jigsaw | 31823040d8ccb20eab0b8653d01af370a6537017e69ead69f6f7b73d6ef7ac14

Analysis

max time kernel
149s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe
Size 2.3MB
Sample240607-xpsrhacb91
SHA256 31823040d8ccb20eab0b8653d01af370a6537017e69ead69f6f7b73d6ef7ac14
MD5 4c153eacdfa8807f1c8fd98e5267da4b
SHA1 ce42e2c694ca4737ae68d3c9e333554c55afee27
SHA512 b2352099a41460c5c210774e5e63f85bd3c8898b58a3348444b35f233fdac50d2cedec68b7695a10109c3493f430c1e85fe039352d66756c5f6f9e9b0793d851
SSDEEP 24576:oF0rCLbf5rqziUnd5l1kqo/wvX0muSOcFjiWrO/iK1ubRM24RWCJG6h/ekExcZ4R:q607QiUnx1k4B9iWrTbi2AhDRek1Z4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

jigsaw persistence ransomware spyware stealer

Malware Config

Signatures

Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
ransomware jigsaw
Renames multiple (3738) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe

Executes dropped EXE 1 IoCs

pid	Process
2172	drpbx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe"	VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	drpbx.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	drpbx.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\sample-thumb.png.kkk	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-48.png	drpbx.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.kkk	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\minimalist.dotx	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-up-pressed.gif	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-40.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MediumTile.scale-200_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\0.jpg	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\faf_icons.png.kkk	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	drpbx.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jsse.jar	drpbx.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity.png.kkk	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_scale-200.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-200.png	drpbx.exe
File created	C:\Program Files\Microsoft Office\root\vreg\office32ww.msi.16.x-none.vreg.dat.kkk	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\Office Word 2003 Look.dotx	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\LargeLogo.scale-100_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionWideTile.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\LargeLogo.scale-100_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_ReptileEye.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.UI\Resources\Images\star_3qtr.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-200.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeMediumTile.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailWideTile.scale-100.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsStoreLogo.scale-200.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\ui-strings.js.kkk	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-24_altform-unplated.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-100_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-400_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeWideTile.scale-400.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\de-de\ui-strings.js.kkk	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.boot.tree.dat	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\WorldClockLargeTile.contrast-white_scale-200.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\192.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_listview.svg.kkk	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSmallTile.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-100_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\FetchingMail.scale-125.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\es-es\ui-strings.js.kkk	drpbx.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfxswt.jar.kkk	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorSplashScreen.contrast-white_scale-200.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\ui-strings.js	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_en_135x40.svg.kkk	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\vi_get.svg	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-gb\ui-strings.js.kkk	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ru-ru\ui-strings.js	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-64_altform-unplated.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarMediumTile.scale-400.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Dark\Moonlight.png	drpbx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jawt.h	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteMediumTile.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-200.png	drpbx.exe
File created	C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.boot.tree.dat.kkk	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60_altform-unplated.png	drpbx.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\manifest.xml.kkk	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\AppxManifest.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_altform-unplated_contrast-black.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filterselected-default_32.svg.kkk	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\s_shared_multi_filetype.svg.kkk	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\selector.js.kkk	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\ui-strings.js	drpbx.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	drpbx.exe
File opened for modification	C:\Windows\assembly	drpbx.exe
File created	C:\Windows\assembly\Desktop.ini	drpbx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3952	VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe
Token: 33	3952	VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe
Token: SeIncBasePriorityPrivilege	3952	VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe
Token: SeDebugPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe
Token: 33	2172	drpbx.exe
Token: SeIncBasePriorityPrivilege	2172	drpbx.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 2172	3952	VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe	81
PID 3952 wrote to memory of 2172	3952	VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe	81

C:\Users\Admin\AppData\Local\Temp\VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
  "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\VirusShare_4c153eacdfa8807f1c8fd98e5267da4b.exe
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

s_remove_18.svg.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.kkk
Size 720B
SHA256 6c51edc47a2807addebaa82a37d7d641068f1f63a31b7b99a4a9dfb8e9800691
MD5 29a408170ffe16e9e29ac5727962195d
SHA1 1c37d8242159d376cbb4821b5db65b9fd182c210
SHA512 a625c6a010dce4ac37ee098e487c4e6634042985b69f7d2f99a38d350684ffe82593d5c3869f2c736821ddeaf04dbcda968674a6132131133fa0e21e5d734f59
MD5 SHA1 SHA512

Submit Download

icons.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png.kkk
Size 7KB
SHA256 cb52aae0724d4e958b7b3472c067f6c4315f4a73e7a784939450d34f33f454bb
MD5 2ebfbb36a79471f5710188d276e7d03c
SHA1 b774f47d5d0e043070bac8caadfd962e12242e6b
SHA512 8eae9f50ec7bb1d3cd89e06278a1b7581eeeb858687adfa653186e2c7d722cd3f54359eb728945564a0b79776869140e086199bc14775c0860bbcb2a9d4d4627
SSDEEP 192:IpjmzcFuvUZVfjkJj+GN8/nUeHQQjqup/oZ4a:ejmzcFRrCx8MeRjF/oKa
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_ie8.gif.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_ie8.gif.kkk
Size 7KB
SHA256 76ed85b29798700d01fb167a93d7368e1ab617e64797b76f3f49c248fa033898
MD5 06f03686581599505887047735aad07e
SHA1 f3076888652e3bcc4fadd33bc101321b2e402494
SHA512 755b5253c9fcf0f95383b1eb6cb15dc996f503595e81c5af0fa6a3b6d4253429f1fe000279cc961ab35f59322acdbad226c16795405764239fa1db8dd9c9abdf
SSDEEP 192:xzZk4ePactxwQxM3jSIq0ktdXkugqr4LOHXFARm7KSZE+:xlk4eTwQq3+MyMqr4LOHXFARm9m+
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_retina.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_retina.png.kkk
Size 15KB
SHA256 143b5d0e5aad18e43067d7427c08d7be0f45d2315c4e047208e38f9364fed193
MD5 93463a6765e65056c87ce3822cac2907
SHA1 d544758b93403ff5fcdc36af0e2cd5888939c5b7
SHA512 f5fd7681275a9e7930101d0c44d6953cfe6b87dcbca7171ce9bd1d5a05d99cb248c84c3c710b5e8a312bc6076e4c710f98d48d81938e4cd4389b1035fe43ba10
SSDEEP 384:O50ynmy9/+LRhT0lfT3IsM63tM35HTdbi7FC9sbaaN53l//Z1:OKymy8bIlfTA6dQ5HTde7FUs+8531n
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png.kkk
Size 8KB
SHA256 960cf54856c67209a7f72b7e7a17757741eb3292e4f1d3c440be83a354cfa5cf
MD5 c689f5ee91a3ad650dddbe269fb91298
SHA1 de973b1c7d4e72cc4768779eb39c8a49604c46b0
SHA512 4644dfb5e6db3c427aa387c19e1020a55695e5802cb8c7731129dd44d5c6b07ec55208fcced555120f725dc98a8b2c89f14d9ca756da9361dcf8bc93717b37d9
SSDEEP 192:VzvY/kBXMsjjtGgeYz3v2Xr85A7Ui12P2n5vaKWn:V0MBXMs3toYJU/1p5vHWn
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons_retina.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons_retina.png.kkk
Size 17KB
SHA256 6a666ae7367bef8cd52e2ef15a93e6b69316499fba56622ca9de7c289dc87ccb
MD5 bcb909053ff2ff38553678ceaded5bd5
SHA1 a74b633d1282fb2fe2730474a01976f9c45a7de8
SHA512 4cae019c28ec62ba880f84ec62c96ac5c2d8010effe58e5926fadd3e19377d249bf13e6adc80912ed98c3eba65f1f6f41280d4055d833fe3d28a07588d88e98a
SSDEEP 384:Swdm0Wu6mM0N/2cMKKLXYxGcVbaHMFlkviQ8MwuLsAvPZuuXkkZVwuc:VdaciJz/cdIMnMwQskS2wl
MD5 SHA1 SHA512 SSDEEP

Submit Download

rhp_world_icon.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.kkk
Size 448B
SHA256 991bf0fbc8783bfc4e13202e8dd9a7586435834e3b2a46160dfa3f37d413692d
MD5 9df060250e40980abc61d0b48728d4c4
SHA1 dc9e791a795079dd715b4ccea94b08715e53a59b
SHA512 90fcac1ed3fd1e573849aaeb770f4d4d69b430d8e29c13f706fa955c2772ee537fe368b9371bdcfa7f07e595e87367864dfaa5a290474e8b1871e309f2ca4d63
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.kkk
Size 624B
SHA256 4784b90849e8a8a643958c9f82e408477001a4ae18551569e6c79602c1ec8c5c
MD5 c0addc6e84ea4ea99f2305668be3cbfa
SHA1 8ddb58ae89ecfa2bd97a57015a9c3d00fbe9c183
SHA512 6bf20b7c3a13472f2125aec7292f17dd1d903d0efdfcc7149a76e566f9045bade672502c1c37d9d179db2f474934759c852b586f98400071fbda352080258cd0
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.kkk
Size 400B
SHA256 48de13f3fa2edb30f17aea3620cf5580677ba1849d97f2d2ca5ed4201980cbc0
MD5 666aefad45f46d6853942c2b95c3ae10
SHA1 4afcd7e7212e5bc2fa8c4d7a0ecc77d806852d08
SHA512 8e4342045ea12364efbf330918cd38ebb32945ed2777cc7b1bbfa9b4f6f6870af490d10a5bbd8352ce31a1b6e813bfeca0a02abc80f53050737f05985259faf7
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.kkk
Size 560B
SHA256 591d63df9400e7ad3e81a3fe9b2da472bbea73cf59aaa3dd9be9702153b305e1
MD5 139a62653e6657745091a60530914484
SHA1 70916e4f2f1fcde07a036cc18ab0fe682ffd9c81
SHA512 fd9e767e53f13aa701119fa5a1bf436b8e357cb01ac5e9eb6bc0222c9ddca15e9a40266d3509bdf4ed2e7e57e3b14a67056fffc3cec76a89f8dee9858aca9320
MD5 SHA1 SHA512

Submit Download

rhp_world_icon.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.kkk
Size 400B
SHA256 e470cfd620db9961285f982ea7df4c02add4cf13b9ee2c9d66625eb7f7880ae5
MD5 95b2ccb8c1bceecb1e205a7873d86e36
SHA1 8943ee85f7319be77d1b234b8eb52bc76cdb4a60
SHA512 19f19d4964b55a504335c3f100033cd9ef5385d538d7bdab18438e6a7e72afc02be40d3038bab8361eade8e0d131d8f15ffa7b37a662c5ffac5dbf9265b2552c
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.kkk
Size 560B
SHA256 aa797faa0fa7225b1d49e26fc7ff2eec5011c05d2a831ded970255df22c70b81
MD5 647203592e26f92c93396df37cb20724
SHA1 7dd45d5c9728452a2fe5b7d7c885a4e630435341
SHA512 32383c1dbaed0d178c070034f1186a5e4b032323a2017546ac552fd1b50550926b782c1c4e956e173866de306756b7cc6352c49f506bec074268846b0c820d4e
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.kkk
Size 400B
SHA256 4086caacf845109ee04978330ddfc983f9f854ca20ed4b1e1e0de099da92fb43
MD5 d44a13706db694a304ad90016adede5a
SHA1 a3a163564f7d70846702dd4c86e21b35a54283ed
SHA512 c1e39b2f1fc4d02e44962383865ec3b70c00dad77e3c795d633116dfbc550a08a146ec2ec47c58937ec426fe004d97a658e9c474de37b1bff6e613b28366e37d
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.kkk
Size 560B
SHA256 8df508c0ac3d35f8302e97f273d780d8205b9410a924df4455959911e58fac55
MD5 b1b0dafb860c7217d3055d0f933081f3
SHA1 472252976b360261f977b471e56cbe30cc8aef3a
SHA512 13d9888220dd307496f02cf37b024fde3aefc71d2d7cffc4890ddc7548dec7e872521a38c473f1eac9d4df09ab70651f8ce7de70a6a60d4a08201e1642fc8728
MD5 SHA1 SHA512

Submit Download

example_icons.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons.png.kkk
Size 688B
SHA256 b279485b869bdc7a872e269d6f96058bdd26ce43f9fba617103b5092b5f4da02
MD5 71beddf5e6b987d95ff93064ecd1b28c
SHA1 0cbd3304ea405193b3b704aa14a1b5ebc9bcb6eb
SHA512 dbcadef4c108e9e090cee4049431dc0fc06082e8c6221845646a94c504024f6d369cfba0b1c63b2e63bdd43076e35d46a72c0b61c03a9baf26b4ed63430a485e
MD5 SHA1 SHA512

Submit Download

example_icons2x.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons2x.png.kkk
Size 1KB
SHA256 62d7ca0c341425e48f2f935122742861aab1b82d925e36279880c90c22afa686
MD5 5f3d9f0e6d3205c2a42e36e74ddd5135
SHA1 963b55d7f03d00361b8f6b7bfc2ee192db6d2397
SHA512 baaa1a9a5b160469319c0e4d81aeccc03de0ac0744897dfc8fe661590213c8c824be93a7897146b429df796c60e2ced98c0d61dc94ef0a4d6b6caa8faec10b2b
MD5 SHA1 SHA512

Submit Download

bg_pattern_RHP.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png.kkk
Size 192B
SHA256 5de4b1c143d50c427cea38380fd2a5ea6166e5e9adb8059ecb70bbae193121d1
MD5 3c8831c9282918db2fd0b8b908faa569
SHA1 866a0f6c39467156142ce428400a6f6198af063e
SHA512 23185d5b81a6d4b4e1b9d6ad2be10bef860da9149a4ed00c78052d66abee312bc0d66d0bbe6c2cc2c1f3760aada94f9716f953e479ac4be4bab5cbc021857ff8
MD5 SHA1 SHA512

Submit Download

bg_patterns_header.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png.kkk
Size 704B
SHA256 700e5f564c857c033b462a905e0329e1e3864191f251aa778e590b132438fcb4
MD5 29063541403d2c6472fc14f04f0bf55a
SHA1 d1d0ecd570920f826461b04fb2e31ef9b3896285
SHA512 8818acfc36214faaf33b8e110c51c43422ee7a6197e4e2f21cde9f62ff0cc277451e1974b383f69135d773c54a0b43c939588f9b5d42020964b6d9cf0eb4c441
MD5 SHA1 SHA512

Submit Download

illustrations.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png.kkk
Size 8KB
SHA256 af2ae9548058151f6b56da0c29feb27f9402ef0a0dbf935d29d1c1304591b809
MD5 5bd48a40cab8f44d2461c0613d332684
SHA1 65c2bc325faf10e531633518d7d335658de90707
SHA512 f96c3f732534455e2fb51b76ccee5a0d076d943c0e8b93095a4fdfd37ddb3fbd77e8415adf30158599b87ab2cf941b864f6194339b70e024a51b1c86638f0a5d
SSDEEP 192:UL8+64zqQM2F7CUWGdIMooXc0g9xJOFwu1Xank7oqz:ULO4Gvy7mOLXc0Jm3uoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

illustrations_retina.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png.kkk
Size 19KB
SHA256 1a6c8c6795ff7796c265a2615be0ed7689296031f287e139df703def01a99505
MD5 5440afcf6f581cffaf3ee6d96096d764
SHA1 3b291d0e5f54b8e60b2ccb0f18a7a446bb358a17
SHA512 6d1da555ef190c0117a92b03fd0bdf1927f4b66bef1c8f9e653e47ce36148045717b1f57bd21e3699a27287f6361bab33629bf3ccaa49a8d8a71fdb25b2a6431
SSDEEP 384:Egxp6u1BX1yLjTVAHfYJSJ1ErEXZfZV3cpMNUCme94eRbGIaVU:Hx/3FAXagjEXZxV3GLe+SK7VU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ui-strings.js.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.kkk
Size 832B
SHA256 1169a53a5b985233b0e4702ce118c58962f4764762a36a909265173d0f3a6a23
MD5 cad31bdd810cf0a5ea27e477bf36a71c
SHA1 64f7a790bf1ab10881141d94c3105ee0d0db4912
SHA512 059566e97f21c4df8f10bc274ca05d074591f47d0accd1f6969ea98df0a7f763e596b058a1e7f837dbe302fc1583f111029158cbd648e5aef33c725b8be540da
MD5 SHA1 SHA512

Submit Download

ui-strings.js.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.kkk
Size 1KB
SHA256 f3cf6a411f5fe4e769a28ec3efa535835d364d42c8273acffc8111016a5536e5
MD5 f5bfb177a12b9f20f0dae986c5f1ab98
SHA1 a687c7c0c4f2e555af4a0f771fd92581fc7f3dc9
SHA512 cfd45f414eaaae3e5722118531ca11c733e57dc6cc728bef0cd307c36179814918757a3ac5901bbc55f1360ceceffadd3b88c41cfe04cdb2309c3e24910e97f4
MD5 SHA1 SHA512

Submit Download

ui-strings.js.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.kkk
Size 1KB
SHA256 cfce39cb1d86245173f1c91ff9780fe81e06b872b8cba8c8e60946ec70bfca52
MD5 0c6d95125e24cffcd015af65700bd75b
SHA1 5eecdfb09c43c4d6f95fe59d40749f4cc944964a
SHA512 f95c4ed9db7fc8d52f84408a6df88290c2cf0c90a2567418b1a4aeccf2de93375d43afd2ede265efda89cae975fd56f741b48b53f2b60ed8659f6ceee560382b
MD5 SHA1 SHA512

Submit Download

bun.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.kkk
Size 2KB
SHA256 fa410268b6204531c77957986a262c37a53883eee104ac4a7e56eb6367e623b1
MD5 bd8d3db8b130cfe717afc9c122ec9c94
SHA1 40abc62267f30036d9b544e969420dcde6e8a19b
SHA512 a5f3d43dc93e777942e9083141e5d6cb32f60d86f2fee47c66450aefd8082615b8b7d8db7da051399b297bd89673572f4aaf2c89141ba18c3fc9201a185b6683
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.kkk
Size 2KB
SHA256 a86d93a9af9005fc2018ca9fcd829b18181d5e0efa63c9248f8262918be6ade2
MD5 6b1f7dfe312cbc857be7fbeb4ca79a0d
SHA1 1c748f056143be429f5ed118c043c0fe1a3b67d6
SHA512 a7b2cea78053c0a409df24c19460e409f9bc977c7f5224db02be6d44826fdf6c7dcafed1b57d11e84bfd82729352559ae783a2e6b40ebae211d93057aef75b28
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview2x.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.kkk
Size 4KB
SHA256 33d44a69227cb3e80ab37ca36ed12ee3fbfbf182b4fb9b87fed28c54a16f83cc
MD5 900862c45569112668ffa952e4736cc0
SHA1 109e8d4aa47c05cbca46d16056655ad70f2b091c
SHA512 9a6504fcf813b8664320c6ead573086e1f7b162a743c236deb2217cd65a0d2784aa544f9d13db361854885955802a88d167261adffcbd00a223faef7dcb69a4e
SSDEEP 96:zapNv92hrsLY+bnZKrLsGEh/v2peVGGk/eH1aHNMmN1GNFp:zaLviIUScjEhH2pjpIaHyLP
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_arrow_small.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.kkk
Size 304B
SHA256 a560bb056367841475b6d2e053dfa1904d0863d6a40ad59ce8a1c8c1ebfa48ad
MD5 1b8202298443947c8908acdcb5718a52
SHA1 50169d66e7001f1bde1a4f8905489d78e2754b2c
SHA512 7a9442a83255d5a20ff1a859a4b705f7481bd6e05dd8210f6802e611ed957d8d676d61d49d49eeabcd3d718e85c4b8dd6d6cf1f67eca86adcfb411513eba194e
MD5 SHA1 SHA512

Submit Download

dd_arrow_small2x.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.kkk
Size 400B
SHA256 744d21d201df5c2e8547f06af1a3a540c77dcdb95dafbd04bc191dd4c919386a
MD5 d1f632ec601dbb78e902b0b1b19022be
SHA1 2dd5cb5f6659aa747a15caf692817af2ffcd1f19
SHA512 efa9a54476ff9dada9393c63527d41ea5e30b2cb43eae86021cb450de3760a269a093596d32f0c0585b2b4c4d8094087084d46aecefe17e6d7f6ffa66803639f
MD5 SHA1 SHA512

Submit Download

nub.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.kkk
Size 1008B
SHA256 fcb78b1fe239e0f9ea9401724320b1c751764f336df6c1c5230bd0733a777a64
MD5 a5d1aed6719d241e779478a2d11e92c5
SHA1 e6861e0a1dee7832abd4f822f8b779dd668a3c5b
SHA512 3fdefc37df36024a965c79d0c0bb4d82d3c30233a895eb902d04ea24f05b24d7bbdd4000ef9452701f56065106d4e0afba3e341a3f54026ce29641321b2c898f
MD5 SHA1 SHA512

Submit Download

share_icons.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.kkk
Size 1KB
SHA256 0d907545ea897345683d01eefe0be48e6b4d66c2c5f0422fc27cd66ff9a5775d
MD5 91a943103fd079736de37521ff610672
SHA1 b4dbb8d307b3dc05460fb979327f1244ee9b71da
SHA512 1daf8c73b19b5caab1d38fc84df67f8176a89a50554d476089ee96c3d566e0c6c802aa17540e6eb779f79c6bc9f22742c5e294c9bfcebc0e66956d006833b96d
MD5 SHA1 SHA512

Submit Download

share_icons2x.png.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.kkk
Size 2KB
SHA256 a46b9b729ae3340b00b50bc245ecc7e101869779040886ed480c6d324aabb17a
MD5 32f8d4915397cad38828996c475dff0a
SHA1 ea4fab34804b610ab1a5abf5ce712f0d51629009
SHA512 fffa16d10134f517b09452103c9e96925c1aa817a851a085bb0a02adeba8445a663f59b666c930e665fed2dcb84cf3a63070fd81b60381e6786c6491978b0bcd
MD5 SHA1 SHA512

Submit Download

ui-strings.js.kkk

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.kkk
Size 848B
SHA256 d52a3b8cae9e4713c7dfe0ea9d55662b80e68b60ffc2d25dabd80634841167ab
MD5 24c59b42a296a8c4b4658185bb58154d
SHA1 cfb55a1a0009cae6d1d01a88cdb8f7af081f8692
SHA512 b3aa79e775dc231458794adc4af95196d9f2ea028e340f29ac04f474294f6713a9da099c86b3da20889163f6ec41f59a766b70f0e2fedc587022f1107470613a
MD5 SHA1 SHA512

Submit Download

DisplayLanguageNames.en_US_POSIX.txt.kkk

Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.kkk
Size 32KB
SHA256 bd7b91a5891a65d0a55509ac09642b2b33646f21e0a19453094bfafb76348e22
MD5 9bf1204dd02ebce5b9ea86a12b5dab23
SHA1 b0a46783409c48cc05e1f7b7385989a2afc83d98
SHA512 ae4e43453c0b9dfd08f75340bb81f81babb87f08d34dafc60b5d2a588baa46e315e527665c4e464b19ebccfd775307a5e76efea8a0b075743335962ccdd033eb
SSDEEP 768:o2PGSrbhPfUJaafMztWSMopD2/ilicKvB2kzvVfv0xF:prbh3UEafMzUSzCa620tq
MD5 SHA1 SHA512 SSDEEP

Submit Download

invalid32x32.gif.kkk

Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.kkk
Size 160B
SHA256 257c16c6967bc37b43934987963025ef860d83c198a5a0dc380f72638d6b47f6
MD5 c55a44def54d2d4ad446279e2396fd53
SHA1 f77e9719392509d2faadeb953d40a3810c100b83
SHA512 bd8f3b07592b9036ccd6778cf98e1604ee4e93f3273aed09869dd8ecd1a5c084bf2cadca3eb718c09bbc20487f19ad8848f8dc6e613b5b6155df741fd43a0c59
MD5 SHA1 SHA512

Submit Download

drpbx.exe

Path C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
Size 2.3MB
SHA256 31823040d8ccb20eab0b8653d01af370a6537017e69ead69f6f7b73d6ef7ac14
MD5 4c153eacdfa8807f1c8fd98e5267da4b
SHA1 ce42e2c694ca4737ae68d3c9e333554c55afee27
SHA512 b2352099a41460c5c210774e5e63f85bd3c8898b58a3348444b35f233fdac50d2cedec68b7695a10109c3493f430c1e85fe039352d66756c5f6f9e9b0793d851
SSDEEP 24576:oF0rCLbf5rqziUnd5l1kqo/wvX0muSOcFjiWrO/iK1ubRM24RWCJG6h/ekExcZ4R:q607QiUnx1k4B9iWrTbi2AhDRek1Z4
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat.kkk

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.kkk
Size 8KB
SHA256 14b9522354ed528a9708e4e88c073b63ccbc8730a5d98e206c67d654f3f28f50
MD5 e13fe9c7429238a99ac7db11842fb884
SHA1 ef32fa3b7d7d39449e6ef43a4b67c8cf495cb366
SHA512 c24b84dd2d12ae1361578503276fe94e97d1ca27796f3311add97c734a388840200fe2c6f0dc89d0608c6b0c690e2d8cca2e655187278f6b1122b98de9ec43b8
SSDEEP 192:+QQD6mVxHiIfNMUUfh6/pg7lYdX8mpOBSxOjUvtfRSM:+3D6ExC2NMbfhwK7wsEOBScjSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

0.1.filtertrie.intermediate.txt.kkk

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{4f7bbdca-2df1-4113-a6c2-26f2463e08c2}\0.1.filtertrie.intermediate.txt.kkk
Size 16B
SHA256 2949b63015439d7828d9046d8f58549ff4143995221e688c07fdd9df15ff5b69
MD5 b1820ada39cf417635de0ac72a8e862a
SHA1 f5cd54f8d80671758aea2182d63e81f9126e2b35
SHA512 119b5bba0ce494306a02fa3fc9effcc97a82859df808f33e11b7ec29689ee3f488b8bfc1fb76d29ec9e8d5ca47f24c02b82714185aebc58efbd0a5b8707d3a1e
MD5 SHA1 SHA512

Submit Download

0.2.filtertrie.intermediate.txt.kkk

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{4f7bbdca-2df1-4113-a6c2-26f2463e08c2}\0.2.filtertrie.intermediate.txt.kkk
Size 16B
SHA256 0ec7324324bdc7ed572a056858a6feb90184dad9be4cdecaff4abddefb786450
MD5 1ca0f6617d61a23a175c6fe4849a563b
SHA1 a1665fd136bbe2cd75b913d06fba7e64d31285e0
SHA512 f8eef671820ce374d86fd0dc9a2f8b03e973134b8e49e961273dc362feb18dc46bbe873428bacced480688eb0f3ae71ab8bec99d5f3f3466860062ea3976157f
MD5 SHA1 SHA512

Submit Download

AppCache133596439082960180.txt.kkk

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596439082960180.txt.kkk
Size 77KB
SHA256 e419eddfae5470ccca379eef4733eb075addfbadc6d442688d84158ec9fcd000
MD5 ca2a8f8cc6289c691039c7a9c1d622ff
SHA1 8310bce9bef54497e76fd834fef78c3ce6fd809f
SHA512 9e082c3b53fa8db4820d8705cdfe8866d2d1f81b94b39a573eddde8531c6ca7b57ce94d95e8aa101418f87c3b54044354157d743a0b6fd3bba483e0f400507dd
SSDEEP 1536:QBt9LMjTJieQet4BkkwftwnTcRklohDUeADxEPK2eAyTBxbtpnxzgVxlpX5Lk:YxMjvouftOJ8AXRTfB0VxL5Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596440369039129.txt.kkk

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596440369039129.txt.kkk
Size 47KB
SHA256 1540e416b8868b85df57632b39392f5347cc9de61ac6ff604d02b2fac443d9d8
MD5 fe7022615c5e33edfdf5c46a532671fa
SHA1 eb734ba4cc74741c44f192ee538e2f2e3542f74e
SHA512 8f71389c1886f7c1ca8fdbd1ae3455553d49589688202ff6664ec1f27bb4e197bb52500e82c2de466c02d115d8fecbd3a05397a5a12d651efab5c03ca5d43161
SSDEEP 768:DwDM3iBbi2aootBitMiukdKBIPzHBAOlA6XCONR6uE3nJPz+eyLYYyKD+prIhE04:DjyBbxhotBT8z3lACv+3nJP6RLT/++uX
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596447416703473.txt.kkk

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596447416703473.txt.kkk
Size 66KB
SHA256 987d708999ce530e468f67bd62fbb1b1f24d7cd2731d1eb6c31e26f7f0a6a5d9
MD5 453aba43610c5fed88c5182b8d23bde2
SHA1 4af167ece1be1eebd6ffc5fe3e6c16ebf04a5616
SHA512 104136fb7c27fb6c1a6dda57a77da05b8f7315f86033248440ba54697aee6c36352bc1b172406cc5f4c772b425f7dc33dc5248b907bc0c191a3275c80315a0ed
SSDEEP 1536:kxhvsmkueZrmT7Fur0Swf8mCbAvo6aiTuoFwf0:YhvsZuR76NwEmSWaiTuoSf0
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596457988061993.txt.kkk

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596457988061993.txt.kkk
Size 75KB
SHA256 6635ab17220e21a6a5b18bee90c7246d51c81b150606ba69f8aeeeea939d2e43
MD5 d673271334ac881fba904af9ad28b5bf
SHA1 0ff1af6fb8cf15aa535c3e5834ad0094a450a1d0
SHA512 11d3ce8f9948493114525ee06bf00b5afef9d750a44a219ad0bff68a482ed2ec39ccea8d7ad09e9c7ad46d6063bbe5e256be2ba8d1f6fd9d872ac79a0e9b5b61
SSDEEP 1536:/DfMqkshG9BQIbwbpHau3T2FGoVCMRsJR5GJIIrDU70MsL5IdjbFa:/DXksYBypqF1VdG5GJIYz95Mjb8
MD5 SHA1 SHA512 SSDEEP

Submit Download

{965EC1E0-F908-4331-A37A-CA86A9869F9D} - OProcSessId.dat.kkk

Path C:\Users\Admin\AppData\Local\Temp\{965EC1E0-F908-4331-A37A-CA86A9869F9D} - OProcSessId.dat.kkk
Size 16B
SHA256 6e658c85e1ac3f1599673a2374ad5e8fb94520fe68b3f6eefdf108c42acc6414
MD5 f676080bd90886ac2ecf680ac3162244
SHA1 30a721d56041472fcf0c255c3c05c89b76093101
SHA512 b654a04f020ca0ccb0e9f7ab964e0d6a998b15b02ec47cbcccfd1274b99fddeccdca688b1d39e3d82de28610624f8765b1f5ac52895072f7c4cdb824f1658960
MD5 SHA1 SHA512

Submit Download

memory/2172-37-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

Download

memory/2172-470-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

Download

memory/2172-3784-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

Download

memory/2172-3783-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

Download

memory/2172-3780-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

Download

memory/2172-3779-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

Download

memory/2172-256-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

Download

memory/2172-471-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

Download

memory/2172-25-0x0000000000D00000-0x0000000000D08000-memory.dmp

Download

memory/2172-24-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

Download

memory/2172-50-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

Download

memory/2172-254-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

Download

memory/2172-255-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

Download

memory/2172-26-0x000000001F640000-0x000000001F7AA000-memory.dmp

Download

memory/2172-22-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

Download

memory/2172-23-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

Download

memory/3952-1-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

Download

memory/3952-21-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

Download

memory/3952-0-0x00007FF8013A5000-0x00007FF8013A6000-memory.dmp

Download

memory/3952-7-0x000000001CD80000-0x000000001CE70000-memory.dmp

Download

memory/3952-3-0x00007FF8010F0000-0x00007FF801A91000-memory.dmp

Download

memory/3952-2-0x000000001BF10000-0x000000001C3DE000-memory.dmp

Download

memory/3952-4-0x000000001C3E0000-0x000000001C6EE000-memory.dmp

Download

memory/3952-5-0x000000001B9F0000-0x000000001BA16000-memory.dmp

Download

memory/3952-6-0x000000001CBA0000-0x000000001CC3C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads