jigsaw | hxxps://github[.]com/ytisf/theZoo/raw/refs/heads/master/malware/Binaries/Ransomware[.]Jigsaw/Ransomware[.]Jigsaw[.]zip

Resubmissions

07/08/2026, 19:21

260807-x2n9vabl8s10

07/08/2026, 19:18

260807-xz48aavwcw10

Analysis

user interaction
yes
max time kernel
134s
max time network
118s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/08/2026, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/ytisf/theZoo/raw/refs/heads/master/malware/Binaries/Ransomware.Jigsaw/Ransomware.Jigsaw.zip
Sample260807-x2n9vabl8s

Score

10^/10

discovery jigsaw persistence ransomware

Malware Config

Signatures

Family: Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
ransomware jigsaw
Renames multiple (219) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4136	firefox.exe
4468	drpbx.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe"	jigsaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe"	jigsaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe"	firefox.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
57	raw.githubusercontent.com
58	raw.githubusercontent.com
45	raw.githubusercontent.com
46	raw.githubusercontent.com

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/files/0x001c00000002b3ae-435.dat	ConfuserEx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.fun	firefox.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.fun	firefox.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.fun	firefox.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	firefox.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt.fun	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\AppxManifest.xml	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\AppxManifest.xml	firefox.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	firefox.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.fun	firefox.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.fun	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.29512.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml	drpbx.exe
File created	C:\Program Files\TraceSearch.pptm.fun	firefox.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.fun	firefox.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	firefox.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.fun	firefox.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.fun	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GamingApp_2021.427.138.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	drpbx.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.fun	firefox.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	firefox.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	firefox.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	firefox.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	firefox.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml	firefox.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml	firefox.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml.fun	firefox.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.fun	firefox.exe
File opened for modification	C:\Program Files\Windows Media Player\Media Renderer\RenderingControl.xml	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.9.2002.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.29512.0_x64__8wekyb3d8bbwe\AppxManifest.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.OneDriveSync_21220.1024.5.0_neutral__8wekyb3d8bbwe\AppxManifest.xml	drpbx.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.fun	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\AppxManifest.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	firefox.exe
File opened for modification	C:\Program Files\Windows Media Player\Media Renderer\RenderingControl_DMP.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	drpbx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\meBoot.min.js	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	firefox.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml	firefox.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\connectionmanager_dmr.xml	drpbx.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceYi.txt	drpbx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	firefox.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.fun	firefox.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\AppxManifest.xml	drpbx.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.fun	firefox.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	firefox.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.28604.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5112	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306041571156871"	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{C5ADF1C4-0B60-4A8B-A390-C9974FEC5941}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Jigsaw.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Jigsaw (1).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Jigsaw (2).zip:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\Frfx\firefox.exe\:Zone.Identifier:$DATA	jigsaw.exe
File created	C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe\:Zone.Identifier:$DATA	jigsaw.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4580	powershell.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3824	WindowsTerminal.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
3824	WindowsTerminal.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe
492	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 4192	3440	msedge.exe	80
PID 3440 wrote to memory of 5112	3440	msedge.exe	81
PID 3440 wrote to memory of 1656	3440	msedge.exe	82
PID 3440 wrote to memory of 1656	3440	msedge.exe	82
PID 3440 wrote to memory of 1656	3440	msedge.exe	82
PID 3440 wrote to memory of 3384	3440	msedge.exe	83
PID 3440 wrote to memory of 3384	3440	msedge.exe	83
PID 3440 wrote to memory of 3016	3440	msedge.exe	84
PID 3440 wrote to memory of 3016	3440	msedge.exe	84
PID 3440 wrote to memory of 3016	3440	msedge.exe	84
PID 3440 wrote to memory of 3196	3440	msedge.exe	85
PID 3440 wrote to memory of 3196	3440	msedge.exe	85
PID 3440 wrote to memory of 3196	3440	msedge.exe	85
PID 3440 wrote to memory of 5016	3440	msedge.exe	87
PID 3440 wrote to memory of 5016	3440	msedge.exe	87
PID 3440 wrote to memory of 5016	3440	msedge.exe	87
PID 3440 wrote to memory of 2884	3440	msedge.exe	88
PID 3440 wrote to memory of 2884	3440	msedge.exe	88
PID 3440 wrote to memory of 2884	3440	msedge.exe	88
PID 3440 wrote to memory of 388	3440	msedge.exe	89
PID 3440 wrote to memory of 388	3440	msedge.exe	89
PID 3440 wrote to memory of 388	3440	msedge.exe	89
PID 3440 wrote to memory of 1384	3440	msedge.exe	90
PID 3440 wrote to memory of 1384	3440	msedge.exe	90
PID 3440 wrote to memory of 1384	3440	msedge.exe	90
PID 3440 wrote to memory of 3656	3440	msedge.exe	93
PID 3440 wrote to memory of 4996	3440	msedge.exe	94
PID 3440 wrote to memory of 3656	3440	msedge.exe	93
PID 3440 wrote to memory of 4996	3440	msedge.exe	94
PID 3440 wrote to memory of 4108	3440	msedge.exe	95
PID 3440 wrote to memory of 4352	3440	msedge.exe	97
PID 4108 wrote to memory of 3200	4108	msedge.exe	98
PID 3440 wrote to memory of 3456	3440	msedge.exe	99
PID 3440 wrote to memory of 3456	3440	msedge.exe	99
PID 3440 wrote to memory of 3456	3440	msedge.exe	99
PID 3440 wrote to memory of 4372	3440	msedge.exe	100
PID 3440 wrote to memory of 4372	3440	msedge.exe	100
PID 3440 wrote to memory of 4372	3440	msedge.exe	100
PID 3440 wrote to memory of 704	3440	msedge.exe	101
PID 3440 wrote to memory of 3460	3440	msedge.exe	102
PID 3440 wrote to memory of 3408	3440	msedge.exe	103
PID 3440 wrote to memory of 3808	3440	msedge.exe	104
PID 3440 wrote to memory of 3808	3440	msedge.exe	104
PID 3440 wrote to memory of 3808	3440	msedge.exe	104
PID 3440 wrote to memory of 2996	3440	msedge.exe	105
PID 3440 wrote to memory of 1436	3440	msedge.exe	106
PID 3440 wrote to memory of 2996	3440	msedge.exe	105
PID 3440 wrote to memory of 1436	3440	msedge.exe	106
PID 3440 wrote to memory of 1436	3440	msedge.exe	106
PID 3440 wrote to memory of 4792	3440	msedge.exe	107
PID 3440 wrote to memory of 4820	3440	msedge.exe	109
PID 3440 wrote to memory of 2072	3440	msedge.exe	110
PID 3440 wrote to memory of 2072	3440	msedge.exe	110
PID 3440 wrote to memory of 2072	3440	msedge.exe	110
PID 3440 wrote to memory of 1696	3440	msedge.exe	111
PID 3440 wrote to memory of 3676	3440	msedge.exe	112
PID 3440 wrote to memory of 3676	3440	msedge.exe	112
PID 3440 wrote to memory of 3676	3440	msedge.exe	112
PID 3440 wrote to memory of 488	3440	msedge.exe	113
PID 3440 wrote to memory of 488	3440	msedge.exe	113
PID 3440 wrote to memory of 488	3440	msedge.exe	113
PID 864 wrote to memory of 3824	864	wt.exe	117
PID 3440 wrote to memory of 2008	3440	msedge.exe	118
PID 3440 wrote to memory of 2008	3440	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/ytisf/theZoo/raw/refs/heads/master/malware/Binaries/Ransomware.Jigsaw/Ransomware.Jigsaw.zip
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x284,0x7fffe681c188,0x7fffe681c194,0x7fffe681c1a0
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,3348612052115602934,1877014362036838384,524288 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,667770651198279969,12325843047081569482,262144 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,15646409592632032078,13157007052585182077,524288 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:13
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,11064691556357032217,10098018353725187394,2097152 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,3844047755701375372,7984582968623592887,2097152 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4124,i,14553925296351512765,1242846093691891059,2097152 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,15839109748741575028,17082003620704541701,2097152 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:9
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4292,i,16476618845336628354,7547991819442304665,2097152 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4340,i,2546357727952730076,2780895740446523175,2097152 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:9
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,8226729393940593208,5320096961760665484,524288 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,11061144163031350443,15019191938971650808,524288 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,12894494184405222869,1790118513658537635,524288 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1116
    3⤵
    PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,3624820113108701583,8119138376572108150,524288 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,3624820113108701583,8119138376572108150,524288 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6236,i,15789394288453376886,15341174859933145673,2097152 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3532,i,4938104263285683358,2592625163934586400,2097152 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4116,i,3105528376747015016,2610807299966695912,524288 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,15068466333217524642,2593592637290639237,524288 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,10308270428878788106,14704346659426457927,524288 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3948,i,17933100016123562615,14977260920402572791,2097152 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,7415063453483431570,16992242891974930468,524288 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:14
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3908,i,18442583534922163638,8903539845837403493,2097152 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,12413941845297885403,17264393493411881068,524288 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,497947980699249286,13889369386584127148,524288 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:14
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,497947980699249286,13889369386584127148,524288 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:14
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4128,i,2102814500154800064,6604848968751427,2097152 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,9891968029850010504,6033695250830875151,524288 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3944,i,1977602291512870546,3350900173442166062,2097152 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3780,i,29321791136690805,5734448354588634114,2097152 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,8046452222022531673,7715202467877611994,524288 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6088,i,5270362617721702457,7614150931903500878,2097152 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,16093834991191971886,2183014717351946182,524288 --field-trial-handle=2464,i,9191044977945582306,11469802993684727083,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1864

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4552

C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe" -d "C:\Users\Admin\Downloads\Ransomware.Jigsaw (1)\."
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe
  wt.exe -d "C:\Users\Admin\Downloads\Ransomware.Jigsaw (1)\."
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3824
- - C:\Windows\system32\wsl.exe
    C:\Windows\system32\wsl.exe --list
    3⤵
    PID:4688
- - C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe
    "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless --win32input --resizeQuirk --width 120 --height 27 --signal 0xa38 --server 0xa34
    3⤵
    PID:3608
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4580

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:492

C:\Users\Admin\Downloads\Ransomware.Jigsaw (1)\jigsaw.exe
"C:\Users\Admin\Downloads\Ransomware.Jigsaw (1)\jigsaw.exe"
1⤵
- Adds Run key to start application
- NTFS ADS
PID:3328
- C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
  "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\Downloads\Ransomware.Jigsaw?(1)\jigsaw.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4468

C:\Users\Admin\AppData\Roaming\Frfx\firefox.exe
C:\Users\Admin\AppData\Roaming\Frfx\firefox.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:4136

C:\Users\Admin\Downloads\Ransomware.Jigsaw (1)\jigsaw.exe
"C:\Users\Admin\Downloads\Ransomware.Jigsaw (1)\jigsaw.exe"
1⤵
- Adds Run key to start application
PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

drpbx.exe

Path C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
Size 283KB
SHA256 3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
MD5 2773e3dc59472296cb0024ba7715a64e
SHA1 27d99fbca067f478bb91cdbcb92f13a828b00859
SHA512 6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
SSDEEP 6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX
TLSH
T110549D9C366076EFC867D476DEA81CA4FA6078BB832B8207901715EDA90D997CF141F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drpbx.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe:Zone.Identifier
Size 90B
SHA256 dc85706f0206cd0abf378c6a8e47baf300c9864ff2780391a953b9960d78741e
MD5 3c28f635e4ab753371ccbff300ffa941
SHA1 d0b72e7dbea3ff3a199b69428a0e7c765ce8031a
SHA512 f8350ba126003bdbf8af243fb6dabe3499394e8c4d9ec59a0293b2f10d54a47d458bb054938d2e8bb7efdc5b9802fbde9a7401bb4c7c70bb01ad6bc1afc1fc5b
TLSH
T134B012A6348D4E180020212216FD168CD05E6D520E101284DD69C8B2B350D3C8497C07
MD5 SHA1 SHA512 TLSH

Submit Download

jigsaw.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\jigsaw.exe.log
Size 610B
SHA256 a4ed9e04cb4a82b27da4f19bb19766c17950288b6686d8af2709d8b6a1f018a3
MD5 8c6b4be642c1ee88b27c5b8c0c9ba3e4
SHA1 1ec2c65753e33ff16dd255369ab461634802e436
SHA512 dbd6114714d00a0f4831db5c18f88b1d2fddf7aaa7daf11e243b0e28bdaa54ac7d947495be9887f296e13ddb9792a0422a685499616f890cab064a6f0f6585c6
TLSH
T149F04C30326299D80D211F500C10BEC967EF0725B7B8CE0CA6A5525DED2B067EB117E3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9267ca39fb50d75e1644d2a3d696dd6ccb217e6bf9e7569d932cd90aa7ddc3c6
MD5 3053e2c309efab6af094759a328116e7
SHA1 5d7903424cad814547aab0b24c905523966a4e3e
SHA512 e50de13a7f8638a26ab1291ceb7deeec0ee240e218416f04728511d55351ed30af33ec0e5c0080501730ddff8c78a910c56192116e7e3b1043719f834e9a713c
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7G:fwUQC5VwBIiElEd2K57P7G
TLSH
T1C9B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dcfc4c476f41db2d6042449b7b855b9751140e2127be8e8208aafd46a5893b7d
MD5 08e448ed3ad1512fa216c2eea50fff9a
SHA1 2d684e6af180cff0b8adea283dbb0c009102fc3e
SHA512 f9ebe4d980c84e665fbd9643a31fbc7a6b08028d289cd54ea7400acc1d6a7d231dd7952c9c49775207225efebf00cdaaf6a2b295dbeac8f234ed7bdfa52c4693
TLSH
T122D0C073050D0000EA0D41312073C7050313BB210E013C03B855F8381D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 88d6d21e0c66c003e4133c53bf9d2589082f0c67a62d3172640c9cb74c0a4472
MD5 a12513b79e2bda8a8dbaba00d57de751
SHA1 a901322dff7887dfe83ae9fd4b2cd19083bda8f1
SHA512 575cb4927a8a7bd263dc01796b17b1ff71d75eb12c2f7d8097b02f36c30168aaf6c35514e7fe2c43183ab885f87a979073a611801685b0259870cd379a8c401e
TLSH
T10AD023B16D1D91D1D91D00355020511061275B7331A767476056B41EAF70484D3DF9EA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 89ab71a3a4e732da8cbbe2e13ba149e13c94226b7119c8a0598106b99907544f
MD5 ca938be236bc251b79a4ee9dbf06dd19
SHA1 2ed95a78846a95a90b8d9b70e9cdc6188f0ce608
SHA512 caf4662a529a373a26b513e285938286f3af46a8729fb4c0be324b084fdba1e10dacca4b8f67585c4a5c6683f45dc7e259548eaf3ffb985905aeefbb7225e0e7
TLSH
T124D0C073050D0000EE0D41312073C7050313BB210E017D03B855F8380D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 a8438def7ea233e1a3fefde5c05cec9da2b1ae123efac78ba956c6d938104d50
MD5 481783acaa94dc7062ad45e5980ad8ab
SHA1 99d734b1b7bc77ff175378a3a96c18703854deb7
SHA512 e0680c437bfd9d8016b1fb79c91459c0d7b0677a5173313d23bf1a92a9226433f371d61e8ffe2b1a25f97a6e7495a985f959fc06f263f5d491d8d2e2dfebf841
TLSH
T1DA714F6ECE424093E7ED11B767F290C1FC33B1DA0A63CD54056BE9B62909B65F026D38
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585c83.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585c83.TMP
Size 3KB
SHA256 9879661bef4597359f4491e6fa4013073e1168a9ea59720d78c066c507457d7b
MD5 72a8640f2c7f68f1cd4ce47887f83f3e
SHA1 724be391f574ef3f71099b1863685db2b1392f1c
SHA512 62b8365425d2ee35389c744b9be1b521f550fd949a6ba2cabd73d2dee1aa2c0e9c77599745637e85123f093921756f49012c9b708878f385d32cda94ac94f604
TLSH
T192714F6ECE425053E7EC10B767F291C1FC73B1DA0A63CD54056BE9B62909B65F026D38
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 a61a6353dbc0c34cae419fc5ae508b53a27d0bcc3cf2e6e361f07a01f3b89ec9
MD5 4cc0b738c505c58219ec9699557bcbd5
SHA1 48e9686e642445e8a0575fb153f82c120959dccc
SHA512 56b5cdc014e05c7a0faa36fbc3a07b911ee135bf963784491d6cd324395924fc9282ec175efdbfb3dad10e93ebe8e7daeca5e670a6db990cae7bdcb14eda4b2a
SSDEEP 3:MsEllllkEthXllkl2zE87lt:/M/xT02zJ
TLSH
T1A3440404FFC40C45CD4510704011C3540370D4700531F74335511C175CCFDC00C10104
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 757B
SHA256 0e62bf6d2483b77ec6bbc25f27d0f0038f07104ac2f8a2d76d2520c47897a1f2
MD5 df7ed09375b6ecfe4e3cb64c3bcf490e
SHA1 443c5f7e5988c5a4d36e4e8a512931529fe36af4
SHA512 12731f28ff808892cab119b6e124fe3f6b0b7c5044fe307f5355392afb3cf4bf41dbe066b591b2278600095003dbd27b8e6fcac6bf5ac64504ad144c5151aa1a
TLSH
T106016DF747B1596E9B1196F09A18AE1BCF6C0015835C786A85E0BE17D3E3461E101A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 757B
SHA256 dbc0be76944cf8ee50840834e3c4acea07a1242d5240d4e4c056c7025fd8b8af
MD5 24b6343052561cdeb08738ebfab0201b
SHA1 76f027153d3114d85e9860f49b4193bc7a5a61dd
SHA512 70892e51e1e4ffc3e13011d1f02770b32f3d826f95d0a025bff37558e720f8f08fdb3948d125327ac6ee1e9902f7125f553c6d969c75c5ef28958c9bc0c8608c
TLSH
T1CA016DF747A1596E9B1196F09A18AE1BCF6C0015835C786985E0BE17D3E3461E101A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 43c371b35e6dc025836fceced2e1057b1aec22d6c4b7622fd8034338fc32e323
MD5 9daafd6e82f1b391c317075f4b903d9c
SHA1 67449cc82f885167922187be96233f1ccf706b56
SHA512 586e0a7fbce804ead9993800514079dd34451bab2e75709e75ccc60749023bcc8de4c7e7fb7db37e12383325c2ea4847b6db74833657592c442bffe0c1ac92d5
SSDEEP 192:sxZI/yM/jK1Ml8MFf/fPs1PhkqIdpM/W6+WNGY01NLHUIgrJ:sxZI5df/fPsNhkjM/bG5A9
TLSH
T10642F8116B34A977CCDBD209FA557F93D6F84472D2900E48A9FCDA1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d29ad77c2286409959f7b1920b2bd0f15cf58403c9225e816e950538878eddd3
MD5 be0aaa0542f4f8c636f27dd17d502e7b
SHA1 964e0e38c5da872116edad711f8b3dae6d8443c2
SHA512 2cd8f51a3280fb0637dd754c8d4e22179e11f98b6da8fa42db2a26c93f69e17e490ac586b77edb6d7f0b638577e0c4e2aba09d6b3b2176b3f73795e603c00856
SSDEEP 192:sxZI/yM/jK1Ml8Nof/fPsTWpVHPh3VIdp4u/W6+WNYbs/Y05Kg+yOIgbdJ:sxZI5ff/fPsTWvvh3mf/b5/5jE7
TLSH
T15262E852AE346977CCDBD209FA557F53D6F84432D2900E48AAFC9A1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1ff2acbf22cfb0d793009a814884bfa7e0ac4da79b9c5ca2e215b0fb97563ef5
MD5 8e6b88beb71b736b4e0a470b5457306e
SHA1 a704b9a905ab03a48f3b4c177045c44dab183c1a
SHA512 76428dc46af8de807e9bfe6e0306b99385bb27823e14c89f55fd22e3bc03d7b7bf2616b6ec1d3801ad5371a58c52446d53ff37acd0a49690472c0a5b0c9b4d80
SSDEEP 192:sxZI/yM/jK1Ml8Mof/fPsOPh3VIdpqu/W6+WNYbs/Y01MLHUIg5dJ:sxZI5Qf/fPsmh3mJ/b5/5rh
TLSH
T15552E852AE346977CCDBD209F9517F53D6F85472D2900E48AAFCDA1C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 09b366d6cfd9888a5897c0dfffe7ad84c9900bc81593361285243cb31f3ddaf3
MD5 f77e01e314bf09f35f0e58d0ca6ec0e2
SHA1 b0603f9324803a555530202dcf3ee423c98493cd
SHA512 73abf9cb8a2842182fea7ea58b086c021f7c13171693fb2e14e65edda2bcdf2d617125b8406688a5f168ffab0dd904f3ca47f46f080487ee1211f514cc53a6df
SSDEEP 768:oF4bSV4b+8b4bm254bRWRmG4b/QB4bH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3c4q:ouu+68si2y1WRmlzQqju1jaKDILpZ8UX
TLSH
T1BBE22A3B280CCB7E4F844E5CEC26AF966ED802CB66A84D5447FE494C03C77EB511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 13ec024ac2263821e0a64ce55cd493d73bbaef4e42334558d7f4d02629d545a2
MD5 ea0c61bba2e1e34aacf98f0bfe506f7c
SHA1 0ffa03b575d73f17fb9ced5f9e956434c9c143a3
SHA512 a06549126acbb6213b5d7f38c5e289ce31b516c1e7341c362902ea2b26dfb878602ebe2ffa04dd8101180ae02f5830289e51f9d80af20424df445d107c9a62f1
SSDEEP 24:KdMfDYZaWduOK4mi+5IjEKKi5haaK1E0aSmoMJ8kjyXYAfnUFaqdSSu4Ce+1IjIX:KYlIJKGE8DyFhItKygwqbIdKY8Qny5H
TLSH
T11291AAC170BEE6823D3E640CA2608A57664331A3302CA46F77B854B19EA7E615CFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 53ca863a9726630c9b0c64d924a0d1db07b5bdc2f807f5cd9aea4b62aea8202f
MD5 a4a0628f422d733c6f9c9984f6182177
SHA1 d0535301a2f7a797693c709abcf2ef73f57c632b
SHA512 67d5535190926354b5ab47b38ec381857c3f17e82088afc1e9c846c6b0083a9ccb90bd4448fe6ef40d9e20f5f22b17a3b7182c60f880d6268e3ea98cd5850825
SSDEEP 192:uCHi8NhSHQaxrvzSQmiU1STgo84r3b+jcyOZPdmaOb+29s3hvqz9YyXj/tMs7:s8NhaDql8r3b+AyOZZOb+26E5JN
TLSH
T1CF4219726CB4AC735DF2A585F44B36038FB851A796882FC8D5DC7B1C09CB26C230B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7e76f9adeedaae51f4c02105fb4d49397951fcbe6a7e6b1db80fcdba69affe8e
MD5 81b18f712349c3244357ca9d400fadb7
SHA1 a78eb007c01e6632a72e7349d127b7ff89294e6f
SHA512 7e206826b7fe2937e871723573957fb42ba399e7838f39737141e7f87636417751e839ecb5bde3593a8609fd031afc4b828f91dc59864bf085a05393d718ad75
SSDEEP 384:eZcIP8Nh3DnO8r3b+AyOZZOb+2IEf5UrzlKDCr:cPForpyO/UlIESlHr
TLSH
T1A6927D715C74AC3769F2E585F84632078FB85067E3C82BC8D5DD7B2D099B66C270B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b51c27ffb2bdfaf0f176daab7a74ca37a6ae7a3a122866e2a6fc33e15b222f79
MD5 c5d9250c1d4bb1672cef2d1f1071aae8
SHA1 63ddc2730deaa969704adf84f2e075e05591321d
SHA512 429a269ea124e6869ab6930c54c911c6eec2dd4da8956b89501ec5815050e9ac72f2aeb0af0a610e7e617a265439fa8cd9fe89f095d548c0445cbec36f6c8def
SSDEEP 384:eZcIM8Nh3D5v8r3b+AyOZZOb+2IEf5UrzlKDCr:cMaorpyO/UlIESlHr
TLSH
T162926D715C78AC3769F2E585F84632078FB85067E3C82BC8D5DD7B2D099B66C270B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c53afe7d008efe304c91a570207f9e051a37384d3f8b8c49764359a875da09e8
MD5 9edf1ae9d7eacfea5f1973c39e8d3aaa
SHA1 d1670a020c2a131568bec7dcae98fab3b1a458d4
SHA512 bb8614a4f6476a6074ec403ba7d97cf45f9e1c4803ee5bf4fe908d053028a6e19234f22076a1f4ac6f3414479bf88522bc77d0db440388d74387d16d8b0d27c7
SSDEEP 384:BZcIU8Nh3DnO8r3b+AyOZZOb+2fEf5UrzlKDCr:JUForpyO/UlfESlHr
TLSH
T111926D715C74AC3769F2E585F94632078FB85067D3C82AC8E5DD7B2C099B66C270B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2e561a4a175350050ebc180ed4ca990dadebae2048cd86f296f5be769f748a3c
MD5 bbee29d874cf649cd8f02bfec4c94ef1
SHA1 c652409fd18d9c33d4651bfc41f163e29d1b05d7
SHA512 c54d693b95ba7a20650b17ac07845fe28e5512387a2d7b51db98669e43b6e4d48a43e026dccd6026a70f3980e355461f5ac5fccaa44f4b11662be332a8403e09
SSDEEP 384:3ZcIP8Nh3DnO8r3b+AyOZZOb+2IEf5UrzlKDCr:/PForpyO/UlIESlHr
TLSH
T1D5927D715C74AC3769F2E585F84632078FB85067E3C82BC8E5DD7B2C099B66C270B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 86dc66aac405dc8c3f6956e326fcef93ded3058b033c59c88d318eb38b7a5999
MD5 b33cc0e0f7200cc11c885a50827aaf1d
SHA1 155b39c08818b4bc0d6ec1f908f6c97798689bc7
SHA512 123e0b146f01a3b91e8bd9ffeac6a260c4313767e236137fb9e70059deeb3166d0eb2b735b046218485b578142465c80c26543d924bd4a14639130ed41c385ba
SSDEEP 192:nRGNz6yMQmiUy5Jm71Y3b+jcyOZPdmEzMnaQU6:RGNz6xuA1Y3b+AyOZNGzU6
TLSH
T14A02D735A8786C778FF2AE45B94727138FA8112BE9942FC4DAD82B1C04D725C230B966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 13KB
SHA256 78f64082542ee7d641cd5d18f495c937e511ccb143723e1745f611f104e31aad
MD5 d215164c6c6e82005651b8482331941f
SHA1 75377afbe04569e4eb577573f27a6369969927dc
SHA512 8b75775628e3b21ac81d8cd7c6a83efd9a56bcadbca7069cbb54df23b3501f3eb52ff517c34dbedd49d753ad07492356c035bc86ebc9cf36c24d281146b0f263
SSDEEP 192:uCHy8NhY7HQaxrvzSQmiU1STgo84r3b+jcyOZPdmaOb+29s3hvqz9YyXj/tMs7:g8NhWDql8r3b+AyOZZOb+26E5JN
TLSH
T1865209726CA4AC735DF2A585F44B3613CFB851A796882FC8D5DC7B1C09CB26C230B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2344772e8c0847fe78e733e120a18839928f056c7239a7246d62600919b3836a
MD5 dd90cd5fe18ce95d922978a23bf143c4
SHA1 50f93b34e3c3bc0cf780440be408d11bb19e9dcc
SHA512 edd4249424350b2cc7fab6794883792cc280e360f8e5431c5b841f4fd2d9eac275fed7b46daba42af17a6c3f95fa429cac3aa06fbddd0ab53b8a85af7b134880
SSDEEP 384:dZcI78NB3DiD8r3b+AyOZZOb+2WmC/aeY7KQ9XKuSsf5UrzlKDCr:F7rorpyO/UlWmCJY19autSlHr
TLSH
T13AC26ABC9C645C3F45FEBB08BA4E26264EA8023BD1B42998E3E9170DC57655CFB02816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e5a9d38cbf980f5e95afca539215e35fde5ccbb80f78cda2ec391a8b894c60af
MD5 8b044469a883a56bdfa72670873e0956
SHA1 6aae98fa68da53145950c2673bc078c7ee2d0435
SHA512 9bdf4733e39120a4f01994c0e941629916111a40cc5c8bde87ba3007db728d38b76dbd4a845c14a703cb0335997c3d64e701110bfae0f839aabbcd4c3bf312c0
SSDEEP 192:o9GNc6yF6QmiUyn07oBY3b+jcyOZPdmaOb+2N4MvqzU6:UGNc69zsY3b+AyOZZOb+2zEU6
TLSH
T18E12E872A868AC775EE2A584F48736138FA9016BD6887FC4D5DC3A1C09DF66C230F856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

703d16d8-e3ac-436a-ba8b-975a91ca4635.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\703d16d8-e3ac-436a-ba8b-975a91ca4635.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_dhzebt5b.bfm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dhzebt5b.bfm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Ransomware.Jigsaw.zip.crdownload

Path C:\Users\Admin\Downloads\Ransomware.Jigsaw.zip.crdownload
Size 239KB
SHA256 86a391fe7a237f4f17846c53d71e45820411d1a9a6e0c16f22a11ebc491ff9ff
MD5 3ad6374a3558149d09d74e6af72344e3
SHA1 e7be9f22578027fc0b6ddb94c09b245ee8ce1620
SHA512 21c21b36be200a195bfa648e228c64e52262b06d19d294446b8a544ff1d81f81eb2af74ddbdebc59915168db5dba76d0f0585e83471801d9ee37e59af0620720
SSDEEP 3072:p7ykj3uuY4NsJD7kPdSRQLqas/pkPm9jvkEL60Uf7k2BgS6/aFybrNN5ZAdNstk7:p7ym3VNA7w8R5/rxv7O0yng0UtVw5NJ
TLSH
T1263423121BD13B4CDD6F7C19DCCFA43DD3B62D4DE08A069979AA990E0E0E0A1E9F1D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ransomware.Jigsaw.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Ransomware.Jigsaw.zip:Zone.Identifier
Size 157B
SHA256 6a2268552d26869a210963dc1c9851899356c6060f1c287cee56c59dff8c6cac
MD5 aa24240f7159651c843395ffbc84d7ef
SHA1 7e13b2d231642683c4772367a0bb91de7c53bc4e
SHA512 85319b58dbc92b23cfb9bce02c7db5f5777edbe0f947b13f8f87352a581d4fcdeb4c0026789672988fceaddc5d159aa5648b95e14dae2f923f0cdbad43ed07b2
TLSH
T129C08CA235014A184606B8C89BE4A599D15E33B099C493B9D8CCC86ED68075D11A1D71
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3328-424-0x000000001B150000-0x000000001B188000-memory.dmp

Download

memory/3328-425-0x000000001B750000-0x000000001BC1E000-memory.dmp

Download

memory/3328-426-0x000000001BC20000-0x000000001BCBC000-memory.dmp

Download

memory/4136-442-0x000000001BB10000-0x000000001BB18000-memory.dmp

Download

memory/4580-287-0x00000283DD150000-0x00000283DD172000-memory.dmp

Download

memory/4580-289-0x00000283DD580000-0x00000283DD5C6000-memory.dmp

Download