jigsaw | 0921add95609d77f0c6195b2bec474b693ec217abb1db496f367c768bfbe7cca

Analysis

max time kernel
112s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-01-2024 05:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0921add95609d77f0c6195b2bec474b693ec217abb1db496f367c768bfbe7cca.msi
Size

1.1MB
MD5

a362de111d5dff6bcdeaf4717af268b6
SHA1

2e5104db35871c5bc7da2035d8b91398bb5d5e0e
SHA256

0921add95609d77f0c6195b2bec474b693ec217abb1db496f367c768bfbe7cca
SHA512

b48a18158a0dff9a9012952c467fcf69b8bfc53ceeacaf32a90fc4b7f3afd34465e676b282fa87f3c5c85b4780baf96cc754dcdeef77ba5330fa8c4fd1d20b72
SSDEEP

12288:w6yilXxt+i9uJB5XladYq15U+F54Sy3JItYzpm+zF4KSlgNY/k09L4:byKtb9gXdqjF54/JuOplFB09

Score

10^/10

jigsaw persistence ransomware spyware stealer

Malware Config

Signatures

Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
ransomware jigsaw
Renames multiple (3733) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	Wire_Transfer.docx.exe

Executes dropped EXE 2 IoCs

pid	Process
3204	Wire_Transfer.docx.exe
4176	drpbx.exe

Loads dropped DLL 2 IoCs

pid	Process
4160	MsiExec.exe
1508	MsiExec.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe"	Wire_Transfer.docx.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_auditreport_18.svg	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-30_altform-unplated_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GameBar_SmallTile.scale-100.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-48_altform-unplated.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7d5.png	drpbx.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\HeroAppTile.xml	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\jquery.ui.touch-punch.js	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\ui-strings.js.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\16.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\SmallTile.scale-100.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_newfolder_dark_18.svg.fun	drpbx.exe
File created	C:\Program Files\Microsoft Office\root\vreg\powerpivot.x-none.msi.16.x-none.vreg.dat.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-30_altform-unplated.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-30.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\nav_icons_settings.targetsize-48.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-125_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare71x71Logo.scale-125_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-72.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_altform-unplated_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\example_icons.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_close2x.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-80_altform-fullcolor.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-16.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.pdf	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyCalendarSearch.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_altform-unplated_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\SmallTile.scale-200.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.scale-100.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-96_altform-unplated_contrast-white_devicefamily-colorfulunplated.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-100_contrast-black.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\rename.svg.fun	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pl-pl\ui-strings.js.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-30_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt	drpbx.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.png.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.scale-100.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-200_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\hscroll-thumb.png	drpbx.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubSmallTile.scale-125_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\PlayStore_icon.svg	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-cn\ui-strings.js.fun	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\nub.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-400_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSplashLogo.scale-250.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\[email protected]	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_close_h.png	drpbx.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.fun	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-80.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\ui-strings.js.fun	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_fw.png.fun	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js	drpbx.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\autoconfig.js	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-40_altform-unplated.png	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\warning.gif.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\SmallTile.scale-200.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\check-mark-2x.png	drpbx.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{6CC1D7E5-F55B-405E-8E29-8BF624B41193}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F06.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File created	C:\Windows\Installer\e576e5a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e576e5a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI730E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI735D.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000cdbedf05adb60d680000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000cdbedf050000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900cdbedf05000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dcdbedf05000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000cdbedf0500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3036	msiexec.exe
3036	msiexec.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeShutdownPrivilege	920	msiexec.exe
Token: SeIncreaseQuotaPrivilege	920	msiexec.exe
Token: SeSecurityPrivilege	3036	msiexec.exe
Token: SeCreateTokenPrivilege	920	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	920	msiexec.exe
Token: SeLockMemoryPrivilege	920	msiexec.exe
Token: SeIncreaseQuotaPrivilege	920	msiexec.exe
Token: SeMachineAccountPrivilege	920	msiexec.exe
Token: SeTcbPrivilege	920	msiexec.exe
Token: SeSecurityPrivilege	920	msiexec.exe
Token: SeTakeOwnershipPrivilege	920	msiexec.exe
Token: SeLoadDriverPrivilege	920	msiexec.exe
Token: SeSystemProfilePrivilege	920	msiexec.exe
Token: SeSystemtimePrivilege	920	msiexec.exe
Token: SeProfSingleProcessPrivilege	920	msiexec.exe
Token: SeIncBasePriorityPrivilege	920	msiexec.exe
Token: SeCreatePagefilePrivilege	920	msiexec.exe
Token: SeCreatePermanentPrivilege	920	msiexec.exe
Token: SeBackupPrivilege	920	msiexec.exe
Token: SeRestorePrivilege	920	msiexec.exe
Token: SeShutdownPrivilege	920	msiexec.exe
Token: SeDebugPrivilege	920	msiexec.exe
Token: SeAuditPrivilege	920	msiexec.exe
Token: SeSystemEnvironmentPrivilege	920	msiexec.exe
Token: SeChangeNotifyPrivilege	920	msiexec.exe
Token: SeRemoteShutdownPrivilege	920	msiexec.exe
Token: SeUndockPrivilege	920	msiexec.exe
Token: SeSyncAgentPrivilege	920	msiexec.exe
Token: SeEnableDelegationPrivilege	920	msiexec.exe
Token: SeManageVolumePrivilege	920	msiexec.exe
Token: SeImpersonatePrivilege	920	msiexec.exe
Token: SeCreateGlobalPrivilege	920	msiexec.exe
Token: SeBackupPrivilege	1532	vssvc.exe
Token: SeRestorePrivilege	1532	vssvc.exe
Token: SeAuditPrivilege	1532	vssvc.exe
Token: SeBackupPrivilege	3036	msiexec.exe
Token: SeRestorePrivilege	3036	msiexec.exe
Token: SeRestorePrivilege	3036	msiexec.exe
Token: SeTakeOwnershipPrivilege	3036	msiexec.exe
Token: SeRestorePrivilege	3036	msiexec.exe
Token: SeTakeOwnershipPrivilege	3036	msiexec.exe
Token: SeRestorePrivilege	3036	msiexec.exe
Token: SeTakeOwnershipPrivilege	3036	msiexec.exe
Token: SeRestorePrivilege	3036	msiexec.exe
Token: SeTakeOwnershipPrivilege	3036	msiexec.exe
Token: SeRestorePrivilege	3036	msiexec.exe
Token: SeTakeOwnershipPrivilege	3036	msiexec.exe
Token: SeRestorePrivilege	3036	msiexec.exe
Token: SeTakeOwnershipPrivilege	3036	msiexec.exe
Token: SeBackupPrivilege	4020	srtasks.exe
Token: SeRestorePrivilege	4020	srtasks.exe
Token: SeSecurityPrivilege	4020	srtasks.exe
Token: SeTakeOwnershipPrivilege	4020	srtasks.exe
Token: SeBackupPrivilege	4020	srtasks.exe
Token: SeRestorePrivilege	4020	srtasks.exe
Token: SeSecurityPrivilege	4020	srtasks.exe
Token: SeTakeOwnershipPrivilege	4020	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
920	msiexec.exe
920	msiexec.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 4020	3036	msiexec.exe	94
PID 3036 wrote to memory of 4020	3036	msiexec.exe	94
PID 3036 wrote to memory of 4160	3036	msiexec.exe	96
PID 3036 wrote to memory of 4160	3036	msiexec.exe	96
PID 3036 wrote to memory of 4160	3036	msiexec.exe	96
PID 4160 wrote to memory of 2472	4160	MsiExec.exe	100
PID 4160 wrote to memory of 2472	4160	MsiExec.exe	100
PID 4160 wrote to memory of 2472	4160	MsiExec.exe	100
PID 4160 wrote to memory of 3204	4160	MsiExec.exe	101
PID 4160 wrote to memory of 3204	4160	MsiExec.exe	101
PID 3204 wrote to memory of 4176	3204	Wire_Transfer.docx.exe	103
PID 3204 wrote to memory of 4176	3204	Wire_Transfer.docx.exe	103
PID 3036 wrote to memory of 1508	3036	msiexec.exe	102
PID 3036 wrote to memory of 1508	3036	msiexec.exe	102
PID 3036 wrote to memory of 1508	3036	msiexec.exe	102

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0921add95609d77f0c6195b2bec474b693ec217abb1db496f367c768bfbe7cca.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:920

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4020
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 404842EE440E38791D5780EF4D3A8A05
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Windows\SysWOW64\expand.exe
    "C:\Windows\System32\expand.exe" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:2472
- - C:\Users\Admin\AppData\Local\Temp\MW-d57c59c9-ee18-4242-bb14-39c4d30a1fb3\files\Wire_Transfer.docx.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-d57c59c9-ee18-4242-bb14-39c4d30a1fb3\files\Wire_Transfer.docx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3204
  - - C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
      "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\MW-d57c59c9-ee18-4242-bb14-39c4d30a1fb3\files\Wire_Transfer.docx.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:4176
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5EC97A8CA5380E2ABF7F32A1A2233366 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:1508

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.fun

Filesize
720B

MD5
61947d0907c945a6df0f1d86b894e4c7

SHA1
fd488589b551ef61957bc329d1a10a4dd20481db

SHA256
cfa663ff1da533b46726d1761848a327ff515ee7dd4bb395a9430f6cbc568bdd

SHA512
296a37e91d1fbce5e951413e09b240db31eef5ff88ce783a506cb40151dfc394465e0ba617f8d2ce4310a1432b969d88873e74905012b65492cdccd11a874981

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png.fun

Filesize
7KB

MD5
a842db7ac1990b29e2c453d22188eafc

SHA1
562adae12978c15a03c541c86a930d306d1a3618

SHA256
577aceff95acfa55f729b8c56d5a5848d55d76ac0664b7ad4e32f1ffbc6729f3

SHA512
21639cb95779a49f24fa1fc74e2c26eba8040800b2f3fcba8815b41a915cb7710d2d528d00fb9d3acce8a74ce155a83e0f1b24fd7f4614934405d10211a19554

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_ie8.gif.fun

Filesize
7KB

MD5
f13b68445c6a611c58b69d0663adcd41

SHA1
f4405939a8ce9d73be0b9e95bc694c0e3187d4f5

SHA256
dfa70d2305ea3cc4ceedf503877087e358697aba61f28e6afe310af68dddfcee

SHA512
c2e8e3fda0588bf6bf8385c654a245a597ba146e5877943db63d0f2177833de3a1e0f6118d318071f07a2c0a107001bfeac901119e036b15ebf5dfa6b7795f28

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_retina.png.fun

Filesize
15KB

MD5
c8fc25207f8ceecd9227242be2efbac3

SHA1
46f774b5a0f7cbd381d4434ce8e50de84c3c0c12

SHA256
bab54850e29f9ebc93b283187ef71904745c380cf99f7b2fa75de22a59ed3d97

SHA512
8ebfe4584beb21ad2a82da8ad799aebb00e52b5c819775f4df6dbf6dd2435f45514cbb15747baaea6018d476f43ea2c7ba66f6103b551ccf55ae3642167bc653

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png.fun

Filesize
8KB

MD5
b5d8672c3a1c0c03ea94ed8e7545b730

SHA1
95dc280bb5e13b9979952cc20f30f6830f184901

SHA256
fca20ec5c665941480e92223fc4719aac0b3235a7f115d2574d7129e7e6ee348

SHA512
de8da4e24416eda326404a717e77a8d810aa6f995c5fd545c9da1ef8cb47fa9786628d3ac3273f165167e4ea4f63532303f07518c85f8198adbfd89f0342f7c3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons_retina.png.fun

Filesize
17KB

MD5
ce629e483860631759ed4b212ade9bfb

SHA1
f5b4a74fcd8a4c203febcbcf808d2581959ab442

SHA256
5091a8ca0d8b0b72af4059110ad2197a423e2ddf8c8cc15e6a7f468c3fb2a78e

SHA512
d530e96e76b674605c4cf5ec30288ad4ea93399021ba88d68961cee3b158aed0e56729925a025ab355a888dda8d668780723aa3decfdebbeabfb6d5109504b42

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.fun

Filesize
448B

MD5
cab6c8585046fdcc0b2600cef0cb22aa

SHA1
2b0ce8b6523310938dceeec9fb9c9d864acc2f6b

SHA256
628b2ec6f6336318df443543de6a8a1d16e3b3400753e75a54e7a68cac604720

SHA512
8a88ceb9ec69d8f3cb6ac5965d7498fecb83e9c64f18d96c385ffffd9eae8fcebdc382c8a2c4b4b45581995fd1bc77e0afb0d3c568a6ce2907543092b3e6f992

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.fun

Filesize
624B

MD5
363b1b98d976980f0af736f587e99651

SHA1
4c9dbdd0523152e757c445a0495cb0572306b5f9

SHA256
bb70106809438ed5d550b69ae3d5119ecb46c75f7d8e0dddddd18e2967df73d0

SHA512
ca1c0b3690e7c9ce985a7f6ff2af321685d365d5ce61d700d2d17afd231cce067c01372faf43e2634414e3e6aa0c1ebdcadbdcab7c46eab759d6e4e584030e7a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.fun

Filesize
400B

MD5
296b9b5580cc931820d1a1e62c29c41a

SHA1
484d786dc7196520072ec4a4952ec96d88ed6e26

SHA256
a36df9606a73c204e04696b1930d23c3581d33876d2b1510c9d324996186247c

SHA512
58e4b6c8014c9413540733003a2075c74ce9170bfdcfc27db79b795616988d91f58b7f3234183850a24a6b38ef2b4befdc61bae828a0d50bb79e729e51e458ca

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.fun

Filesize
560B

MD5
355f9c4064151c7089fbe1126af0cb77

SHA1
b138c3b0563efc29dc3ed24180dcd46cec5819b4

SHA256
0d8584a9d9fbf7c7b0b54f69b308da3204281c93aa1bf2f83c02e129c73a987e

SHA512
cc39d40c5058cee42fd451210b64def65499a5e2abe1475426aa88b65305e3b0a7572b7a0de15756ab68660d899bfd0c28fb62c2b6920c98d0a7e1896e292905

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.fun

Filesize
400B

MD5
b9928ad5ffa158894354df8b8ff6b23f

SHA1
e228563a9873a502801dda31c3d33be880080251

SHA256
e1a2e7cd9fe8586b95860da7c13d7b9407797ab253573c24fe423c8bc4485cf7

SHA512
d18f4fe5500a0cd70092f22f414895782cb8f3f3040c627a21ddafb1295faa146bf158e8b71ed4741f53c096b13d24d1046f7c6d6753fe0fe9a72b496f1093a6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.fun

Filesize
560B

MD5
2e7765187796a13a10d805e0ee978a6a

SHA1
c7a8e4989068703a552b2cfe13e2411a621114f2

SHA256
cf050c014f972d74e2e9ef5aab5dab5ca46fb1344d07539aa4071305f51d2b9e

SHA512
73fd7b93efc84fb8a7c63eca4b51c85a33c85db58c2e98161bb2045ad06fc60479a0cf672346a0fd9ee30ed4cd28e565310921315180400cab56561ce0f9ed40

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.fun

Filesize
400B

MD5
d86ab3c169ebf736f5109312a9ce1c27

SHA1
513eacceed79aeba7c7ef521759d65e73edb368b

SHA256
aca7c25306834d60e990bbff5a59d35171811a4cd764cd6f19ed7f3d60678a6c

SHA512
ae27bd93e06be3c9e392ad9ed852e5b06828ab298a7e91ea58411b04cc7997858f6d3e891212a044dde51307f9cf759fb18e90c6d3afa7e78ed8f404116ec0c4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.fun

Filesize
560B

MD5
ba92eb229413a4997d609cb7c32a262b

SHA1
7e3d458cb15bdd2b4dfb48cd636b915f1e216d69

SHA256
307ed4b76842f00b9b5ccbdfee3dbe845027badaf9fefa0f270ffdb37d053195

SHA512
4d532be35dbee30672cc2734717c827cc1ba3e9961fe5068bc21b0826edfceaabbf9e8511ed60b03522fa8f02f3c028c5c815727628a29217a8a843200ae3925

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons.png.fun

Filesize
688B

MD5
79928359f473ca412b6619daa126ea4a

SHA1
55d1f1d741b2327b2853a26b9c55712460ab6433

SHA256
26bc3338fa8e8f825c0e8fef85c572df98afa06dfd09dcbf6be0be93a0e7644e

SHA512
6e976147cec5201ed7d9543db2b335d007dc159f571e7df373d4efd28625255c53e47d76e21ff514de08887b15995111ba68ae0b047678d5c64387465729e52e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons2x.png.fun

Filesize
1KB

MD5
27c2ae5ec13d9be007de8f3bd3577b19

SHA1
0b4fb7f92ed8c9a72bb48a2b6ff4dd0eeac45f5c

SHA256
9bc2e43816cd6586b50b94902b7beac1291a4123b9ca38fa2f3cb6bf647cb9a8

SHA512
832d67e486247748c3eafff6c9c0b3a039203c349c31677d26361e0f66c1e0e1e671f637be9c6dc22687b7ec77cd3ac4bc1a2d7eeac3e67204b79dfc2f664e4d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png.fun

Filesize
192B

MD5
840221d27a09a3080a93c1f4bb265f5e

SHA1
6ed12d47df1500f7ad56ce0e3e43fa803dc040c0

SHA256
9999fa3e8b7b136d9688bc0bb42a144fab43263998c28850facdcf0def8d6360

SHA512
cc4afa07c610dba58ac80779196edaf2a745c733bcbb3b1a581ddf36c0a3f4e79a70e93ee448074d3f06f25362919140288ba59e71fc21a89ba46688434db7d7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png.fun

Filesize
704B

MD5
a967c33396482152971c0a3dd54053a2

SHA1
2d8cf663746ad928d0ebfcf87af685988f540aca

SHA256
107c2a1239238755e33ce29ef7b000935ede80dc9fdf544182d01e5c330a5a6e

SHA512
63e990a4d044c2414571481e6fd40bf30d1bc59c009b6b497eef062c9b2b3443005caf0dd014055d2da08e2f7e8a12d7c324f6c63430b1bfd95d14088c9b7162

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png.fun

Filesize
8KB

MD5
a48c79d6485aa84f70909e0deac5afc6

SHA1
5885dd3d8553862554312632d40b04ecc583e09e

SHA256
02f138096bc96757a83a6b42e855007d6f4fd1c8390c220fb5f428219253d573

SHA512
3615eba5102df9ad4bc8aafa4c43ad3a43afb617f49607789c8a6c0fb80d0fc4f5a625ba27600b5e7f6ef302dfdedee3022d61ae202dfa6c319762befc31ca46

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png.fun

Filesize
19KB

MD5
a5b25141ae69df8e8627814bc7da55e7

SHA1
862ab0471f3d3415ded16e77f2542f84023fe8ad

SHA256
bc2276d83723961e25e621e4400a2aadefb95f1e38642ba2fd8c4e7f83dda6a1

SHA512
b9b0b0c3e5bf9026e684ef38ee576aab142ccb9a19759834d30771df121a0f87167d298bfda2d341055c1949e203102e88d5195a53ab96eb18ec2c6e70d614cc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.fun

Filesize
832B

MD5
f9d942430d103eb14bb89a8b06dd354c

SHA1
28c8f183fc1c03eb2f69dfc662c0d47f25dceb9c

SHA256
30f745264662bb65ea8e073548faa9cbb594394fe6bb8f238fd463cd4b19a16b

SHA512
51994cfee07ebe1f030eb609f5d70c42b15f7f4d7a7e7e82c44682048b405ccc52cc33aed16ac21ac189d378eb93db093e32c50ece0d1c6bb5687fa1451ffea5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.fun

Filesize
1KB

MD5
254e6e1f919c82e7e6386148f4fd8b85

SHA1
4b16f83c625875047f0e397bd22c318e3dc401f5

SHA256
6fd7ad452179754ac6fe6ee17a1e9ca7277173e23096153ab776cb5c572f19f5

SHA512
b9d8f88e89da06a98685ef2dab1f85115defd342d09527fcdf81712b000800fa1350db0ba085e2fc9df29ba0da394346a9d2c68395a3f9509d525e155d986ca4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.fun

Filesize
1KB

MD5
c8df49bb4bbdc9da2bcab074f61beb09

SHA1
7bec3ca11d7533d9853d2a9a6ba2dfeb7d8201a8

SHA256
ef67108356c94c9c8826ab0a667fb88add02381715a352f9be62ee92ad781647

SHA512
53b472bdc116931819173f7385d23a8becfce39f63fcd451962bc3c6d0e117fc5f2e7ae6dac3297bf778bb35b06d5d514c10dc882ed3a5d958f8f5cdd979a213

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.fun

Filesize
2KB

MD5
5a7c257c74c8c7d5352b57cde2f0b55c

SHA1
ef9cac32cb1329bef6857173abee2fff4cac3ac6

SHA256
b2a557b40c73eb81ca22b167c4a6ac1f43622c59b2d85e5f43119769c6d6b6f5

SHA512
031764f3fb1194d778a84a294df4e0509ba00e50ddefe3a6cf7a655f48219cc38e53f5c47a56646d6ea63275ed56d19328c7b82f14e717a688d6181093764928

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.fun

Filesize
2KB

MD5
2ac07813a74d6adaa3e44db55e899e09

SHA1
a0447b0b95d442c2d770987b1e007826cdae98a2

SHA256
b770a96d153a9e662d5a586e571ba9687a0995b9dccf3f50afdb5dba8da465d9

SHA512
940e4a99d233d99b1b342c4a8d032ce70f66ef0134d57b3c13f1cdde780453e32f54f442fe9255cfe73cc9e478f72f707a383a156aa924a95ffbd3cfc840a94c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.fun

Filesize
4KB

MD5
2613b34bca30302406bbfa57c93b6c0f

SHA1
04a4e32759eb78be5d4397916bc9e51090fa4333

SHA256
53bbcb949a287d7ac25e7a31d671cd9eb11ac609f7344a38aaa5c2f165dc4093

SHA512
4c170f25c9d3238cc6572ff5522495effab28c7e0047a44eaba8939d2da46950ff9f8f1329b923d82b0b8a3e28de735dd41ebaf83711eb20b2fa52ba82f23855

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.fun

Filesize
304B

MD5
e4e7837a4f0c71864f2ed00e23aae8e0

SHA1
c35796c887fb94fc2112caf3921ba504570dde1e

SHA256
e69aa05159c50cb7dc9083dcd34a21f811aa80ca24e67eda8fca86c244d9a483

SHA512
296817bbf0f9faafa16577edb105f560be7a27ded19370efbbe9e14657fca5c202d3f19d0f001de5d9119fdef304e099bafda922135f679b487afe05e36d4fbb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.fun

Filesize
400B

MD5
30c5fafcb889cfdfef7a7373c623221b

SHA1
e4a12b7ef07ca5780ebe205201be538a34fc6154

SHA256
b2bf549220418c47e80507084b43eeccd85c0a43f4da74de6858fc96dd3020af

SHA512
4a621fa79335711dab7dbde3bf0fd30979b15c2f48eff9b867a0cde99ddc67a97d612ea0472db9903c5cb5555800907b8a183cf499f55d186a42fe0ad6fb023b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.fun

Filesize
1008B

MD5
3c501b84ed7912d164470fb2024d29ba

SHA1
f54ec8a32fe7a67acfcbd48e789c0b5d2c0b6816

SHA256
d1ba5eb730cc20b906290b76d64d2697896cc25ab4d782588f98c62c9b7ea1bc

SHA512
cf9adc56a6685c7f5131d703238752700cfe9b32133ee38f6e828b658dbd64af9732509a47abee3958c5cc22f3685f10cc27a1d5d76f7459b99498310fb6cdb9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.fun

Filesize
1KB

MD5
242c795c3e07e4f7e1db97121e007727

SHA1
c0704070f2026d817b82f71878e334be06bab551

SHA256
2ab2f7f6b540d3bcab915e7626db8db6ed71736ba7da94ce2ca4366d440cd822

SHA512
8b990d5a35b324ebbd5ee6d6d88d74e783e211f3c778162dfdf1577e2d3c6cc32693117fbfd1175ad34d7bb46e05504e8ccdcdc116a6895eee31f50d583289cb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.fun

Filesize
2KB

MD5
a06ee81cc9009bcac3c9a5af0dab2b1d

SHA1
b95ada870dd0ebfd4058b6710076d750186ca151

SHA256
c82b8a9a8fa45f93bc000a754e07e9922fc1788f9d54bcdd0b4c6869145c613e

SHA512
b4271b58a89b37e2c48584778eeb08668e2d32026f98990fb017215e854a7006184f09149e478bd95a5b15027e308b61982f5a2275b998174bdf281736edece8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.fun

Filesize
848B

MD5
fe2afee9fcdf2d43940944ebd1145480

SHA1
986b8b7ce80ec8b8e223f95b508532e69cd49c05

SHA256
116b7fbce50c3c08cc73efca3439106f4f2e00012794fbad81ebff4598066a42

SHA512
b66aec41ffabc4d1566b2316de80efe3528d2ad5dd8b0030d1a127d58c0f9257c8b76ca7c301199e92213eb35f1d557a85062dc8c432e5c554590f0a91d2ceaf

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.fun

Filesize
32KB

MD5
aec7bd7c96948d97d13c7df53988e89c

SHA1
7b906b88009e7509324ae92dc8a32ae4fb38626c

SHA256
15fcb7c77cf60f287e9c81ec8053a9cdd1aa8bc0413734e8a1499a9de635c6d0

SHA512
27d12f825c16d1d5349f53a23d57f71eb8d4534a1ae4af2c4eead9cda09a4440dadc518a8887a3ea818494cb6319fc82ab8147cdb85958e9b344400b7d6b2803

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.fun

Filesize
160B

MD5
000e8c41d4a15fb34d0be0dbb56e3778

SHA1
00c4eae64ee6239d7c65d819c6ce1ac329224f8c

SHA256
8bdfa6a5b7de345cf0d4fe0e9c17d8b0e9db26d58b05b1b2ebbb3a05a068ff28

SHA512
775d832eb8ab73e4a93789917dca69edb6c91fbb426e02acf7c6e213ffb4575776187209d1c471fbf57c4621ea3c23d9850f6dfc2770d62c17de9d66710800af

Download Submit
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

Filesize
169KB

MD5
fbb034304d233d33977fa71f4c80d248

SHA1
18518d6673346efc3caed783dca509c8d5504ee3

SHA256
db07e858d71a07516970aa564a2ede4ff702c35386968e8b3effcd1562c9fd98

SHA512
94141dbd6213b726aa247e9ad8acf9ddd5a4dd4d7fdc5c09f637aff950b7b6135271dfe33a7dc2e3fcfd8e1953a2dbead636b6d4bb62c1dc16ce89110131759f

Download Submit
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

Filesize
203KB

MD5
61ccaf582d1aa75df3199a7c982d795f

SHA1
9e3456a0d957636ceeba2a41f94570fa665c1b76

SHA256
bbecbb4ff66caebf419fb95984d8038f1cd835e620773ee1c269e27b61df4c66

SHA512
74e7bd0e8adbbdf647b923f0bdf990278b55b02724f13de39074252b3e110d5d557792f4d64490a8ed6fefa40998a79b4de24356efc87cfd6a2be72f9946b3db

Download Submit
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

Filesize
132KB

MD5
e3cafa58e284102081cada58d482cc92

SHA1
c479f099f7a1dee52cf42356e324b02ddc32f2e6

SHA256
eea94082f55f7d4333a935903417dad5fbc898190318f1db8e0408782382d88a

SHA512
95e28168fa9f2a4c564b16c44d10fe9dfe7936bceb616d10e5b643bd48f33c58459e3bf24ec47428d895544b1daab3b7ae91acfac9ecfb3d8ef812ab1accc0d5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.fun

Filesize
8KB

MD5
420960c4b17842a24bbf117222c60e47

SHA1
4e2f5bc3a3fe7da4ea60dfaae851b1b88e48751d

SHA256
e94c37d7dc8dd954bfee8e340abc882bc361baf0d3771ed442ed625a3bcb0174

SHA512
b42f16f6fca9b66d49a2ad7c80e56c51e04d023a4ae50e984dbd267e204682ecbb929fefb5c7ee67775597773b08b6bd39416f13b87f1782cf8c5d553ecd7ce5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{7f0b0531-6830-451a-9b7c-630b666dd27f}\0.1.filtertrie.intermediate.txt.fun

Filesize
16B

MD5
9817c637ea440822e5d3ff2144d17467

SHA1
84080fede70d3544aad82976cec9b51c83c472ec

SHA256
df1b3b60351e48245d6ac589c68ddf77dba1aa9ba12427405b90daa9143d8252

SHA512
399bd0074e50829c3f5b5000c5e6da863de969adab921b5244da53ae35661ffbc24687176ecc1411f0da78d6a186c999846d454c365500f9833607095a0f2373

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{7f0b0531-6830-451a-9b7c-630b666dd27f}\0.2.filtertrie.intermediate.txt.fun

Filesize
16B

MD5
2a89b7646b4d795f4bfc5bb4269138e7

SHA1
ff1ffe4b11ab6094419b961bcdc9b923369293bf

SHA256
9dd722337fac6f6363c0697082384f6866d27ad7f5f3d541cb494c91afe14c16

SHA512
4a2cfc5c842227c576b3f93962fa38001db85ae56f5989880e6938c31cc77718b69d94c900cbe150d2126d1952242450981bf2f3f148909b5e056d69579bf3d9

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133471124561211919.txt.fun

Filesize
77KB

MD5
43e18c134ab449f3b8aa8e2bafa21504

SHA1
85b53f85cdfdcecee67fe12f7a806a73b1067584

SHA256
e68a944897646d65e0f174970ed8a66c5ee80f6c60cab7fa713c80adc282bb1c

SHA512
0dc9c60e39ca911414cbd8118033a11d5bb8e57e58bc2d1064be8ba3c97d65514b442d10e86ee4ed36762bd275f84ab4e759ab49f5db079e07b9644288d3311a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133471126443266927.txt.fun

Filesize
47KB

MD5
0cd983711e421993ee5dc9d27de77e86

SHA1
2da4cccc82e37e5be747dc1a908ed08779c21b14

SHA256
88c30949df40aa6369b912775077ada944b40d8a8bb3fbdf7dee75143586d3ac

SHA512
e5d567c8cd8d60b15297cef39aa3a25f6acef1ee57b90d8363747a79aa0866df5be3602f2cc83fd710d36e5a5504dd625f1e30461c2633669cb096decf388ed9

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133471131189256905.txt.fun

Filesize
64KB

MD5
5256c4cdd028f2a6b432c85323e7978d

SHA1
4c86e015771a5be8aa6ea428dbc0025f5a1d0ac1

SHA256
4d3c4f3d597044e0724e97765b4a20865b1a2b9eb2aae6203197799f526b4533

SHA512
8203f7a146006df35e22180c098a178bf987ace25a19e92b04364092ebf01a6556b42ce2c48d4d50d18ec1b9e842043c15a55ba1430e251f4c9231d26e2da859

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133471160693255159.txt.fun

Filesize
74KB

MD5
5c9144e00a1a56b5250dbeb9ae482c9e

SHA1
42a37f9b0de1ac684eb4d48cb801184bbe8cb409

SHA256
f6b749c1d3c21d005f62dcc905723bf65288db51354693726a9c2eee121c5282

SHA512
be7265d29a31545300c1c40539dd86bec73b9de5c15f51e0cd89aba19664921ca6fd4a95fecdf8a0d7969d0a22bea75104700a7a8fa95534f24a347c518dde2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-d57c59c9-ee18-4242-bb14-39c4d30a1fb3\files.cab

Filesize
45KB

MD5
131f9756f68eecb06e93b9a43d0a12b6

SHA1
7a45ece9e62c737c207c7390523b396358976172

SHA256
aa3190f3735ce5b59c6f890f81cdf227f846a28bf18e41775fdfe4afa0545a2a

SHA512
65cb0ee62c7d09df252a185e83f0960445d6a139de6ca81c550e932e5fdb3a1c27a45b41e93cf080c7051bfaba6d42bcf83074aefde44cd7fbdc792cfd182acd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-d57c59c9-ee18-4242-bb14-39c4d30a1fb3\files\Wire_Transfer.docx.exe

Filesize
282KB

MD5
fba7f5f58a53322d0b85cc588cfaacd1

SHA1
da2617cb96dd02a075565de6a704551fd7995dab

SHA256
1fccbea75b44bae2ba147cf63facbbcf1cc440af4de9bde9a6d8d2f32bde420a

SHA512
c9a4cb9076aeccff2cd1409dcdd8046ffa524ce768459443c2d69f21ef9c3fc899e2db19bed0377852e8e626436a80d9f192258e7e320fd3e252c0073eb762db

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-d57c59c9-ee18-4242-bb14-39c4d30a1fb3\files\Wire_Transfer.docx.exe

Filesize
57KB

MD5
56ae48fafbfee3c2c3d988b22c24f2db

SHA1
c58bf022ccf5bd71b4fe4cb2212889f9019440a7

SHA256
0d804c6bbbe3a8465a8a303ac8451f8743c37c1eb2f25f213ff941fe0cb8871d

SHA512
41454abb594f40f339b57c5cf232304ffd59b25cf7bfed2dc752571d8453678359073a30e7b2800b6e1a308f74a2d5bafa922bf81ec4d10e75275142e885ab01

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-d57c59c9-ee18-4242-bb14-39c4d30a1fb3\msiwrapper.ini

Filesize
513B

MD5
5952215c3ca021b53aab16a521f94294

SHA1
cf8823521973a3b87549d6523dec8aae7990c63d

SHA256
112644dea3715b0e2f7e344fb994ee9991fc0636c8cc8f563f1184cd75908d9a

SHA512
ab21befc2ff03149209444bd717a8f1b7a95aaf585e6ae3aed7351e6549988046cbb5fe9cfe2d5ffdfb6cb75056a5a6e4d7eda1e1ef21720088fd422f54a2803

Download Submit
C:\Users\Admin\AppData\Local\Temp\{754DD6CB-E507-43EC-B60F-9B7AE378B705} - OProcSessId.dat.fun

Filesize
16B

MD5
cfdae8214d34112dbee6587664059558

SHA1
f649f45d08c46572a9a50476478ddaef7e964353

SHA256
33088cb514406f31e3d96a92c03294121ee9f24e176f7062625c2b36bee7a325

SHA512
c260f2c223ecbf233051ac1d6a1548ad188a2777085e9d43b02da41b291ff258e4c506f99636150847aa24918c7bbb703652fef2fe55b3f50f85b5bd8dd5f6e3

Download Submit
C:\Windows\Installer\MSI6F06.tmp

Filesize
58KB

MD5
2e0aa0c30e28b54546b41a6f46f74adf

SHA1
64d1ee51e309a909ac0aa0360a06e286786efa79

SHA256
f582e2796a6ab650ff23f196d38b5c881d4475a89561ca7bd31d67de336900ab

SHA512
d0a095467064bcfa3dc0660c0f288f7b5f7d50a43ca6748a40791b77f8ddf25ba9303e733ee11482dee460d4516a0c4333dc907f4ab14a715b5e711d13fc5318

Download Submit
C:\Windows\Installer\MSI6F06.tmp

Filesize
53KB

MD5
ac7c63f8958acb5ebe2fbb7073f1ce4a

SHA1
0fce0ca2915e36672924952b13cd5ff03cd0e795

SHA256
9623fb1308c3df9dee09b1993d8133db0eb8fed30b526be8ae82cfc2d27926d1

SHA512
1bc174e5a78a06c1d00d57b90358ad998d0fd704f0c2f10af74fe311715f504ea0436c73564a92c3713204cf77ea4c8eaabb6f92d2500938657cf48bff6a9ad0

Download Submit
C:\Windows\Installer\MSI735D.tmp

Filesize
84KB

MD5
342e0be754bd786cbbe93c5a40c7f71e

SHA1
899b4cb32d82f0a14384586f0ba6853eb23ecfc8

SHA256
9af7493b764b7967c342bc3fde391c32b27882c1cdab2d4f8ef394f66913cf05

SHA512
9e8a2ec26416b35729d8c6ae83c6222d9fefd0775b3e1d97e71a24b6f908036849700b635e4d2a8ec1cbe3e0200b73760e7108ba51de8d579b922520f6bbbfbc

Download Submit
C:\Windows\Installer\MSI735D.tmp

Filesize
244KB

MD5
fa59d49079031002e8c1edb80c68c5d6

SHA1
5695c7b80d37401c444a75a4a237d9b52274e8bc

SHA256
40543a4920df015f97db152f00ba2106f3cc885f42b028dfe11d44aa59b2f04e

SHA512
bde48bac7d810ceb9bb5bc30d18d18360833e7334d3a7b9d971043fd6d412d8a85427b04f5e038c8e99533a6444152aae8220b3d112a5b0b6175ab9c2dcf0539

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
141KB

MD5
379235abfc0396ad2d09da181ed05c21

SHA1
86bd1928b7161430ab2233917744f41596248ad8

SHA256
e621a343b37d46bd0200e38966062cc01d45f68384f87cd8fad3e000d6b77950

SHA512
7adb323896ad4a10f5d5f4ae838cdc6d7d5cd96c437d46df81a69308a894e0496522be9a2426a2a0df4e00e231e30ca2c44c7c3a5c6541ef53f99db971d9a70b

Download Submit
\??\Volume{05dfbecd-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{53d9df83-46fc-4452-862b-bb9e23b10ad1}_OnDiskSnapshotProp

Filesize
6KB

MD5
e63a0a11b61b9004786b0f6e95ad07a3

SHA1
271b835ab3f097d3f02e6c2237a1adb31aa72284

SHA256
dd387aefbfc9e364f0603c92ec9416761d50812d1cfe5129e823a7b3bcebf640

SHA512
62fa40ddb38448713dffe8e9cf5586a48b94cc0b1156fe8e361a74b89d36369fcf12ae7cf78f99fb09773747b8c74c5693e4f5540faa6c08e29aada7850b9702

Download Submit
memory/1508-77-0x0000000074840000-0x0000000074915000-memory.dmp

Filesize
852KB

Download
memory/3204-47-0x000000001B690000-0x000000001BB5E000-memory.dmp

Filesize
4.8MB

Download
memory/3204-48-0x00007FF95B240000-0x00007FF95BBE1000-memory.dmp

Filesize
9.6MB

Download
memory/3204-65-0x00007FF95B240000-0x00007FF95BBE1000-memory.dmp

Filesize
9.6MB

Download
memory/3204-50-0x000000001B0A0000-0x000000001B13C000-memory.dmp

Filesize
624KB

Download
memory/3204-51-0x00007FF95B240000-0x00007FF95BBE1000-memory.dmp

Filesize
9.6MB

Download
memory/3204-49-0x0000000000AE0000-0x0000000000AF0000-memory.dmp

Filesize
64KB

Download
memory/4160-13-0x0000000074840000-0x0000000074915000-memory.dmp

Filesize
852KB

Download
memory/4176-335-0x00007FF95B240000-0x00007FF95BBE1000-memory.dmp

Filesize
9.6MB

Download
memory/4176-330-0x00007FF95B240000-0x00007FF95BBE1000-memory.dmp

Filesize
9.6MB

Download
memory/4176-67-0x00007FF95B240000-0x00007FF95BBE1000-memory.dmp

Filesize
9.6MB

Download
memory/4176-84-0x00000000012C0000-0x00000000012C8000-memory.dmp

Filesize
32KB

Download
memory/4176-66-0x00007FF95B240000-0x00007FF95BBE1000-memory.dmp

Filesize
9.6MB

Download
memory/4176-3827-0x00000000016C0000-0x00000000016D0000-memory.dmp

Filesize
64KB

Download
memory/4176-3828-0x00000000016C0000-0x00000000016D0000-memory.dmp

Filesize
64KB

Download
memory/4176-3829-0x00000000016C0000-0x00000000016D0000-memory.dmp

Filesize
64KB

Download
memory/4176-3835-0x00000000016C0000-0x00000000016D0000-memory.dmp

Filesize
64KB

Download
memory/4176-3836-0x00000000016C0000-0x00000000016D0000-memory.dmp

Filesize
64KB

Download
memory/4176-3837-0x00000000016C0000-0x00000000016D0000-memory.dmp

Filesize
64KB

Download