:/gajEnXjfap5w4ocWR89
MD5 SHA1 SHA512 SSDEEP

Submit Download

invalid32x32.gif.gws

Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.gws
Size 160B
SHA256 799474c262c09de278cab1562154797551483d7e4cdfad242bdf51df82136e06
MD5 4624905679a8c26eb3cbcf0bea34785e
SHA1 341765659db6ac5dca240a2d559f9767b5ce1252
SHA512 25abe41f1b7e95c1371c59d15c27850a207a6221e77413ae3cef50b4c49cb98174f2c6da57f0be62658a545840ae5b55f80f2d24a54bc183babe408369cbc907
MD5 SHA1 SHA512

Submit Download

drpbx.exe

Path C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
Size 436KB
SHA256 a375201f22b6e71d8ea0f81266242e4638e1754aeee14059e9c5e39026d6c710
MD5 3bee1d24189d4941f68b96da6e207be4
SHA1 dce911b1c05da965c8733935723b88bc29d12756
SHA512 a40b01c630ff2c4b90a2e1bbf285c5d558193ee0fba79a3210a56408087ca828292269945e3202f65b8eb038a565b1ea8a18d185864ba9dc4073a3633c86ca29
SSDEEP 12288:5l9mnmYK1bcy9oNm3/oK14MfZGLBddXLA:cqzONmQrBM
MD5 SHA1 SHA512 SSDEEP

Submit Download

container.dat.gws

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\EmieSiteList\container.dat.gws
Size 16B
SHA256 da1f992586145a03fec57464a38b8bb928cafd8fa9996386732e83a6de555ed7
MD5 c3a747554556df614575dc417c3cf9d9
SHA1 2e71688b2013bc93b1c5c01e5fd902a32a62007e
SHA512 eb740b56bfc85d2c5be11af614cb413a0f0e055d6d2311d4790d86ad71c59a2ec4f13e09d04a180e3279c22ac320cfa38892bd0f6a5e8e04299ed64b2d514c2d
MD5 SHA1 SHA512

Submit Download

settings.dat.gws

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.gws
Size 8KB
SHA256 935fe7ef1e5df94a769e677657e9a910748eba742d0e8fab219ccad10d55d48b
MD5 02bcd4ccce238299d4b7279fabe1078c
SHA1 f086725a337c62e4dff2bd0e33115ad58b7a7df0
SHA512 5b3b1a99b5e8693369e3ed8c4ed7c6f92ed5f470af6163dece4e5c150339efa5afcb1c4124237ba0d115fb0b0274834a9a7ecb5062caf6edc835a88a582ffa3f
SSDEEP 192:YGVNdnmJ7v9kWKyos5AtxVC/uVQnTYKzJe5MaIb/he8256msi4Q4g+:YG0J7v9ktAAc/uCnkQI2ap8Cpf4z
MD5 SHA1 SHA512 SSDEEP

Submit Download

0.1.filtertrie.intermediate.txt.gws

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{5ad19b1b-600e-4a94-9f1d-df48f742e3e2}\0.1.filtertrie.intermediate.txt.gws
Size 16B
SHA256 1b2c165eb9e14a6b184880b765e8c0a7217c95d34772c7e4cf7e72833627ad34
MD5 208da38c14d2967e979f4cda92b451f9
SHA1 07f4c57d3cc75482044886c985a52a928b96266f
SHA512 6405723ac441ddcda39d81c64b2cd12ee6ec65f6e522f77db02d9a9c332ebe61db5422335af83521a2bd7cec468e31ad375b978734b9b8cdc688f690ef52863f
MD5 SHA1 SHA512

Submit Download

0.2.filtertrie.intermediate.txt.gws

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{5ad19b1b-600e-4a94-9f1d-df48f742e3e2}\0.2.filtertrie.intermediate.txt.gws
Size 16B
SHA256 69a1de0369c140ef6f2ecc92b7e000555c3ee25e5e8de574696d4f4edca114d6
MD5 92df3955a31d89c551eccf694988de89
SHA1 ee7273f91878ed7f65aa60cc342a22582d87e07b
SHA512 d38ba0a4fe7e0214c436069f4cb1fe0ac0fa2637963bc51ad9e374321f80910299b9d49675da7dd587c6de89108be4389a4f5668ff243463b54406684334a7c2
MD5 SHA1 SHA512

Submit Download

AppCache133596439083295209.txt.gws

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596439083295209.txt.gws
Size 77KB
SHA256 aa4519811c014a0a7afee4e187c17a7234fd0d565aff7ce231f4736858ae20f8
MD5 91ccec998a1b2e5189229789eb40bd7a
SHA1 a2cf1a33849ac5d384c7ed041cf2e000fb9c8da5
SHA512 547ab8888682e94451e80663e5dd6a7ddf2067bb6f75f78b6f0574dce8d5e9f1d88f70b2eac9fb92a69814a0c4e298ea5062b47e9425944e3480b99d2f45eaac
SSDEEP 1536:g3uQVOTGyroWwgh8fVBAe+WduZL+5KKSYMEY0UZjm:g3uQPyrofg0rAeHmS5KKSxEpUk
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596440479376967.txt.gws

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596440479376967.txt.gws
Size 47KB
SHA256 46c5d2f752618bd310131d552e02ffa8ead20d4d7d071759024822a7452e81f5
MD5 b58787b834dcbc0603fbca76b9226153
SHA1 96666ce41b688453c5ede9557b438b487209b3ab
SHA512 e462c7756a3aacebcdf2ca08a43d0d3d7139909c51617122923ce33598ae9d000cbc6c2040e6af047b2041dfca7d36d6e1bd465e6b1efde2ec16d097ed871ca9
SSDEEP 768:38AdwVI8c0oV3xFaGFsnpBSXS4rYcnk6u6vsM5XKxNvkqmud6Pq82+r+CBYBWX74:r+VIRV3xFgLOk6u6kMkNsq8Pq8J+ykWU
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596447864304096.txt.gws

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596447864304096.txt.gws
Size 66KB
SHA256 c05f03c31da347b15f4258a3fcc6e9d30d33e31a1b3ba9974e76a0f91d6c7e90
MD5 580d4cf26a9b602926714db8c1030ff0
SHA1 698e8a449784c908fec5cffe1a1f759ffa007448
SHA512 88ceaeb53c9eb3ceaf9735384476fd8008837f751bb2dfeba7f93f21a355b4c3bab8fb209e92042227cc86d6d63b3b8e8a493b8ae35cc86e00eaab8108ca4850
SSDEEP 1536:DTlZ+6vuZsoZm/TrI50ZoPM0UO4xn0UvqZnuxted3KRTU0/KJ4Sgy:n708rI50ZoP7U3ywqZ8Ad3EMV
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596487033736795.txt.gws

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596487033736795.txt.gws
Size 75KB
SHA256 9b7413c770caff335423f93fa7bd138597b4a396955492d79fadc5b373e8e98e
MD5 36cceae9dd7121b04cc0db802ea4eac8
SHA1 0ef9632af23d027d399a91518f5b982ba2ffcca0
SHA512 fa1a8d4e31b77018fc531585ddbc3433d194f5bdfa2ab82d46e6f3d5d9077e9066c30518ca1c55e0133ff97edc6c6683d43ed1f2c03308704f786d088072164e
SSDEEP 1536:ezZ5Z8OFGz4zpDTb95fiwBj1AwNId3LgP7iUAMRjCds2sMS:pUd/b95lSw6tg6QirsMS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1584-6-0x00007FFEC4250000-0x00007FFEC4BF1000-memory.dmp

Download

memory/1584-1-0x00007FFEC4250000-0x00007FFEC4BF1000-memory.dmp

Download

memory/1584-0-0x00007FFEC4505000-0x00007FFEC4506000-memory.dmp

Download

memory/1584-18-0x00007FFEC4250000-0x00007FFEC4BF1000-memory.dmp

Download

memory/1584-3-0x000000001C780000-0x000000001C81C000-memory.dmp

Download

memory/1584-2-0x000000001C2B0000-0x000000001C77E000-memory.dmp

Download

memory/4844-259-0x00007FFEC4250000-0x00007FFEC4BF1000-memory.dmp

Download

memory/4844-258-0x00007FFEC4250000-0x00007FFEC4BF1000-memory.dmp

Download

memory/4844-22-0x0000000001780000-0x0000000001788000-memory.dmp

Download

memory/4844-257-0x00007FFEC4250000-0x00007FFEC4BF1000-memory.dmp

Download

memory/4844-19-0x00007FFEC4250000-0x00007FFEC4BF1000-memory.dmp

Download

memory/4844-20-0x00007FFEC4250000-0x00007FFEC4BF1000-memory.dmp

Download

memory/4844-21-0x00007FFEC4250000-0x00007FFEC4BF1000-memory.dmp

Download

memory/4844-3795-0x00007FFEC4250000-0x00007FFEC4BF1000-memory.dmp

Download

memory/4844-3796-0x00007FFEC4250000-0x00007FFEC4BF1000-memory.dmp

Download

memory/4844-3797-0x00007FFEC4250000-0x00007FFEC4BF1000-memory.dmp

Download

memory/4844-3800-0x00007FFEC4250000-0x00007FFEC4BF1000-memory.dmp

Download

memory/4844-3801-0x00007FFEC4250000-0x00007FFEC4BF1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads