Analysis

  • max time kernel
    96s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-02-2025 21:30

General

  • Target

    jigsaw.exe

  • Size

    283KB

  • MD5

    2773e3dc59472296cb0024ba7715a64e

  • SHA1

    27d99fbca067f478bb91cdbcb92f13a828b00859

  • SHA256

    3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7

  • SHA512

    6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262

  • SSDEEP

    6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX

Malware Config

Signatures

  • Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

  • Jigsaw family
  • Renames multiple (3684) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 37 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jigsaw.exe
    "C:\Users\Admin\AppData\Local\Temp\jigsaw.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
      "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\jigsaw.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:4740
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault53f12e16h72b7h4575h8907hb5640192c9fc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4252
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x98,0x134,0x7ffd98a546f8,0x7ffd98a54708,0x7ffd98a54718
      2⤵
        PID:2452
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7948037144414383093,12863084015375751265,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
        2⤵
          PID:4584
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7948037144414383093,12863084015375751265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4568
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,7948037144414383093,12863084015375751265,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
          2⤵
            PID:3304
        • C:\Windows\System32\CompPkgSrv.exe
          C:\Windows\System32\CompPkgSrv.exe -Embedding
          1⤵
            PID:4532
          • C:\Windows\System32\CompPkgSrv.exe
            C:\Windows\System32\CompPkgSrv.exe -Embedding
            1⤵
              PID:4840
            • C:\Windows\system32\taskmgr.exe
              "C:\Windows\system32\taskmgr.exe" /6
              1⤵
              • Checks SCSI registry key(s)
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:4544

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.fun

              Filesize

              720B

              MD5

              75a585c1b60bd6c75d496d3b042738d5

              SHA1

              02c310d7bf79b32a43acd367d031b6a88c7e95ed

              SHA256

              5ebbfc6df60e21044486a5df3cb47ccdcd7a4d5f197804555715ffd9bf6c5834

              SHA512

              663a302e651b9167f4c4e6ae30028307b4d8da0dda3a0e5fd414104951d50419862fc9396c5b39fe5c4b696efd3efbf0b575688983b1d341f3ef38becf500505

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png.fun

              Filesize

              7KB

              MD5

              72269cd78515bde3812a44fa4c1c028c

              SHA1

              87cada599a01acf0a43692f07a58f62f5d90d22c

              SHA256

              7c78b3da50c1135a9e1ecace9aea4ea7ac8622d2a87b952fc917c81010c953f7

              SHA512

              3834b7a8866e8656bbdbf711fc400956e9b7a14e192758f26ccf31d8f6ab8e34f7b1983c1845dc84e45ff70555e423d54a475f6a668511d3bcbdd1d460eeb4b0

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_ie8.gif.fun

              Filesize

              7KB

              MD5

              eda4add7a17cc3d53920dd85d5987a5f

              SHA1

              863dcc28a16e16f66f607790807299b4578e6319

              SHA256

              97f6348eaa48800e603d11fa22c62e10682ad919e7af2b2e59d6bd53937618f2

              SHA512

              d59fa9648dc7cb76a5163014f91b6d65d33aaa86fc9d9c73bf147943a3254b4c4f77f06b2e95bb8f94246a982ea466eb33dac9573dd62f40953fd23de1c1b498

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_retina.png.fun

              Filesize

              15KB

              MD5

              7dbb12df8a1a7faae12a7df93b48a7aa

              SHA1

              07800ce598bee0825598ad6f5513e2ba60d56645

              SHA256

              aecde4eb94a19095495d76ef3189a9abd45bcfd41acbed7705d22b4c7d00aa77

              SHA512

              96e454ebb4c96573e8edc6822290c22d425f4c7f7adbab35e6dc4b3ce04a5916ae9254c2c312c98299835ecbf3c5aa95da2939b8408ac25fbae44ba87a3795dc

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png.fun

              Filesize

              8KB

              MD5

              82a2e835674d50f1a9388aaf1b935002

              SHA1

              e09d0577da42a15ec1b71a887ff3e48cfbfeff1a

              SHA256

              904372666ca3c40f92b20317d92ca531678958affbc34591401e338146fe0ecb

              SHA512

              b10a8e384d0bd088443a5085f5c22a296f6f4d295a053d4526690ba65846e887daec47d01cf18fdf1160db98061a8b7c4040de56e6e604451a821fadccf32698

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons_retina.png.fun

              Filesize

              17KB

              MD5

              150c9a9ed69b12d54ada958fcdbb1d8a

              SHA1

              804c540a51a8d14c6019d3886ece68f32f1631d5

              SHA256

              2dee41184747742fbdc527b2023d67fecec1ccdfdf258439a06cd75d4fd33f43

              SHA512

              70193ee6f0919eb14311f43b5a5da041deacb568db55fc43290ee76e17af902ac468435b37a150630ea3b7871c724073915ae5dcba3c301ac42f2d68dd598e2f

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.fun

              Filesize

              448B

              MD5

              880833ad1399589728c877f0ebf9dce0

              SHA1

              0a98c8a78b48c4b1b4165a2c6b612084d9d26dce

              SHA256

              7a27d891097df183fbf0031e3894bdac0ce77aef15d666ddd9f6a04e9836fb27

              SHA512

              0ddf247892a72a390437390d535debf6e41d12e51b31eb4f0353b710ec380c5fbc531a48e76935088063a41aca843287d3def9c1cd46be05b8dcb69f5017a464

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.fun

              Filesize

              624B

              MD5

              409a8070b50ad164eda5691adf5a2345

              SHA1

              e84e10471f3775d5d706a3b7e361100c9fbfaf74

              SHA256

              a91790b778026db625c9dedfe1c6d94b884818b33d7977e86b2f9c2f3c500796

              SHA512

              767a75edd37d29b3433040ce21cda849cd11ba549f27581f7edc6416c433ba7047c56908d40956422393ab0f35ede61617d4bd2aad0bde3d1ebd276584c858c7

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.fun

              Filesize

              400B

              MD5

              2884524604c89632ebbf595e1d905df9

              SHA1

              b6053c85110b0364766e18daab579ac048b36545

              SHA256

              ae2facd997527426fc4def82e0db68be29b44499bfff86a28c36f7c31b177d4f

              SHA512

              0b506397627823a1768796129c6b37d146821471b89338b5f2d0fd3aea707fd46a8e197ee0e298ddfb3b50eef0a0b064946006346b060f733ef19cbd5d24fc90

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.fun

              Filesize

              560B

              MD5

              e092d14d26938d98728ce4698ee49bc3

              SHA1

              9f8ee037664b4871ec02ed6bba11a5317b9e784a

              SHA256

              5e8ec278a273be22199884d519a79f748801baa3a45b76e57569fdfffe96e7fb

              SHA512

              b2fcb5d46339cdf6b5a954f2a083cf913779e57cb6e8699bc5da1fba1c370c41117b7ddefb50075622067eb7b02a20268bc047171bd883bcda4a497c2ec64ea4

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.fun

              Filesize

              400B

              MD5

              0c680b0b1e428ebc7bff87da2553d512

              SHA1

              f801dedfc3796d7ec52ee8ba85f26f24bbd2627c

              SHA256

              9433084e61062d2b709c1390e298ddaf3fb0226656662c04c0b7026a44dee750

              SHA512

              2d1399a6bf225b048d2b12656e941ad912636acae2dec387f92f33ac80629a1e504bca63580ba73a8ed073788f697274d5eb76ea1b089f0555fd397a8f5cbbff

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.fun

              Filesize

              560B

              MD5

              be26a499465cfbb09a281f34012eada0

              SHA1

              b8544b9f569724a863e85209f81cd952acdea561

              SHA256

              9095e9b4759e823e96984981af41b7a9915a5ecaa6be769f89c13484cef9e0f5

              SHA512

              28196e5de9670e9f63adcf648368bd3ea5926a03e28a13adc2fb69c567fba2f84e4f162637c487acb64eda2e30993f849806f2313820ba693c7e70303542d04f

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.fun

              Filesize

              400B

              MD5

              2de4e157bf747db92c978efce8754951

              SHA1

              c8d31effbb9621aefac55cf3d4ecf8db5e77f53d

              SHA256

              341976b4fe312824d02512d74770a6df9e1c37123781655532bd9cd97ea65fa9

              SHA512

              3042a742c38434ae3ee4fe10f7137462cdebad5cae0f9a85fb61063d15a30e1b54ac878b1af65f699c6ca1a9d2c3e58d245e54bdebfadc460cbd060836734e11

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.fun

              Filesize

              560B

              MD5

              ad091690b979144c795c59933373ea3f

              SHA1

              5d9e481bc96e6f53b6ff148b0da8417f63962ada

              SHA256

              7805ac9d0e05d560023e5aabed960d842e4f3ec2aa3db45a9cfb541688e2edb1

              SHA512

              23b4c799a7b25f70962e8dd0ec7286ba7150053cab7c88f5fb1efc1095c2987bd6f3572e7fb3ee4b2238958e52a763de2c84a74615df7a6d3a19a034584fd687

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons.png.fun

              Filesize

              688B

              MD5

              65368c6dd915332ad36d061e55d02d6f

              SHA1

              fb4bc0862b192ad322fcb8215a33bd06c4077c6b

              SHA256

              6f9c7ebec5a707de439e3fd2e278fdfa07a39465d56157b70b24f091509bf76f

              SHA512

              8bb9a7690aeb3c0b9e14e1a6ebc5741536d354cf2324fd74ee0c3e4ef511718f7795039a94c8d2df94b6e6d0fb1762191cb649089d1def12abdf34003f0cdd0f

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons2x.png.fun

              Filesize

              1KB

              MD5

              0d35b2591dc256d3575b38c748338021

              SHA1

              313f42a267f483e16e9dd223202c6679f243f02d

              SHA256

              1ca0cfc2df0354c8d886285ae5e743d9c7cc030e1afd68ac113c0f2ce43ad5fa

              SHA512

              f6c58c27bbde7508a866bd0e7fabadb13a4f020378cd8b8cfc0c9fa23f645d811d6cdea04b81afdf30c064c6248152e74b3e6a78ec7a3d1d19037a0db8897d7e

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png.fun

              Filesize

              192B

              MD5

              b8454390c3402747f7c5e46c69bea782

              SHA1

              e922c30891ff05939441d839bfe8e71ad9805ec0

              SHA256

              76f8ed1dd50e50c7d62b804a0d6901a93e5534787d7b38467933d4c12ce98a0d

              SHA512

              22b26c62473e80d17c1f78df14757ccfb6c7175faa541705edc153c02baa7ab0982b5daabe8dd2c8c9efb92af81f55ccaeeecffe8ed9a0b3c26e89135ca50923

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png.fun

              Filesize

              704B

              MD5

              6e333be79ea4454e2ae4a0649edc420d

              SHA1

              95a545127e10daea20fd38b29dcc66029bd3b8bc

              SHA256

              112f72ef2bc57de697b82b731775fba3f518d1ae072120cd11b732bf4a782e36

              SHA512

              bed5906c7373814acc8a54c1631428a17f0aa69282920447a1575d8db826afd5dab262301dc6da610ff8bb81d24ec6babd3d9fb99fd6945f1aca9cb9c76ec2c9

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png.fun

              Filesize

              8KB

              MD5

              3ae8789eb89621255cfd5708f5658dea

              SHA1

              6c3b530412474f62b91fd4393b636012c29217df

              SHA256

              7c5b1d8469e232a58359ccbcb89e619c81c20e6d2c7579e4292eb9a19849bc5a

              SHA512

              f6998dbae1a2fa56f962045261a11a50b8e03573d9d4cf39083da3be341cc104e0ecf5908076f03961bcdb1356d05a7450d69940ec3aaab73623a6fe180e7051

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png.fun

              Filesize

              19KB

              MD5

              b7c62677ce78fbd3fb9c047665223fea

              SHA1

              3218c7b6fd8be5e0a8b67d3953d37d5dbd0c71d8

              SHA256

              aa638be6e1107ed1f14e8430abedd6f6d0a837a31b1b63e6a7741d6d417eddc2

              SHA512

              9e0cc29835845f2a0260a6989c1b362bac22a8e0c2825bc18f1dde812ce7868503881d2deaf951429a80b5017b6ce31e785ff524883e08d730aa38b36a2fb074

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.fun

              Filesize

              832B

              MD5

              117d6f863b5406cd4f2ac4ceaa4ba2c6

              SHA1

              5cac25f217399ea050182d28b08301fd819f2b2e

              SHA256

              73acdc730d8a9ec8f340c724b4db96fc222bb1eaf836cec69dfe3fab8d6ac362

              SHA512

              e10883029c1e0fbc64bec9aac0a6957a8499af255e1790843717212077926474e02b2870c5dd04b057c956b97ad4bb1747fe73e731ea61b891f4b38dd80494d7

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.fun

              Filesize

              1KB

              MD5

              433755fcc2552446eb1345dd28c924eb

              SHA1

              23863f5257bdc268015f31ab22434728e5982019

              SHA256

              d6c290e942ee665d71e288229423a1f1866842988eac01f886910b0ec383aa9b

              SHA512

              de83b580ce27012a7677e1da867c91e2a42dbc6b5872dcf756ace51c2862801814665ecca997171f2e550e8b9a3de19994d2516a4e5d4d57e16c7b4b823236c0

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.fun

              Filesize

              1KB

              MD5

              781ed8cdd7186821383d43d770d2e357

              SHA1

              99638b49b4cfec881688b025467df9f6f15371e8

              SHA256

              a955039cd9e53674395f4b758218e4d59c89e99a0c4d2a909e49f6008b8f5dd4

              SHA512

              87cb9c4288586df232200f7bbacee3dee04f31c9444902dd369ad5c392d71e9837ebf8b3bb0fcb4a5db8a879cf757e97ce248939e3316c6bf3a3fe7cbe579534

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.fun

              Filesize

              2KB

              MD5

              51da980061401d9a49494b58225b2753

              SHA1

              3445ffbf33f012ff638c1435f0834db9858f16d3

              SHA256

              3fb25ddd378ab756ec9faa56f16b76691cf6d9c7405bb9a09ce542a6f5b94e44

              SHA512

              ecc5eb2a045ce2508d461b999f16caba6cce55aa0c00b34bd73a33e0458795f93a77caff5026212912684164057be016f51dc57ec83821c2a1f2e27417c47b2c

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.fun

              Filesize

              2KB

              MD5

              2863e8df6fbbe35b81b590817dd42a04

              SHA1

              562824deb05e2bfe1b57cd0abd3fc7fbec141b7c

              SHA256

              7f1238332901b740cde70db622abcfb533fc02f71e93101340073552f4820dad

              SHA512

              7b2d95465ea66951ea05c341549535a0a939d26dbde365b212e3983e4047fa6912c37d737cb8054c41bb1a7d92586d968a0154c666572a70ebc59a4776897f38

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.fun

              Filesize

              4KB

              MD5

              79f6f006c95a4eb4141d6cedc7b2ebeb

              SHA1

              012ca3de08fb304f022f4ea9565ae465f53ab9e8

              SHA256

              e9847d0839d3cf1039bebdc49820ee7813d70941347ce420990592e5e3bd998e

              SHA512

              c143a4cf1ccfa98039b73214978722408188535ee4aa3dac08a34760b94bdf6d36ad0ff0de893da5b17fd69c96a6dfb25098ab7fec219fad1a77532113d0353e

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.fun

              Filesize

              304B

              MD5

              b88e3983f77632fa21f1d11ac7e27a64

              SHA1

              03a2b008cc3fe914910b0250ed4d49bd6b021393

              SHA256

              8469b8a64e80d662eec71c50513f6d295ef4a3a9992763dbcac9d81253cef9d5

              SHA512

              5bf93d4f4250ca96169f3d27d4e648cc5d6e00b7558a3ef32e07edcbae36dadb8008d7ba5f83ac3ed812b72c9d52730e866191b4de7a339df57b5697e00df50d

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.fun

              Filesize

              400B

              MD5

              f77086a1d20bca6ba75b8f2fef2f0247

              SHA1

              db7c58faaecd10e4b3473b74c1277603a75d6624

              SHA256

              cf10d2a22b638cf0978cf30ecaf39ecb5bb0e3ad78cd920afa433ad60cc1290d

              SHA512

              a77a897c0b41f4052cb9546d4cfd6e0856b288b6b8583a86d6c7e79059a05b19cc2593599251581e79107235e9d5cd589c392bf490452be04ff57e944cd19df3

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.fun

              Filesize

              1008B

              MD5

              e03c9cd255f1d8d6c03b52fee7273894

              SHA1

              d0e9a9e6efd1746bc9ccb4eb8e7701c1cd707e2e

              SHA256

              22a34c8321384fc7682102e40d082e7812232a9109e4d4e8fa2152fda3f260f6

              SHA512

              d4bd002197b725316e1f1f2dd0a70ee44a82a53ac0dafa8c6b1166343adc406e147d0c4cca30d65a32aa545f1b327c6b69c0ec1d15330af48a6faa234dc4b5ac

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.fun

              Filesize

              1KB

              MD5

              62b1443d82968878c773a1414de23c82

              SHA1

              192bbf788c31bc7e6fe840c0ea113992a8d8621c

              SHA256

              4e96529c023168df8dde241a9acdbf4788ea65bc35605e18febff2b2071f1e24

              SHA512

              75c8604ea65e0cdd9ea74b4802930444dd16a945da1e7f0af4a9a3762259ee9eb41ea96973555d06f4814ee2f6b73ab662c6b314b97876e9628fa5d4536e771c

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.fun

              Filesize

              2KB

              MD5

              bca915870ae4ad0d86fcaba08a10f1fa

              SHA1

              7531259f5edae780e684a25635292bf4b2bb1aac

              SHA256

              d153ed6c5ea8c2c2f1839f8dadcc730f61bd8cd86ad732bab002a258dea1d037

              SHA512

              03f23de6b0ae10e63c41e73308b3844d49379c55d2df75fa1dc00771b26253d832c21081d8289f04260369df996e31273b7c0788cf3b5c78a27ec909f14a283a

            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.fun

              Filesize

              848B

              MD5

              14145467d1e7bd96f1ffe21e0ae79199

              SHA1

              5db5fbd88779a088fd1c4319ff26beb284ad0ff3

              SHA256

              7a75b8ec8809c460301f30e1960b13c518680792e5c743ce7e9a7f691cfafc38

              SHA512

              762d499c54c5a25aba4357a50bb4e6b47451babeda84fa62cfbd649f8350bca55204ad002883b9147e78dda3dbabaae8da1dc94b716204226bb53326030772b7

            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.fun

              Filesize

              32KB

              MD5

              829165ca0fd145de3c2c8051b321734f

              SHA1

              f5cc3af85ab27c3ea2c2f7cbb8295b28a76a459e

              SHA256

              a193ee2673e0ba5ebc5ea6e65665b8a28bd7611f06d2b0174ec2076e22d94356

              SHA512

              7d380cda12b342a770def9d4e9c078c97874f3a30cd9f531355e3744a8fef2308f79878ffeb12ce26953325cb6a17bc7e54237dfdc2ee72b140ec295676adbcb

            • C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.fun

              Filesize

              160B

              MD5

              580ee0344b7da2786da6a433a1e84893

              SHA1

              60f8c4dd5457e9834f5402cb326b1a2d3ca0ba7e

              SHA256

              98b6c2ddfefc628d03ceaef9d69688674a6bc32eb707f9ed86bc8c75675c4513

              SHA512

              356d2cdea3321e894b5b46ad1ea24c0e3c8be8e3c454b5bd300b7340cbb454e71fc89ca09ea0785b373b483e67c2f6f6bb408e489b0de4ff82d5ed69a75613ba

            • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

              Filesize

              283KB

              MD5

              2773e3dc59472296cb0024ba7715a64e

              SHA1

              27d99fbca067f478bb91cdbcb92f13a828b00859

              SHA256

              3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7

              SHA512

              6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262

            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

              Filesize

              152B

              MD5

              bf0b2725c0cd068b0f67eb62cbc3244f

              SHA1

              54ee5cd3bd0ae55707020bf40c4342736e310caf

              SHA256

              5dff0f70a7691805910a88ef91c9ecc338c6a27b818ff6b0c8bc6e0e8e381d36

              SHA512

              f622f17ddcf1a364bbe926fe427b1544c3bea200b65f24aee14a5eaa7b260e33f396ef07f2a0a53540dc4c0f5beebf431b6d7d0a9032890de13b99a2089b852e

            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

              Filesize

              152B

              MD5

              e8cb3a8ae72d4143c46a67827ca0b7df

              SHA1

              171c2c090300f33f67510e38358077155a664f99

              SHA256

              7bf198a75746d630643056ad1571f0d46f6d069f7813a39888f7519b4b843e9e

              SHA512

              917d6ac30c1975f5266aa380baf9842575ad565c4399ef7da499e8f78d7300f6b1c4d3c5846d46b5c39fbbcd76097fe356274ce44eb35e8ca5c09522def6758e

            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

              Filesize

              61B

              MD5

              4df4574bfbb7e0b0bc56c2c9b12b6c47

              SHA1

              81efcbd3e3da8221444a21f45305af6fa4b71907

              SHA256

              e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377

              SHA512

              78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a

            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

              Filesize

              6KB

              MD5

              f45c34e793c9fb5a58f560de00dfe4b8

              SHA1

              ed38aef27afc1a5ca51ca94c2b98f8004c382f38

              SHA256

              91b07e023f9a24898b7c210b91cb3f988ce6249027775f034df4dc726ba06ebd

              SHA512

              b8e913247adc28b5e8d06f3d4f3a72d864d07eb7ca996bd623d2f534f0ada88074d4c914c605273e3ad81479fe01aef60536be77207d7ded5920fcf25d94c2a7

            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

              Filesize

              8KB

              MD5

              c337f52f972fcfe81216d40175ff62eb

              SHA1

              5a4147c82bc766e1c38458b52f3894c8c23548fc

              SHA256

              79988a34230877b5172938e02d071063c9346944f685dd68fd780af9b994a77d

              SHA512

              1d3b34252e0a64f12288a80cf1d1c91f4974107519d1bf88767c3aad6e106f879410c7471f34c67555e4a3dece9b1eb484610321ccba5ba2943bf63c7fb6482a

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.fun

              Filesize

              8KB

              MD5

              f22599af9343cac74a6c5412104d748c

              SHA1

              e2ac4c57fa38f9d99f3d38c2f6582b4334331df5

              SHA256

              36537e56d60910ab6aa548e64ca4adafdcabde9d60739013993e12ba061dfd65

              SHA512

              5c8afc025e1d8342d93b7842dc7ef22eca61085857a80a08ba9b3f156ee3b814606bb32bc244bd525a7913e7915bdf3a86771d39577f4a1176ade04dc381c6d4

            • C:\Users\Admin\AppData\Local\Temp\{B6CA8540-7F15-4FCD-B55C-8A4BEAEA5837} - OProcSessId.dat.fun

              Filesize

              16B

              MD5

              8ebcc5ca5ac09a09376801ecdd6f3792

              SHA1

              81187142b138e0245d5d0bc511f7c46c30df3e14

              SHA256

              619e246fc0ac11320ff9e322a979948d949494b0c18217f4d794e1b398818880

              SHA512

              cec50bfc6ad2f57f16da99459f40f2d424c6d5691685fa1053284f46c8c8c8a975d7bcb1f3521c4f3fbdc310cf4714e29404aa23be6021e2e267c97b090dc650

            • memory/1520-4-0x000000001C010000-0x000000001C4DE000-memory.dmp

              Filesize

              4.8MB

            • memory/1520-5-0x000000001C4E0000-0x000000001C57C000-memory.dmp

              Filesize

              624KB

            • memory/1520-19-0x00007FFD9B5C0000-0x00007FFD9BF61000-memory.dmp

              Filesize

              9.6MB

            • memory/1520-0-0x00007FFD9B875000-0x00007FFD9B876000-memory.dmp

              Filesize

              4KB

            • memory/1520-3-0x0000000001490000-0x00000000014C8000-memory.dmp

              Filesize

              224KB

            • memory/1520-2-0x00007FFD9B5C0000-0x00007FFD9BF61000-memory.dmp

              Filesize

              9.6MB

            • memory/1520-1-0x00007FFD9B5C0000-0x00007FFD9BF61000-memory.dmp

              Filesize

              9.6MB

            • memory/4544-516-0x000001F50A880000-0x000001F50A881000-memory.dmp

              Filesize

              4KB

            • memory/4544-512-0x000001F50A880000-0x000001F50A881000-memory.dmp

              Filesize

              4KB

            • memory/4544-507-0x000001F50A880000-0x000001F50A881000-memory.dmp

              Filesize

              4KB

            • memory/4544-506-0x000001F50A880000-0x000001F50A881000-memory.dmp

              Filesize

              4KB

            • memory/4544-513-0x000001F50A880000-0x000001F50A881000-memory.dmp

              Filesize

              4KB

            • memory/4544-508-0x000001F50A880000-0x000001F50A881000-memory.dmp

              Filesize

              4KB

            • memory/4544-514-0x000001F50A880000-0x000001F50A881000-memory.dmp

              Filesize

              4KB

            • memory/4544-515-0x000001F50A880000-0x000001F50A881000-memory.dmp

              Filesize

              4KB

            • memory/4544-517-0x000001F50A880000-0x000001F50A881000-memory.dmp

              Filesize

              4KB

            • memory/4544-518-0x000001F50A880000-0x000001F50A881000-memory.dmp

              Filesize

              4KB

            • memory/4740-20-0x00007FFD9B5C0000-0x00007FFD9BF61000-memory.dmp

              Filesize

              9.6MB

            • memory/4740-21-0x00007FFD9B5C0000-0x00007FFD9BF61000-memory.dmp

              Filesize

              9.6MB

            • memory/4740-22-0x00007FFD9B5C0000-0x00007FFD9BF61000-memory.dmp

              Filesize

              9.6MB

            • memory/4740-23-0x000000001C550000-0x000000001C558000-memory.dmp

              Filesize

              32KB

            • memory/4740-24-0x00007FFD9B5C0000-0x00007FFD9BF61000-memory.dmp

              Filesize

              9.6MB

            • memory/4740-3783-0x00007FFD9B5C0000-0x00007FFD9BF61000-memory.dmp

              Filesize

              9.6MB

            • memory/4740-3786-0x00007FFD9B5C0000-0x00007FFD9BF61000-memory.dmp

              Filesize

              9.6MB