Overview
overview
10Static
static
5cerber.exe
windows10-2004-x64
10cerber.exe
windows11-ltsc_2024-x64
10cryptowall.exe
windows10-2004-x64
3cryptowall.exe
windows11-ltsc_2024-x64
3jigsaw.exe
windows10-2004-x64
10jigsaw.exe
windows11-ltsc_2024-x64
10Locky.exe
windows10-2004-x64
10Locky.exe
windows11-ltsc_2024-x64
10131.exe
windows10-2004-x64
3131.exe
windows11-ltsc_2024-x64
3Matsnu-MBR...3 .exe
windows10-2004-x64
3Matsnu-MBR...3 .exe
windows11-ltsc_2024-x64
3027cc450ef...d9.dll
windows10-2004-x64
10027cc450ef...d9.dll
windows11-ltsc_2024-x64
10027cc450ef...ju.dll
windows10-2004-x64
10027cc450ef...ju.dll
windows11-ltsc_2024-x64
10myguy.hta
windows10-2004-x64
10myguy.hta
windows11-ltsc_2024-x64
10svchost.exe
windows10-2004-x64
7svchost.exe
windows11-ltsc_2024-x64
7Analysis
- max time kernel
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/09/2026, 00:32
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
cerber.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
cerber.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
Behavioral task
behavioral3
Sample
cryptowall.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
cryptowall.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
jigsaw.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral6
Sample
jigsaw.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral7
Sample
Locky.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
Locky.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
131.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
131.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
027cc450ef5f8c5f653329641ec1fed9.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral14
Sample
027cc450ef5f8c5f653329641ec1fed9.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral15
Sample
027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745_98STJd8lju.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral16
Sample
027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745_98STJd8lju.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral17
Sample
myguy.hta
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral18
Sample
myguy.hta
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral19
Sample
svchost.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral20
Sample
svchost.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target jigsaw.exe
- Size 283KB
- Sample260916-avy45sssgv
- SHA256 3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
- MD5 2773e3dc59472296cb0024ba7715a64e
- SHA1 27d99fbca067f478bb91cdbcb92f13a828b00859
- SHA512 6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
- SSDEEP 6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX
- TLSH T110549D9C366076EFC867D476DEA81CA4FA6078BB832B8207901715EDA90D997CF141F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
- Renames multiple (3977) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation jigsaw.exe - Executes dropped EXE 2 IoCs
pid Process 2444 drpbx.exe 5012 firefox.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" jigsaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" firefox.exe - ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule behavioral5/files/0x00070000000243f9-11.dat ConfuserEx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\es-es\ui-strings.js.fun firefox.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\manifest.xml.fun firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\75.jpg firefox.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\download.svg.fun firefox.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.fun firefox.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png.fun firefox.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\ui-strings.js firefox.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-si\ui-strings.js.fun firefox.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-si\ui-strings.js firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_139.0.3405.125_neutral__8wekyb3d8bbwe\AppxBlockMap.xml firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyShare.scale-100.png firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-20_altform-unplated.png firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageMedTile.scale-200.png firefox.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugin.js.fun firefox.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-fr_fr_2x.gif firefox.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\es-es\ui-strings.js firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteWideTile.scale-200.png firefox.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\ui-strings.js.fun firefox.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\ui-strings.js firefox.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\adobe_logo.png firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteWideTile.scale-200.png firefox.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxLargeTile.scale-150.png firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_SplashScreen.scale-100.png firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\WideTile.scale-100.png firefox.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pt-br\ui-strings.js.fun firefox.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-il\ui-strings.js firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-96_altform-unplated_contrast-white_devicefamily-colorfulunplated.png firefox.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Doughboy.scale-400.png firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubStoreLogo.scale-100_contrast-white.png firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\Undo.png firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageWideTile.scale-100.png firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\LargeTile.scale-100.png firefox.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png firefox.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\eu-es\ui-strings.js firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-36.png firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-64_altform-fullcolor.png firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-40.png firefox.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml.fun firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-32_altform-unplated_contrast-white.png firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_contrast-black.png firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-256_altform-unplated.png firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSmallTile.scale-150.png firefox.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteMedTile.scale-200.png firefox.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\add_reviewer.gif firefox.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\form_responses.gif.fun firefox.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\Logo.png firefox.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionLargeTile.scale-125.png firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-96_contrast-black.png firefox.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square71x71Logo.scale-125.png firefox.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\WideLogo.scale-125_contrast-black.png firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\stickers\word_art\sticker33.png firefox.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\core_icons_retina.png.fun firefox.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\ui-strings.js firefox.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_scale-100.png firefox.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-80.png.fun firefox.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubBadgeLogo.scale-200_contrast-white.png firefox.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-256.png firefox.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_folder-focus_32.svg.fun firefox.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons.png.fun firefox.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1432 wrote to memory of 2444 1432 jigsaw.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\jigsaw.exe"C:\Users\Admin\AppData\Local\Temp\jigsaw.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\jigsaw.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2444
-
-
C:\Users\Admin\AppData\Roaming\Frfx\firefox.exeC:\Users\Admin\AppData\Roaming\Frfx\firefox.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:5012
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.fun
- Size 720B
- SHA256 5ebbfc6df60e21044486a5df3cb47ccdcd7a4d5f197804555715ffd9bf6c5834
- MD5 75a585c1b60bd6c75d496d3b042738d5
- SHA1 02c310d7bf79b32a43acd367d031b6a88c7e95ed
- SHA512 663a302e651b9167f4c4e6ae30028307b4d8da0dda3a0e5fd414104951d50419862fc9396c5b39fe5c4b696efd3efbf0b575688983b1d341f3ef38becf500505
- TLSH T1E90165B1C98846F3072209B10852EF92C81705958D3FD709067A45B7859D52ED1B725A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png.fun
- Size 7KB
- SHA256 7c78b3da50c1135a9e1ecace9aea4ea7ac8622d2a87b952fc917c81010c953f7
- MD5 72269cd78515bde3812a44fa4c1c028c
- SHA1 87cada599a01acf0a43692f07a58f62f5d90d22c
- SHA512 3834b7a8866e8656bbdbf711fc400956e9b7a14e192758f26ccf31d8f6ab8e34f7b1983c1845dc84e45ff70555e423d54a475f6a668511d3bcbdd1d460eeb4b0
- SSDEEP 192:yl9YEEreKN7EsfKJ+weTMeEfGK3lQvxdt12Ne2UZ:aYEErr2Ai+Rwzm5dt1qMZ
- TLSH T15EF19E2D39284B054E71898C61EA546FD253A19C880F1FBD7D1C4D8557F81B322F7A97
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_ie8.gif.fun
- Size 7KB
- SHA256 97f6348eaa48800e603d11fa22c62e10682ad919e7af2b2e59d6bd53937618f2
- MD5 eda4add7a17cc3d53920dd85d5987a5f
- SHA1 863dcc28a16e16f66f607790807299b4578e6319
- SHA512 d59fa9648dc7cb76a5163014f91b6d65d33aaa86fc9d9c73bf147943a3254b4c4f77f06b2e95bb8f94246a982ea466eb33dac9573dd62f40953fd23de1c1b498
- SSDEEP 192:JPTuKNGOc9sqG+FzfP0GvzYmaMH96m5sW5hx7WZvz:cKNGOc9sqGSzn0GvzYma496osou
- TLSH T1D2F1B0E52D2A3E49010EA1B4F90D1FA1CECC1CED9F685E8D7F1B3221A63165C464AC28
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_retina.png.fun
- Size 15KB
- SHA256 aecde4eb94a19095495d76ef3189a9abd45bcfd41acbed7705d22b4c7d00aa77
- MD5 7dbb12df8a1a7faae12a7df93b48a7aa
- SHA1 07800ce598bee0825598ad6f5513e2ba60d56645
- SHA512 96e454ebb4c96573e8edc6822290c22d425f4c7f7adbab35e6dc4b3ce04a5916ae9254c2c312c98299835ecbf3c5aa95da2939b8408ac25fbae44ba87a3795dc
- SSDEEP 384:HURsH7Wedt7Tyle66zOlvgcZ0RjAJoVS9tJbTa0gB1jaexOyPxoNBZxk:HesbXTyle66alYAyVS9tp+Fady5IZxk
- TLSH T18062E09F013D1060B70116AC5F7012F339CA64FF5D01BA69C7CC7D86A92B7664D87875
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png.fun
- Size 8KB
- SHA256 904372666ca3c40f92b20317d92ca531678958affbc34591401e338146fe0ecb
- MD5 82a2e835674d50f1a9388aaf1b935002
- SHA1 e09d0577da42a15ec1b71a887ff3e48cfbfeff1a
- SHA512 b10a8e384d0bd088443a5085f5c22a296f6f4d295a053d4526690ba65846e887daec47d01cf18fdf1160db98061a8b7c4040de56e6e604451a821fadccf32698
- SSDEEP 192:yE+uhOLGpyTkZ/+KeeRHguUjlgc1Ggew+Br8IAkjuL1M2Gw:9+KpyOmKee5guw2UewYr8pkeM21
- TLSH T17D02AFA18E9654D6985081E1AE1C164A2F18EBD1F3D35AC1279FA7FC42A74B432DD501
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons_retina.png.fun
- Size 17KB
- SHA256 2dee41184747742fbdc527b2023d67fecec1ccdfdf258439a06cd75d4fd33f43
- MD5 150c9a9ed69b12d54ada958fcdbb1d8a
- SHA1 804c540a51a8d14c6019d3886ece68f32f1631d5
- SHA512 70193ee6f0919eb14311f43b5a5da041deacb568db55fc43290ee76e17af902ac468435b37a150630ea3b7871c724073915ae5dcba3c301ac42f2d68dd598e2f
- SSDEEP 384:Pe9raLU/qoGIgkIBdBtTdYv9lvzIdFCyzu4LFg/atDWd2YAEEAvcEwkCfG:PsraIivkLpXyzRLG/atDa8mwvfG
- TLSH T13282D03AB7F3611F4FE938E2D532459067638C066126EA528CDFFF824062E3604AD766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.fun
- Size 448B
- SHA256 7a27d891097df183fbf0031e3894bdac0ce77aef15d666ddd9f6a04e9836fb27
- MD5 880833ad1399589728c877f0ebf9dce0
- SHA1 0a98c8a78b48c4b1b4165a2c6b612084d9d26dce
- SHA512 0ddf247892a72a390437390d535debf6e41d12e51b31eb4f0353b710ec380c5fbc531a48e76935088063a41aca843287d3def9c1cd46be05b8dcb69f5017a464
- TLSH T181F0DC18B4D4AC890D50AA6ABAE6A1B2F22149A984746C1DD4EA101A215D4A6AE88D36
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.fun
- Size 624B
- SHA256 a91790b778026db625c9dedfe1c6d94b884818b33d7977e86b2f9c2f3c500796
- MD5 409a8070b50ad164eda5691adf5a2345
- SHA1 e84e10471f3775d5d706a3b7e361100c9fbfaf74
- SHA512 767a75edd37d29b3433040ce21cda849cd11ba549f27581f7edc6416c433ba7047c56908d40956422393ab0f35ede61617d4bd2aad0bde3d1ebd276584c858c7
- TLSH T142F02D416A2BF42B82C3542DBC0FB606A23148AB614822324E808AB19E2EAC745C142B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.fun
- Size 400B
- SHA256 ae2facd997527426fc4def82e0db68be29b44499bfff86a28c36f7c31b177d4f
- MD5 2884524604c89632ebbf595e1d905df9
- SHA1 b6053c85110b0364766e18daab579ac048b36545
- SHA512 0b506397627823a1768796129c6b37d146821471b89338b5f2d0fd3aea707fd46a8e197ee0e298ddfb3b50eef0a0b064946006346b060f733ef19cbd5d24fc90
- TLSH T152E0F1A9BD1B070C3F407332AA73F81787A267821ED2D910CF08186692D721D864F644
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.fun
- Size 560B
- SHA256 5e8ec278a273be22199884d519a79f748801baa3a45b76e57569fdfffe96e7fb
- MD5 e092d14d26938d98728ce4698ee49bc3
- SHA1 9f8ee037664b4871ec02ed6bba11a5317b9e784a
- SHA512 b2fcb5d46339cdf6b5a954f2a083cf913779e57cb6e8699bc5da1fba1c370c41117b7ddefb50075622067eb7b02a20268bc047171bd883bcda4a497c2ec64ea4
- TLSH T1A5F041014E4DA2430C688C4A0980ACD0C81CF64187E26C242CB94939304EABA192082B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.fun
- Size 400B
- SHA256 9433084e61062d2b709c1390e298ddaf3fb0226656662c04c0b7026a44dee750
- MD5 0c680b0b1e428ebc7bff87da2553d512
- SHA1 f801dedfc3796d7ec52ee8ba85f26f24bbd2627c
- SHA512 2d1399a6bf225b048d2b12656e941ad912636acae2dec387f92f33ac80629a1e504bca63580ba73a8ed073788f697274d5eb76ea1b089f0555fd397a8f5cbbff
- TLSH T163E0F16E2E6C0B7B9B01A380E46AFD1390EC43097F0028AF9B860C96316304020E7CCA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.fun
- Size 560B
- SHA256 9095e9b4759e823e96984981af41b7a9915a5ecaa6be769f89c13484cef9e0f5
- MD5 be26a499465cfbb09a281f34012eada0
- SHA1 b8544b9f569724a863e85209f81cd952acdea561
- SHA512 28196e5de9670e9f63adcf648368bd3ea5926a03e28a13adc2fb69c567fba2f84e4f162637c487acb64eda2e30993f849806f2313820ba693c7e70303542d04f
- TLSH T174F096018DD04C3461554810D0F72D73FE2A366CCED5AB2FBCAB55608255390C0C6015
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.fun
- Size 400B
- SHA256 341976b4fe312824d02512d74770a6df9e1c37123781655532bd9cd97ea65fa9
- MD5 2de4e157bf747db92c978efce8754951
- SHA1 c8d31effbb9621aefac55cf3d4ecf8db5e77f53d
- SHA512 3042a742c38434ae3ee4fe10f7137462cdebad5cae0f9a85fb61063d15a30e1b54ac878b1af65f699c6ca1a9d2c3e58d245e54bdebfadc460cbd060836734e11
- TLSH T1D1E0F16C8092737971A9B101061E575C00F7852CD020CF7EBE0F3351824B574C8CA5BA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.fun
- Size 560B
- SHA256 7805ac9d0e05d560023e5aabed960d842e4f3ec2aa3db45a9cfb541688e2edb1
- MD5 ad091690b979144c795c59933373ea3f
- SHA1 5d9e481bc96e6f53b6ff148b0da8417f63962ada
- SHA512 23b4c799a7b25f70962e8dd0ec7286ba7150053cab7c88f5fb1efc1095c2987bd6f3572e7fb3ee4b2238958e52a763de2c84a74615df7a6d3a19a034584fd687
- TLSH T1E7F026476B185C360189759E07E32441CFB0F2C16956F4698EBB4A1685D146765851C9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons.png.fun
- Size 688B
- SHA256 6f9c7ebec5a707de439e3fd2e278fdfa07a39465d56157b70b24f091509bf76f
- MD5 65368c6dd915332ad36d061e55d02d6f
- SHA1 fb4bc0862b192ad322fcb8215a33bd06c4077c6b
- SHA512 8bb9a7690aeb3c0b9e14e1a6ebc5741536d354cf2324fd74ee0c3e4ef511718f7795039a94c8d2df94b6e6d0fb1762191cb649089d1def12abdf34003f0cdd0f
- TLSH T1AF018820E19123F73D53091F75C959C613D01074BD90F224EB616C809D754CEBCB9B0A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons2x.png.fun
- Size 1KB
- SHA256 1ca0cfc2df0354c8d886285ae5e743d9c7cc030e1afd68ac113c0f2ce43ad5fa
- MD5 0d35b2591dc256d3575b38c748338021
- SHA1 313f42a267f483e16e9dd223202c6679f243f02d
- SHA512 f6c58c27bbde7508a866bd0e7fabadb13a4f020378cd8b8cfc0c9fa23f645d811d6cdea04b81afdf30c064c6248152e74b3e6a78ec7a3d1d19037a0db8897d7e
- TLSH T12621D72520333A164638C9196F3DAF97C45AAE1B0206861CFEE26FC661B784898C2D37
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png.fun
- Size 192B
- SHA256 76f8ed1dd50e50c7d62b804a0d6901a93e5534787d7b38467933d4c12ce98a0d
- MD5 b8454390c3402747f7c5e46c69bea782
- SHA1 e922c30891ff05939441d839bfe8e71ad9805ec0
- SHA512 22b26c62473e80d17c1f78df14757ccfb6c7175faa541705edc153c02baa7ab0982b5daabe8dd2c8c9efb92af81f55ccaeeecffe8ed9a0b3c26e89135ca50923
- TLSH T146C022C00AB840582E60920847875201BB71121C093C8EAE01FC085ECEE18E1920D584
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png.fun
- Size 704B
- SHA256 112f72ef2bc57de697b82b731775fba3f518d1ae072120cd11b732bf4a782e36
- MD5 6e333be79ea4454e2ae4a0649edc420d
- SHA1 95a545127e10daea20fd38b29dcc66029bd3b8bc
- SHA512 bed5906c7373814acc8a54c1631428a17f0aa69282920447a1575d8db826afd5dab262301dc6da610ff8bb81d24ec6babd3d9fb99fd6945f1aca9cb9c76ec2c9
- TLSH T178019462A270EE4208C44320CF5BBC8CE52C5FBD68F057D5041B0A7D6514DF60A65B8B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png.fun
- Size 8KB
- SHA256 7c5b1d8469e232a58359ccbcb89e619c81c20e6d2c7579e4292eb9a19849bc5a
- MD5 3ae8789eb89621255cfd5708f5658dea
- SHA1 6c3b530412474f62b91fd4393b636012c29217df
- SHA512 f6998dbae1a2fa56f962045261a11a50b8e03573d9d4cf39083da3be341cc104e0ecf5908076f03961bcdb1356d05a7450d69940ec3aaab73623a6fe180e7051
- SSDEEP 192:ycuhx+D6Zj2RBiFyPwdrhSzTIDg/RRAHx0WBAa5Eg3UpTTPO3TZ+2I:Fu14RBvYhBg/obiZyUh
- TLSH T18902BEE462FD94D7EA4BFB092A51128333030945BC899730DB386C87F19BEFE65D9048
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png.fun
- Size 19KB
- SHA256 aa638be6e1107ed1f14e8430abedd6f6d0a837a31b1b63e6a7741d6d417eddc2
- MD5 b7c62677ce78fbd3fb9c047665223fea
- SHA1 3218c7b6fd8be5e0a8b67d3953d37d5dbd0c71d8
- SHA512 9e0cc29835845f2a0260a6989c1b362bac22a8e0c2825bc18f1dde812ce7868503881d2deaf951429a80b5017b6ce31e785ff524883e08d730aa38b36a2fb074
- SSDEEP 384:l4cPtSvsj86dOxdtDZhK4sHDVsuDfEu+WvEWL9NZpbj:5SvsonzzlsjhslWvEo9jJj
- TLSH T19492E080B8DE2D290F64D58F99C179603C92FEF64D4F025BBBB70C26C04D886A59B25D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.fun
- Size 832B
- SHA256 73acdc730d8a9ec8f340c724b4db96fc222bb1eaf836cec69dfe3fab8d6ac362
- MD5 117d6f863b5406cd4f2ac4ceaa4ba2c6
- SHA1 5cac25f217399ea050182d28b08301fd819f2b2e
- SHA512 e10883029c1e0fbc64bec9aac0a6957a8499af255e1790843717212077926474e02b2870c5dd04b057c956b97ad4bb1747fe73e731ea61b891f4b38dd80494d7
- TLSH T1AC01D65066209801348E2A2DD3589E64B223B44A6FE1D365965C392EE9CFC6AB38D843
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.fun
- Size 1KB
- SHA256 d6c290e942ee665d71e288229423a1f1866842988eac01f886910b0ec383aa9b
- MD5 433755fcc2552446eb1345dd28c924eb
- SHA1 23863f5257bdc268015f31ab22434728e5982019
- SHA512 de83b580ce27012a7677e1da867c91e2a42dbc6b5872dcf756ace51c2862801814665ecca997171f2e550e8b9a3de19994d2516a4e5d4d57e16c7b4b823236c0
- TLSH T1D621EA111724C401545F1BA8C74EEF55705170086FE1A36C8E583F6EF89FC25F296553
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.fun
- Size 1KB
- SHA256 a955039cd9e53674395f4b758218e4d59c89e99a0c4d2a909e49f6008b8f5dd4
- MD5 781ed8cdd7186821383d43d770d2e357
- SHA1 99638b49b4cfec881688b025467df9f6f15371e8
- SHA512 87cb9c4288586df232200f7bbacee3dee04f31c9444902dd369ad5c392d71e9837ebf8b3bb0fcb4a5db8a879cf757e97ce248939e3316c6bf3a3fe7cbe579534
- TLSH T1B221F9501124590171DD29ACD218AED4705278621F95E21A87793A5EFECE8F6FBC8D13
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.fun
- Size 2KB
- SHA256 3fb25ddd378ab756ec9faa56f16b76691cf6d9c7405bb9a09ce542a6f5b94e44
- MD5 51da980061401d9a49494b58225b2753
- SHA1 3445ffbf33f012ff638c1435f0834db9858f16d3
- SHA512 ecc5eb2a045ce2508d461b999f16caba6cce55aa0c00b34bd73a33e0458795f93a77caff5026212912684164057be016f51dc57ec83821c2a1f2e27417c47b2c
- TLSH T1AE510B2B66E8CB135E2160922BD7E649634C3B89A058A555FD16DC13B2A13B1C5C714E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.fun
- Size 2KB
- SHA256 7f1238332901b740cde70db622abcfb533fc02f71e93101340073552f4820dad
- MD5 2863e8df6fbbe35b81b590817dd42a04
- SHA1 562824deb05e2bfe1b57cd0abd3fc7fbec141b7c
- SHA512 7b2d95465ea66951ea05c341549535a0a939d26dbde365b212e3983e4047fa6912c37d737cb8054c41bb1a7d92586d968a0154c666572a70ebc59a4776897f38
- TLSH T1BF512D68DCA39F70C14BE355A4DFE8EBDEECFE1C5608B11588A02467E5B445D2744D14
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.fun
- Size 4KB
- SHA256 e9847d0839d3cf1039bebdc49820ee7813d70941347ce420990592e5e3bd998e
- MD5 79f6f006c95a4eb4141d6cedc7b2ebeb
- SHA1 012ca3de08fb304f022f4ea9565ae465f53ab9e8
- SHA512 c143a4cf1ccfa98039b73214978722408188535ee4aa3dac08a34760b94bdf6d36ad0ff0de893da5b17fd69c96a6dfb25098ab7fec219fad1a77532113d0353e
- SSDEEP 96:yo6f1xc8rVxASSyrJ5ZyHh67oj43FjSSTEyAQJpiT:yo6zLu+5Y67ojIFjSSTEyrKT
- TLSH T182A18E79EA031B82B152463630BD6E30F17C798E7494D855D3D3B2170E229330E7C516
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.fun
- Size 304B
- SHA256 8469b8a64e80d662eec71c50513f6d295ef4a3a9992763dbcac9d81253cef9d5
- MD5 b88e3983f77632fa21f1d11ac7e27a64
- SHA1 03a2b008cc3fe914910b0250ed4d49bd6b021393
- SHA512 5bf93d4f4250ca96169f3d27d4e648cc5d6e00b7558a3ef32e07edcbae36dadb8008d7ba5f83ac3ed812b72c9d52730e866191b4de7a339df57b5697e00df50d
- TLSH T1C9E0E74383A174588DA3C3DE6858435D4FB0B0562B93EE154C7557ED3054742DE7D51F
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.fun
- Size 400B
- SHA256 cf10d2a22b638cf0978cf30ecaf39ecb5bb0e3ad78cd920afa433ad60cc1290d
- MD5 f77086a1d20bca6ba75b8f2fef2f0247
- SHA1 db7c58faaecd10e4b3473b74c1277603a75d6624
- SHA512 a77a897c0b41f4052cb9546d4cfd6e0856b288b6b8583a86d6c7e79059a05b19cc2593599251581e79107235e9d5cd589c392bf490452be04ff57e944cd19df3
- TLSH T1F0E0F1879920E11A73660513DF1CB0D50B636ECA5EDC61278613EE7068C304B440B00D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.fun
- Size 1008B
- SHA256 22a34c8321384fc7682102e40d082e7812232a9109e4d4e8fa2152fda3f260f6
- MD5 e03c9cd255f1d8d6c03b52fee7273894
- SHA1 d0e9a9e6efd1746bc9ccb4eb8e7701c1cd707e2e
- SHA512 d4bd002197b725316e1f1f2dd0a70ee44a82a53ac0dafa8c6b1166343adc406e147d0c4cca30d65a32aa545f1b327c6b69c0ec1d15330af48a6faa234dc4b5ac
- TLSH T1A911D500040092690264B6F7ADDDD89EB9503A4A698E369A2EBC482AB8214C28F4A02E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.fun
- Size 1KB
- SHA256 4e96529c023168df8dde241a9acdbf4788ea65bc35605e18febff2b2071f1e24
- MD5 62b1443d82968878c773a1414de23c82
- SHA1 192bbf788c31bc7e6fe840c0ea113992a8d8621c
- SHA512 75c8604ea65e0cdd9ea74b4802930444dd16a945da1e7f0af4a9a3762259ee9eb41ea96973555d06f4814ee2f6b73ab662c6b314b97876e9628fa5d4536e771c
- TLSH T1AD21DB8C5BD25644824A2AD04114476D11376751D8614C37F47C7D6762361F6F2195B6
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.fun
- Size 2KB
- SHA256 d153ed6c5ea8c2c2f1839f8dadcc730f61bd8cd86ad732bab002a258dea1d037
- MD5 bca915870ae4ad0d86fcaba08a10f1fa
- SHA1 7531259f5edae780e684a25635292bf4b2bb1aac
- SHA512 03f23de6b0ae10e63c41e73308b3844d49379c55d2df75fa1dc00771b26253d832c21081d8289f04260369df996e31273b7c0788cf3b5c78a27ec909f14a283a
- TLSH T19B513C1B207DFCAC23B911188D72551B723557123D86B5742245932F7677CA2EAD8D12
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.fun
- Size 848B
- SHA256 7a75b8ec8809c460301f30e1960b13c518680792e5c743ce7e9a7f691cfafc38
- MD5 14145467d1e7bd96f1ffe21e0ae79199
- SHA1 5db5fbd88779a088fd1c4319ff26beb284ad0ff3
- SHA512 762d499c54c5a25aba4357a50bb4e6b47451babeda84fa62cfbd649f8350bca55204ad002883b9147e78dda3dbabaae8da1dc94b716204226bb53326030772b7
- TLSH T1CA01DA102230D401748D272DD3049E55B113744A6FD1D379565C392FEDCFC75B385853
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.fun
- Size 32KB
- SHA256 a193ee2673e0ba5ebc5ea6e65665b8a28bd7611f06d2b0174ec2076e22d94356
- MD5 829165ca0fd145de3c2c8051b321734f
- SHA1 f5cc3af85ab27c3ea2c2f7cbb8295b28a76a459e
- SHA512 7d380cda12b342a770def9d4e9c078c97874f3a30cd9f531355e3744a8fef2308f79878ffeb12ce26953325cb6a17bc7e54237dfdc2ee72b140ec295676adbcb
- SSDEEP 768:G0/UcQ5N99TO/VAWPngk6pGemIpytzO2VnXoE6Yiif2U8tzVdiSl:cjTONA4ngknHUUyQXoE5N2U8t5v
- TLSH T131E2F13169EE435456F3C78B5CF49328AB62F7D0F76AA7A30F9A18620DF342150D1A64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.fun
- Size 160B
- SHA256 98b6c2ddfefc628d03ceaef9d69688674a6bc32eb707f9ed86bc8c75675c4513
- MD5 580ee0344b7da2786da6a433a1e84893
- SHA1 60f8c4dd5457e9834f5402cb326b1a2d3ca0ba7e
- SHA512 356d2cdea3321e894b5b46ad1ea24c0e3c8be8e3c454b5bd300b7340cbb454e71fc89ca09ea0785b373b483e67c2f6f6bb408e489b0de4ff82d5ed69a75613ba
- TLSH T15FC08C6A014B9E0F0B8A99A600301646A72AD831C151B007E67A1E9BA6AA6666220006
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
- Size 283KB
- SHA256 3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
- MD5 2773e3dc59472296cb0024ba7715a64e
- SHA1 27d99fbca067f478bb91cdbcb92f13a828b00859
- SHA512 6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
- SSDEEP 6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX
- TLSH T110549D9C366076EFC867D476DEA81CA4FA6078BB832B8207901715EDA90D997CF141F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.fun
- Size 8KB
- SHA256 36537e56d60910ab6aa548e64ca4adafdcabde9d60739013993e12ba061dfd65
- MD5 f22599af9343cac74a6c5412104d748c
- SHA1 e2ac4c57fa38f9d99f3d38c2f6582b4334331df5
- SHA512 5c8afc025e1d8342d93b7842dc7ef22eca61085857a80a08ba9b3f156ee3b814606bb32bc244bd525a7913e7915bdf3a86771d39577f4a1176ade04dc381c6d4
- SSDEEP 192:FSgNbwp27vLa0nMdhWNBPh0X4f4ht6VfJHYwiP8bIpu6Ev0KrDj:FnNbwp2/HnMdhWN1h0XG4hix4wmFpu6g
- TLSH T10F029E5D52CA6AB63C3B8FB69378A11E87F234CB332445CE41AA263CA3D5195D4148BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fe98c2e6-eb02-45ca-a4ff-f237e998aac2}\0.1.filtertrie.intermediate.txt.fun
- Size 16B
- SHA256 dae6420ea1d7dbe55ab9d32b04270a2b7092a9b6645ed4e87ad2c2da5fdd6bae
- MD5 1fd532d45d20d5c86da0196e1af3f59a
- SHA1 34adcab9d06e04ea6771fa6c9612b445fe261fab
- SHA512 f778cd0256eda2c1d8724a46f82e18ab760221181f75649e49dd32e9a2558bec0e9c52c5306ad17b18ab60395d83c438742103fe9adddf808e40c3d8384ea0b0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fe98c2e6-eb02-45ca-a4ff-f237e998aac2}\0.2.filtertrie.intermediate.txt.fun
- Size 16B
- SHA256 58e3090edb9316d9141065ac654a08169f2833091e6eb3a53b5a774a61b7e30a
- MD5 f405f596786198c6260d9c5c2b057999
- SHA1 f8f3345eb5abc30606964a460d8eef43d3304076
- SHA512 a0b3573dae218ade265709a6fdee5f7700c9754eb10747de5af34af340ae95909d0a8902159a735e82eb5d7091f50a7997113661a7ec3fcc2b408fb6c78a4c39
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336129678611126.txt.fun
- Size 77KB
- SHA256 88ee8257fcf0f57b7b2af2843c74b3cd69afd8a7e71d4fc8d5fc8f666ea679f5
- MD5 3f8facd30ab75a447bbe05974c98f4fc
- SHA1 3b86c22392898ec5173114cf50bff0f7ad758107
- SHA512 045d954be179d88d59a6ad5d9bf8053e9fbe7041bbd1882eac409aaa50dc28c90c41706b1d95c64ab17501e416d8426d11ea76631371d2b3aff11d930e71b7d8
- SSDEEP 1536:/RIKW1zn0oKxy0WIzt49Fp845CeydzgkJm6W3uexKf+FJDTOP:/RPWwIe6jp8C+hWAfuZY
- TLSH T1E37312A6F70376A6103E20DFA7D1D1AD8297364C117159E4FC87DB0D4B4A9AEC8818DF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336131008568956.txt.fun
- Size 47KB
- SHA256 67befed349a1e529aa03f9bc05c564ddf25dcc257589cac1786f6c72c4c62e39
- MD5 32f1f4400a4faa7497fec57861bf2148
- SHA1 f69157a83886dbb23d7ec477b660ba53d92ac3f8
- SHA512 113e032e37449df6fcd991c354d4d89bfb3fb6aa99ba1aa359ad0a1cdf65d964989979bb9a17051186e31a4de815db7b71eb55462ac074e3d98ff870b9d21f54
- SSDEEP 768:CYX8pAknPZz3yoqdquPPIbY3/mes0Z2edo8OliLx+ftz0dh3LmervX8nNf/h6asc:CHpXLCREq/mZ0Z2ZiLx+FzGhVrvX8R1/
- TLSH T11723F1C107C1E45332EA92F7C7572DA9E58A4687FC94779AF82618CA4E56832035FF23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336139911646035.txt.fun
- Size 64KB
- SHA256 9440316d29702970dff6894d801abaef3cd0dfb1f2d877d02415485ce9cd3efe
- MD5 96d9846d236a832a8cf1116f98fa54fa
- SHA1 94e599f2f77886b8e9382b47f069e34fe6c83dec
- SHA512 662ff37f3cf782d13a7ea953befd6e6143c7f2b3e452519ec0a5c1db41184786a80ad0081f3589bd519f8ab4a59079fb3d10ecd852ba49258798062cb17852b9
- SSDEEP 1536:Ous/tLSG8VRgX6Gx/+8xfUGOOx7gPzx2a5a9rp:O/tmG8sX6GxG8xfUByMrS91
- TLSH T1045302219CE9FB529973653838C321B72F1E23A48844B5BA91CC4673DF98480F5338F5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{1DB049AC-19EB-463E-A3AF-18E61CEA4C66} - OProcSessId.dat.fun
- Size 16B
- SHA256 619e246fc0ac11320ff9e322a979948d949494b0c18217f4d794e1b398818880
- MD5 8ebcc5ca5ac09a09376801ecdd6f3792
- SHA1 81187142b138e0245d5d0bc511f7c46c30df3e14
- SHA512 cec50bfc6ad2f57f16da99459f40f2d424c6d5691685fa1053284f46c8c8c8a975d7bcb1f3521c4f3fbdc310cf4714e29404aa23be6021e2e267c97b090dc650
- MD5 SHA1 SHA512