jigsaw | 892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90fc6ae0

Analysis

max time kernel
2655s
max time network
2660s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
08-09-2024 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ipscan-3.9.1-setup.exe
Size

17.6MB
MD5

e9fda12cfcceffd2e6a19c39dcb01b1e
SHA1

ae007dba80a0fc03e44a22db3f4e53ed854b4b38
SHA256

892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90fc6ae0
SHA512

93cba11d265414ae99635c974ac5edb6acda22cc13d3f71474f887230b0e32c4c87035db1822c27fb500d5b83c27c2c2deddfd789208457e8618aca15c914285
SSDEEP

393216:HoWnc4nxmXzdw6ikbYvVZwaSrQ3tINEUWfFxr/WMUT4eR:HoWdnxudJbY7Tl3tICrWMUMeR

Score

10^/10

jigsaw discovery persistence ransomware spyware stealer

Malware Config

Signatures

Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
ransomware jigsaw
Renames multiple (1481) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 1 IoCs

pid	Process
5272	drpbx.exe

Loads dropped DLL 3 IoCs

pid	Process
3940	ipscan-3.9.1-setup.exe
3940	ipscan-3.9.1-setup.exe
3940	ipscan-3.9.1-setup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe"	jigsaw.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
25	raw.githubusercontent.com
49	raw.githubusercontent.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-black\GetHelpAppList.targetsize-16_altform-unplated_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Dark.scale-150.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-white\FeedbackHubAppList.targetsize-64.png	drpbx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\add_reviewer.gif	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-48_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\PaintLargeTile.scale-100.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxMediumTile.scale-100.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-unplated.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-256_altform-unplated.png	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-125_contrast-white.png	drpbx.exe
File created	C:\Program Files\VideoLAN\VLC\THANKS.txt.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\LockScreenLogo.scale-100_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PaintAppList.targetsize-96_altform-lightunplated.png	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsSplashScreen.scale-100_contrast-white.png	drpbx.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\Store\SmallTile.scale-400.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SnipSketchAppList.targetsize-80_altform-unplated.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\WeatherAppList.targetsize-20_altform-lightunplated_contrast-black.png	drpbx.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\COPYING.LGPLv2.1.txt.fun	drpbx.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.White.png.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-36_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\contrast-white\MicrosoftSolitaireSmallTile.scale-125_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\NewsAppList.targetsize-20_altform-unplated.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-white\GetHelpAppList.targetsize-96_altform-unplated_contrast-white.png	drpbx.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\forms_distributed.gif.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-125_8wekyb3d8bbwe\SnippingTool\Assets\Square150x150Logo.scale-125.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Square44x44Logo.scale-100_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Illustration_Seasons_Summer_Left.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-60.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailMediumTile.scale-150.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-30.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\CameraAppList.targetsize-40_altform-unplated.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-80_altform-unplated.png	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.VisualElementsManifest.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-20_altform-lightunplated_contrast-black.png	drpbx.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.fun	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\AppxBlockMap.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\ProfileIcons\{9acb9455-ca41-5af7-950f-6bca1bc9722f}.scale-100.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-white\PowerAutomateAppIcon.altform-unplated_targetsize-24.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-32_altform-unplated.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\NewsAppList.scale-125_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-16_altform-lightunplated_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Tentative_Dark.scale-200.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-80_altform-unplated.png	drpbx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-white\PowerAutomateSquare150x150Logo.scale-150.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-125_contrast-white.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-24_altform-unplated.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadAppList.targetsize-40_altform-lightunplated.png	drpbx.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosStoreLogo.contrast-black_scale-100.png	drpbx.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\VisualElements\SmallLogoCanary.png.fun	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-100.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-32_altform-unplated_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\Icons\StickyNotesMedTile.scale-200_altform-colorful_theme-light.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-100_contrast-black.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailLargeTile.scale-400.png	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptySearch.scale-150.png	drpbx.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipscan-3.9.1-setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 36 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-242286936-336880687-2152680090-1000\{4B49E4F1-57EF-4F00-9D03-4FB7B5E6A2A1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 = 8c003100000000000259417e110050524f4752417e310000740009000400efbec55259612859d6822e0000003f0000000000010000000000000000004a0000000000c668a900500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\NodeSlot = "3"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Petya.sln:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Jigsaw.zip:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\Frfx\firefox.exe\:Zone.Identifier:$DATA	jigsaw.exe
File created	C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe\:Zone.Identifier:$DATA	jigsaw.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1832	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
6028	msedge.exe
6028	msedge.exe
5948	msedge.exe
5948	msedge.exe
5332	identity_helper.exe
5332	identity_helper.exe
4028	msedge.exe
4028	msedge.exe
4412	msedge.exe
4412	msedge.exe
2020	msedge.exe
2020	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5252	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
3220	OpenWith.exe
5252	OpenWith.exe
5252	OpenWith.exe
5252	OpenWith.exe
5252	OpenWith.exe
5252	OpenWith.exe
5252	OpenWith.exe
5252	OpenWith.exe
5252	OpenWith.exe
5252	OpenWith.exe
5252	OpenWith.exe
5252	OpenWith.exe
5252	OpenWith.exe
5252	OpenWith.exe
5252	OpenWith.exe
5252	OpenWith.exe
5252	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5948 wrote to memory of 1700	5948	msedge.exe	81
PID 5948 wrote to memory of 1700	5948	msedge.exe	81
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 1648	5948	msedge.exe	82
PID 5948 wrote to memory of 6028	5948	msedge.exe	83
PID 5948 wrote to memory of 6028	5948	msedge.exe	83
PID 5948 wrote to memory of 3772	5948	msedge.exe	84
PID 5948 wrote to memory of 3772	5948	msedge.exe	84
PID 5948 wrote to memory of 3772	5948	msedge.exe	84
PID 5948 wrote to memory of 3772	5948	msedge.exe	84
PID 5948 wrote to memory of 3772	5948	msedge.exe	84
PID 5948 wrote to memory of 3772	5948	msedge.exe	84
PID 5948 wrote to memory of 3772	5948	msedge.exe	84
PID 5948 wrote to memory of 3772	5948	msedge.exe	84
PID 5948 wrote to memory of 3772	5948	msedge.exe	84
PID 5948 wrote to memory of 3772	5948	msedge.exe	84
PID 5948 wrote to memory of 3772	5948	msedge.exe	84
PID 5948 wrote to memory of 3772	5948	msedge.exe	84
PID 5948 wrote to memory of 3772	5948	msedge.exe	84
PID 5948 wrote to memory of 3772	5948	msedge.exe	84
PID 5948 wrote to memory of 3772	5948	msedge.exe	84
PID 5948 wrote to memory of 3772	5948	msedge.exe	84
PID 5948 wrote to memory of 3772	5948	msedge.exe	84
PID 5948 wrote to memory of 3772	5948	msedge.exe	84
PID 5948 wrote to memory of 3772	5948	msedge.exe	84
PID 5948 wrote to memory of 3772	5948	msedge.exe	84

C:\Users\Admin\AppData\Local\Temp\ipscan-3.9.1-setup.exe
"C:\Users\Admin\AppData\Local\Temp\ipscan-3.9.1-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffaa8c73cb8,0x7ffaa8c73cc8,0x7ffaa8c73cd8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2624 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=1280 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6448 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1908 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1716,10182624998457582190,13924068950343265343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4748

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3220

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004D8
1⤵
PID:4276

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1616

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5252

C:\Users\Admin\Downloads\Ransomware.Jigsaw\jigsaw.exe
"C:\Users\Admin\Downloads\Ransomware.Jigsaw\jigsaw.exe"
1⤵
- Adds Run key to start application
- NTFS ADS
PID:6004
- C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
  "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\Downloads\Ransomware.Jigsaw\jigsaw.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:5272

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\ApprovePublish.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.fun

Filesize
32KB

MD5
829165ca0fd145de3c2c8051b321734f

SHA1
f5cc3af85ab27c3ea2c2f7cbb8295b28a76a459e

SHA256
a193ee2673e0ba5ebc5ea6e65665b8a28bd7611f06d2b0174ec2076e22d94356

SHA512
7d380cda12b342a770def9d4e9c078c97874f3a30cd9f531355e3744a8fef2308f79878ffeb12ce26953325cb6a17bc7e54237dfdc2ee72b140ec295676adbcb

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.fun

Filesize
160B

MD5
580ee0344b7da2786da6a433a1e84893

SHA1
60f8c4dd5457e9834f5402cb326b1a2d3ca0ba7e

SHA256
98b6c2ddfefc628d03ceaef9d69688674a6bc32eb707f9ed86bc8c75675c4513

SHA512
356d2cdea3321e894b5b46ad1ea24c0e3c8be8e3c454b5bd300b7340cbb454e71fc89ca09ea0785b373b483e67c2f6f6bb408e489b0de4ff82d5ed69a75613ba

Download Submit
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe

Filesize
283KB

MD5
2773e3dc59472296cb0024ba7715a64e

SHA1
27d99fbca067f478bb91cdbcb92f13a828b00859

SHA256
3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7

SHA512
6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262

Download Submit
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe:Zone.Identifier

Filesize
86B

MD5
1d726d00a7033a5dab753d6012eee269

SHA1
0eec68c618a8c4d44299dfb8415b9add0eb03863

SHA256
fcce59c5531bcd9542bc0fcd0427669e9527e71384a83a31199d91f157a01928

SHA512
c50f27a7ed7f26f928fe740d4086c863e7a3c5e86d85cd99ccb83534e6d58b662cd0e4608ac4729774d7028cd4b62e38349e94c67c80a8ecec9c5d637b1b0a3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea667b2dedf919487c556b97119cf88a

SHA1
0ee7b1da90be47cc31406f4dba755fd083a29762

SHA256
9e7e47ebf490ba409eab3be0314fa695bf28f4764f4875c7568a54337f2df70f

SHA512
832391afcac34fc6c949dee8120f2a5f83ca68c159ff707751d844b085c7496930f0c8fd8313fd8f10a5f5725138be651953934aa79b087ba3c6dd22eaa49c72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2ee16858e751901224340cabb25e5704

SHA1
24e0d2d301f282fb8e492e9df0b36603b28477b2

SHA256
e9784fcff01f83f4925f23e3a24bce63314ea503c2091f7309c014895fead33c

SHA512
bd9994c2fb4bf097ce7ffea412a2bed97e3af386108ab6aab0df9472a92d4bd94489bb9c36750a92f9818fa3ea6d1756497f5364611e6ebd36de4cd14e9a0fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\42a3c2f9-f221-4ec7-9c1d-78d579a39679.tmp

Filesize
1KB

MD5
5f7e05b40c13c7146dc96d9db9e60634

SHA1
ab5c39b027d7520a10d3e4ea3387ea2607b53d01

SHA256
649e61d97a49ae9cf7b50a2184db33697e155a06d36604de578abba7ea0e42ff

SHA512
de3db7dd13ea709ee57012eb5d127bc3c84b43a6e30b700c8bbc8a3c927922cefbbd43dd08e9c5c0b7326126375d73cbae2807bb7f31ec7725fe38c4a17532af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
929b1f88aa0b766609e4ca5b9770dc24

SHA1
c1f16f77e4f4aecc80dadd25ea15ed10936cc901

SHA256
965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074

SHA512
fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
43KB

MD5
edf3b94d12feda9fec733db26bcfee48

SHA1
b8a381a326bbdcff3e6cfca8c4e2951bc75e3084

SHA256
1402cb49197f078fc86b8522c42006091fb0c091922f420f78c6e1728e005adb

SHA512
7f8fb7d5de19adf67a504d81fe504430aa8a9da1909e12ae15b0f02aedd0ec732e6225742cd1afb054e29a3f6819605b1ddc0835729e176fdd4975fc71feb17a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
38KB

MD5
bff21faca239119a0a3b3cf74ea079c6

SHA1
60a40c7e60425efe81e08f44731e42b4914e8ddf

SHA256
8ea48b2ac756062818bd4ee2d289b88d0d62dc42a36cb6eee5bdd2ff347816c7

SHA512
f9e5baefacae0cdb7b9c93afc43ad6ec3902b28c0cdf569e1a7013f4e5c8dfb7b389b5e2bc724b4ddfe554437320f4f2cc648642944c6f48ad2a78815acd9658

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
1.2MB

MD5
54ab7882085a32f5cd524f2d2b2fc3a9

SHA1
53f6361c4164915ffe0280f5e5ce8493b4d8a2a7

SHA256
acfd68f910c785cd62015bed7c3fb922fdc9431329a429691a15078b8ce8b03f

SHA512
1d6980b6e1e62bc24ad4cb95e06eb2309097d6eb5154f80bcd43af26a0e4e12d8099f8602136e2f9cc8cfbd42ad6044c5ecbff2146bf60cf9312d2c8df6262f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
18KB

MD5
2e23d6e099f830cf0b14356b3c3443ce

SHA1
027db4ff48118566db039d6b5f574a8ac73002bc

SHA256
7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

SHA512
165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
4301736617be0e0146c6916d5ba9483d

SHA1
cba3ea000e07e36481008ba8a2c37b95811231ee

SHA256
521945119507b4ab2f43f88f0c1800b58d99ab34d2c23a1843c9e7a4db2071b3

SHA512
42a34ad01d21fdc447005f681fd585ec013ecf0e142c8548fbb9d5b78c59956607d95931aae3688911adcd68af3eab4cda837d2fa738fe8fa775eb8649163b82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
1ff436b72ed61ee7ad10dd5e6d025802

SHA1
62538ccb76ace1ee20ebf8d1b92279858f7a8594

SHA256
3383ed1fd84aadeb0253a7d95b251d6c849077639df08cda149cf31df989fd46

SHA512
c190e86793c1767933c8fab3656997d8d1cb04916448268d629b4c2915eaff4c58e39ffa31691701d3b267dee57c35b28eab1fe8113f66a0029334dda0e09397

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
176af210e7cef62876616ed9fec701ac

SHA1
437a884db5835d303c978f23fbe138970617260f

SHA256
f53d7b95bdc09304068b8e9803e52fb5f6dedd45281e38c0520278c6726e529f

SHA512
bd63b1c98ec4d9317d8b2451607eab696137238470aff2caf57c83816e97b738bc115876565f60476a328855055656e01b474fa886e86f00687478caa1e73fdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
133c42a62c9c8bd5261093863b6a98a8

SHA1
00fe7e54704042e3b71ed2a0dd08d167cc7d031a

SHA256
6e88b431bbb1b334170347f21141bf1e8027d0ecd0ba4a0cf0ce04cddde12fee

SHA512
57f703f4a54715a34006f612f0a6e85ab15117065013e6facf5656edc9cc7322e76e38e3be6b5e59e7f018c3b21ab61b40c31c4b02c302d7a01e10ef20a6a9f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
958B

MD5
af8616fd8770d660f98d6ad16b68b15f

SHA1
1ff886fe17bb234d18165c763a08a4610190a17d

SHA256
c0333e91fede8cdd85553b389b76ee46818da9ab5709fd266726d8e8849acc7e

SHA512
1cb3160e0c2ffd7639a9942991720b3fc56653cf2448de2e892c4a0601d53b8f8aca8c3f75d41299758d78619e9aa75ee30fec7f0957e7dc63153d244ac28fc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8723bff6941861a2d14eba2294e9486b

SHA1
4872b9cfec86faf710e3803356905a9404d32f1e

SHA256
297e261f514d5cdf0aba89b0ab7064f7647e06118c6bfd6941b21ea11c1286d4

SHA512
02ea80d5783c6fe27dd686a6c044807ca219a78ec077800c2b763cd562c6e4e466ed2305b8ae83e30cee0e6d8710c79d128659d5d6f37ef1863831d02285556c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fa53f0e2f315f8e10669b372df3092ef

SHA1
4874282e6d96efd0e5f13362b59d40a863567ba0

SHA256
33d22cd5224f5731ffc65299692c77e09da5a6144a4022695a8cff0e157deb97

SHA512
d12404a3d4912e3f6980a3fe2c78d7e14140b1ca5d7857f6e578510d2fa26967794029ed1846ce451cf7c929faef8d18d3ceb0896aad943d63dd3edbd7deba7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
904aa96bdee7c257e594b8009a2e5259

SHA1
dddb915edc3b14cde0e5bee07efade516b372f4c

SHA256
657c78db0570ae1fb96b1750063fa98bdb125d94e5a9fe8f2b3a511d72de79ca

SHA512
4f45492ae35adb7502387a8737fe5afd696e266ea1be46d849aedbd8a835f187efdecb1f5b914ba371877684551a71a7ae0d8085aaeade6331d7e31e3c67a1bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
654aa3dae29705973290c77b2bf716d0

SHA1
6aff0619dac709c5c041cf733bbcb6846fc2c703

SHA256
be7a83ba80f42506534c4399869b0258b9915567428499d445ab95e744e81209

SHA512
69333561c30fd61c16364b980629c705b15df1d606e2dc4624c436796486cca8a12620ad2930bc335d3eeb5c52293262953ae35830aa6c0a63b4eba8c9189694

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
be814f6b21fcf0f931fbaf70f4983d24

SHA1
64a2a84ba79d539185928da06e723619f65f15b1

SHA256
2746ac57edfd0bb98e938e7fda6fd6ba992b18a0f55748fee95db4d1289bef40

SHA512
16860be8abe5b78ddb172ac39f4abd69aa7083bd567cdc585c8e0336e0d4954576cec12a3b676133c23533932debd64b7edc2aa0ca87ae827ad31255f757266e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e3ac9bab24419ce65a1b1d46766d13b9

SHA1
45cb16872bb13444a2b5a25094e01e4b6fa6a44f

SHA256
6948a7d1ac82e8af06f67508bca94f6c8546f9b85c9be13c43ac1ca7e4bba1c2

SHA512
89e27a0220c506df5d8fd1ca2e8c9f15f23398d7793d599663c25b2c686f18520a39d831acb25a95f91828f80fed15a1b3219e6a1f015a74cd78384332059ac0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1fe5cbc080fbac28514273f377ad85e1

SHA1
186b2d1922be82c4d897863dff9c22e38442938a

SHA256
4510723295de6d5bdca095d0bb26e3aa18547de26988b09415fb1fd46212fd9e

SHA512
d517bd3549afee6482e317af7cb04aeb9a95b73aff9831fd1d02abcfc546697c847b8b42a47768526e73bbc17935d75c902bdc5ea9868a67dcbb97280a39efb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c30a55a68067dfaacd42b5cc0878ed11

SHA1
ed735965bd4bbad0fd52a130a2c3ff968c78ad35

SHA256
e9ee08b411a3b64610246e47f33795344e7f4d652df2fb6d89d769a305002a62

SHA512
ab2bff945db3c790ce9add3bb0a5ed33c277e046cd8ac5826ed56ab8d9593873669f0236cd3b151cb91a1f37cde69c4a8fc3ca1accd7dc68e452ac1a784f25d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
68701c87a97143d421511dd4c38d279e

SHA1
d3cd5ef2076574c8e95d6951ba3d2446e5dfda83

SHA256
59eb4b7677429906b580c04a8df630b747424e829bcb741eb37f8603aecff6c8

SHA512
7c7f63ec49fd8a0369c7bf919157acf430053b1967ed11e8e368013e230b01601fd6aaf5e8fe1fea59127d597273883148c1eb53c6e132a76f5abfecbd0023f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
504d92eea4ee4047b9bde20d233834f8

SHA1
ed239872f101e55440706a1633958995cf24b0b9

SHA256
a84e8aa36dfbe7e781e05af83ff685048fa927762d8e23d318ba351cffd1431c

SHA512
fb46ed9b289561f3b184c966359f0378e07f35fad7d45a7139668526fe517f3f318849bf2169c613715be7524177f560afd908ab00a977287da8067a750f2361

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1f228c262e0616078678cd1aa2bad4d4

SHA1
1b677d5ce4d1cc7de99cbdfa40a0bdacab30ab9a

SHA256
e9ba25a43c1cbc4e5a6e7d90e412d61474ad1062c23799941c715688c927829e

SHA512
d5268f29194b1b8725e25e455a2a908c780c4f5dcf768a4ef6eb1a1b678f1938db62e01518bd5a3224742bea8924ba75999e89a77d148551201012f03a100351

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
989e45d265c8dfd4e22450c3740f03f2

SHA1
8a86eb6fe9629cbff4fe00f94caff18e6cba2d9e

SHA256
542f99defd8936a4ad1d99700775e62ae77be33e2c82f6c5f26b462237f0a836

SHA512
aa1024cf5df1b5775a4d5748e969e33e8b271c09cfcd83fee0c08e5bea8e71df4c02ca9e7ea80b7018a148f7d0e07318c7d15747476ca75e4c894ab5283ae219

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
315c2d5079d41dfd19642adcc1a9d0a5

SHA1
7cc7fe630a2aa5c0ffc8be9f273432d2be06a6f4

SHA256
8444c2b6947fae838842b4f9ec2bad987b72249502b4687aa8da8d70efe99586

SHA512
1077e821a97ea3df58e3f0ea7bcb585a738bd1bfd6ad45addcd74e948a39bf5b17c64c5aff692f6e6bf534a05e91c2307d7984f32fd6de06c1fb2170332fa94f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
424cededb7d1f7bbbdb08a459c6e64ef

SHA1
362939aba9910e05c54136c7295e4dd62f8c94f0

SHA256
da8d022581fc3bb935661802cc95eae6719209f973590c2c8bae8a4ad620b090

SHA512
e39cbed03a74ea9a4eedb4507cf305527458544e3661a1270d05e69e0fc82b71513555ae180a79366424e7cfd4029c9e5190788a6c4fea115171eb6964050294

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
93f781f3070ef749a28b438163b93a46

SHA1
704f47c556d113285854f95c4e9b9063542de16c

SHA256
a61e2a2af773d1ddef4e2a40dc08010a71501b198da9e932f06e69b1fee958a5

SHA512
ac89b157d7ade2c026ebd2325fadaabaa3b8991b9886f506b8e092639d970f182510022de76ee09743cdf2231d23232ad56f1290b61c9822fdd2b4d640ffcdb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9f25e4f56d20c6a9f94643c6b3b617b0

SHA1
6366ffa846cf028708f0cfea6b0b2a1e19b9553f

SHA256
d8c964eb23d70d49525ae5ac7acfcd563c9a35543f1ff12db15158d79f23870c

SHA512
8b401b879df34ad455622ae62b71d7c3a59efdb451d213aa2e36de57b64f5d3d9cd23e77720476a80f5604faa2e058698bd37fe5fa662385fd39d724af74f87c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
386c6eaf3b205ae3b4e3660c46380ae4

SHA1
10f643ed524cd53b8ea5723d3763cd92fc012fa9

SHA256
327ad2a878bba3d94f6fae7a4bfa295582f1fb5c048e9ef29dbd8eec340400a6

SHA512
52279beb1e67887bfd6331876cb5a0e330c758ae01a12790321f2ae030f3233cdc0ec5a871632f8955ae167120a10113a3704d0c9d61c77ef2425d3660febeea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
05b1fd7dce7af54272a5dfc2d6268833

SHA1
6e4103560b5549d661a6179ee9af39c3f44a4c61

SHA256
a50f7927175770ad794fc3959a786a1880cec8b45f95c9ea49f725b5db911958

SHA512
03cff6a1a616ff3bfc68db385038a9f4ac0c947be20c9630353741eb54813547b74378c553d41c9aa49440a8a2f701b5ccde9cfc4a52e2e218a7a88310d1e40c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9c458c508a5709bc001aa4502d161ee6

SHA1
0fbef2526e89acded9b1a625eeda32b89fc090a4

SHA256
f7c30261eab456f2f64fdbe94771d56dad78725dddfac01b17f12fe590739102

SHA512
9131e6adbaa5bb937f3fdadaf9b625ca5a92f9a06159062515208d7c37b89740c24f275c162218939ce443aae79d25032ff701ac97ec16235556322acdfd36e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c44273d365da5df8b6e5cadfce44a542

SHA1
48b925522d4804b633b39e9116ec65cd7ba758c5

SHA256
49bcd9083e5dc1c659d9009aa52a432d5427d5f7ca1abb2efe5796f102723755

SHA512
bd6196996a3cf158248c9ce8115a8935d7884b040ed240435298c0ed8dbf94d322b5863a765d9f7cf83bb38132e484836f0f488a542941657f20cae5ceb3f907

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
260f59da8bf554b665087bddf74b2a46

SHA1
b5402b9c8deff78047446d1623a16fb9501a010f

SHA256
c983420f1cee8b3243fa5db8b3ab0b91856ccb9e65d46a4ea610f6adbb5fe42b

SHA512
ccbcce436d579e1ae9ac3937bf079aa49c3b91ef2b9928e4db492785343e2554a1297a7f8e6eb94d1a6ff67c832025118abc07539ae88a514fe4a1f1856a25b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
a5e6747a18abdc8e9688f2b79482015e

SHA1
aeceb61f9538a68804f6d6d391b2400d551395f2

SHA256
e30f881c1681035237c8a3d9d994e12efe77ae5a7ef91ff8975851c4d7e476bc

SHA512
6279648ea7630d6b40ab72567a99c3e038d0f3048a6545be156e93d2c98e29594caed4c635028c78a7d5d0062e0a90a713a5c7c853b226388df0fb7faebc07f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d4ad49523a7abc93684149405b43b959

SHA1
c570689be0288223c47a0c413a90fa1d22884d2e

SHA256
296bf0bf818dfd0253fdba9c6c812a14d737fa03693bde5e31d60fb2a61c866b

SHA512
03ab08d1adf450b6677c0701639527f42c203b346c9af2d9268464521483fa5eb7cfb67e98be14de6ee15b878a5e1f7d69f817d1aae27abefaab9f69ee8a85cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
48bf20d218672fbb3ae6c31122453d6f

SHA1
1c0df6330119531b1546c5c1b113d2d0cc47b75a

SHA256
7c15cea2e96bd6332539c670ca574715c0e095fbfdbf8a6f27ba6db2c41d377f

SHA512
b613d6912c2ec485aa014b180add55df7fc40fd496b23ee0480683db0ee6a3d425a750327e523869280498ccb8eea1ceb1f168f95276f99fe45d8f6f1e16abc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0cefe454584af592714d084a41dfbeeb

SHA1
4b45df49a98ff6f375405fb3559b903ce6ed2a87

SHA256
07fd143c7e6e2702cdb3d06fd16769ac8063841145040b56d163fd181aea5200

SHA512
2ce3fb9915ac2d34c46b5dc5f14c6e9d26067b8221ac10135cc7b390f775f6077d83b45a658dd81c7ac6d2d1321a6266cd38b0f7f22badb1e032282fd2a2093f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b61630b9cf204a206393b151f8d246f8

SHA1
8c8a765c54923c61de6325e4b4ee30ea372b8c9c

SHA256
050aeb2493377caddf58066367679d099a5c9d62b93161dcac77c3e67b4ac17a

SHA512
b5c7ee00f9ceff6e33c66e6f1a67ea509aee611324d1b6becae7ddc9e868336db3de1d1d63eb44d9ba0727907cb5771a4c259b18ed57ba57c738b2d5a10089ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a26f3106f80ff3c4c15d544d2c98a24b

SHA1
13264d6d637db9ec7b9dd5d476bc793acdd45e40

SHA256
0b9414532b8ef71dfdfcfb1ae55f4a051d84570f9b447f96a59278002ae535eb

SHA512
f21ae150b7bb3a7f2d7b90e7b564ababc5b9fcbc76e42ad82d2f02b046b1a23e1da137b4aaa85e7480765a8ea9fa415a129efac5c5ac6c1148898b671151df4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7d8ca603ecbc494d9eb5cbdd87ab0ed6

SHA1
cac0b3c40bcb510b2e822325e4b3a4735a6cb094

SHA256
8c0cbddf41a36aab35a85e0f2f8af31278e74568fc65b60271e0c81b42d0f4ee

SHA512
50f41c6671a6167fd6a474afeb9f73596a3a6aeb2c12768e164e50d0a2cd1d8954465bf7448072292f331ba07abf5a4f141396d50e336086b9ccf0b6555b7376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58995d.TMP

Filesize
203B

MD5
8449e934d7ed47bf576c898b2079559e

SHA1
d2d3610f44efcba30f5fb13cda7304d0909586fa

SHA256
1eedca68c90f90cdcf9a7272825954f2c4e5c213271a4a44165a9470257c436a

SHA512
6e5f467d2251d2429773727abaedf6309dd924c57d673f885b4736c9f6c36e1bbe9af1821a3c5c24ab05d465b1c208e890dc4f8831d14748bd64d91b21ce13c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
673ea492b4205791582efe5693d168d3

SHA1
77df67ec72d00c8d6430946804dcc8d61c4cf1d9

SHA256
1dc4f51b4ae78d36e197d53fe72aa1fb010c7555d6e618d0d73da7ad25e1cc1d

SHA512
72cfdf4e7cd0133b3d9aec5a55da5afd65e1d0681e822096f4d1916437dafc5e215eed992167d6bf592a11c666e6d4e2e9596a975da75983e75e5bff67b9c4b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
76256004033227103d78f3774c28b373

SHA1
0dfd4f6ba13d0d82b1e4e07e23b53c7e153ad054

SHA256
5d410d751441123214ac2179b8f94d789b45b38c58961e27eefecdecf7e26c6c

SHA512
c04746160bc90b2a32122b986e5f81afaf32504942fd8d87fc2e9a51fb0ea42b2ecd2cf3a2cd31e6edf9c381e9fdc1013c59b611c7f02fd8d86cb7bfa1a77973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2eb325c118e0d3dbaae735b6f990d1ba

SHA1
330d6f9eee90e31dccdebb31acce44744720f5bc

SHA256
cc8a5b889ddad7d2babcbd97154dd1ab21a88cf9ac92d0f263704c54137d59da

SHA512
f422732b2a350f220380aa42b195583638d646bbffd79d6cedb164ec19bf73b09c9ecf277507e6b9a8411f672057e450d858e1e4af2a8d2928d02df0d84f82be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ab9e4f8cee603634dc83e198f5c11149

SHA1
f60670173e0d1a775bec515b2acfe44289e322e5

SHA256
df293f1c8ded4d29e964596753689ffb715c5002c294fe1cb9e984b315985aaf

SHA512
f7b2518e58e19ddaedbd615ab99aaa769a42904f908113a0f01cdb5ceb21427cae67ef709847e99fdf9d5cbeaace6e497085f4c3d40faf8f99ada5ab6316dd9a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.fun

Filesize
8KB

MD5
f22599af9343cac74a6c5412104d748c

SHA1
e2ac4c57fa38f9d99f3d38c2f6582b4334331df5

SHA256
36537e56d60910ab6aa548e64ca4adafdcabde9d60739013993e12ba061dfd65

SHA512
5c8afc025e1d8342d93b7842dc7ef22eca61085857a80a08ba9b3f156ee3b814606bb32bc244bd525a7913e7915bdf3a86771d39577f4a1176ade04dc381c6d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\.ses

Filesize
53B

MD5
6faa99e9bc4b305a75a2ffb4c6daf115

SHA1
b5ceb94ae71a1bb75e5591d65a88b6b08e6214f8

SHA256
040dd459bc3cdb4bef14ac846b16969a1a6b04425e9c9896666e0f9760d9366b

SHA512
ab3f0fdd6e37144de7c0b27ddef490d1c6bdce87c43bb4042b28b52320ed505a829145a3e5654a5bc14d79d650a43d11ccccd8209279e6d59e3849b1cdd4a6b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1722612033.txt.fun

Filesize
16B

MD5
8ebcc5ca5ac09a09376801ecdd6f3792

SHA1
81187142b138e0245d5d0bc511f7c46c30df3e14

SHA256
619e246fc0ac11320ff9e322a979948d949494b0c18217f4d794e1b398818880

SHA512
cec50bfc6ad2f57f16da99459f40f2d424c6d5691685fa1053284f46c8c8c8a975d7bcb1f3521c4f3fbdc310cf4714e29404aa23be6021e2e267c97b090dc650

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883D.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883D.tmp\UserInfo.dll

Filesize
4KB

MD5
2f69afa9d17a5245ec9b5bb03d56f63c

SHA1
e0a133222136b3d4783e965513a690c23826aec9

SHA256
e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0

SHA512
bfd4af50e41ebc56e30355c722c2a55540a5bbddb68f1522ef7aabfe4f5f2a20e87fa9677ee3cdb3c0bf5bd3988b89d1224d32c9f23342a16e46c542d8dc0926

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883D.tmp\modern-header.bmp

Filesize
25KB

MD5
eef4016c57e63d26c53c90c6b51c31a4

SHA1
c9da4d5002141151790a9effaf48228b73ec3c5b

SHA256
2568602b57e7555655ebd77101de4db955ff2ab7c96b0c4d78a571a0e709e478

SHA512
025a94ef3ea023d41a273cfee65d4c194280c0dde80bc2b69aedcc95891887d9478df29c7588d23bf45031881e4c425367548f4e89888dbfd5c8005134967a15

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883D.tmp\modern-wizard.bmp

Filesize
150KB

MD5
571986bb6e3eed28c772e9dfa1b2d87e

SHA1
c2e7574f8713def6d8647a780d4b5d6fb54843a4

SHA256
8416e0209e7c1497ef84173f52b623eb38d86bab59886fe99317d8f557bf66f8

SHA512
2d2d5ec9e9627a0f7e3e3741bdfab4429cabffc0ab71c5968b87595d41be28ad29ae0dc5142710ad5718c6ef04cf76dee7a9b158d8b34c7a7d59eeaa7f66cf2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl883D.tmp\nsDialogs.dll

Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
47f7b2e7589ea35476aca59348091c12

SHA1
956601b24c5b5d5beb4c6c664f719dbbc084d91e

SHA256
d117848cb686b327d2c6e6408dfc4b095bb2e29489574c84bca594c2e3d93f01

SHA512
da9ca8069625dc5e34fa1a376b34e80c75c15a1322fbd79db4985f2a3c7fc040499e7c64ca8b5c90ff47885a9862b289b1f98978577a7af59adeb38fb7cd3f0a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
fed13b916cb3fdf0827f52a5aa0e9cb0

SHA1
91f217d3ee82826e28cfe35ef2dcc093b733a4e0

SHA256
fd4cbf6c21b6e835d578d20fd1139106935d4b94a6ee71041869f231aa310dbd

SHA512
0ab767a4c9dda9685258001ec95235398c443055f2b1026b866c417123e8d1d9767defd2aceea1ee852f03457454f7917f7041ae37c66e9443662bfd535ee984

Download Submit
C:\Users\Admin\Downloads\Petya.sln

Filesize
2KB

MD5
0c42f2ab6986f6035de0758a17192b61

SHA1
150ce0403a5d9389acb4ec193832997226d6de57

SHA256
04a82afa78eae4308316f8dcbf088482482d9a09d6e4aadbdaa1dad2d9a09640

SHA512
97f4cc96f0a8837c122c22068a57a5c07e2af0f269af55c26e2a0223c70298a28cda91cbf9a76f7303da996c532307813a6e68df34548a41fad1b463b6c6232a

Download Submit
C:\Users\Admin\Downloads\Petya.sln:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Ransomware.Jigsaw.zip

Filesize
239KB

MD5
3ad6374a3558149d09d74e6af72344e3

SHA1
e7be9f22578027fc0b6ddb94c09b245ee8ce1620

SHA256
86a391fe7a237f4f17846c53d71e45820411d1a9a6e0c16f22a11ebc491ff9ff

SHA512
21c21b36be200a195bfa648e228c64e52262b06d19d294446b8a544ff1d81f81eb2af74ddbdebc59915168db5dba76d0f0585e83471801d9ee37e59af0620720

Download Submit
memory/5272-1331-0x0000000000EC0000-0x0000000000EC8000-memory.dmp

Filesize
32KB

Download
memory/6004-1307-0x000000001BD40000-0x000000001BDDC000-memory.dmp

Filesize
624KB

Download
memory/6004-1306-0x000000001B870000-0x000000001BD3E000-memory.dmp

Filesize
4.8MB

Download
memory/6004-1305-0x0000000000B40000-0x0000000000B78000-memory.dmp

Filesize
224KB

Download