Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/09/2026, 00:32

General

  • Target
    jigsaw.exe
  • Size 283KB
  • Sample260916-avy45sssgv
  • SHA256 3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Family: Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

  • Renames multiple (3683) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • ConfuserEx .NET packer 1 IoCs

    Detects ConfuserEx .NET packer.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jigsaw.exe
    "C:\Users\Admin\AppData\Local\Temp\jigsaw.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4204
    • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
      "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\jigsaw.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:5940
  • C:\Users\Admin\AppData\Roaming\Frfx\firefox.exe
    C:\Users\Admin\AppData\Roaming\Frfx\firefox.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in Program Files directory
    PID:5068

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        s_remove_18.svg.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.fun
        • Size 720B
        • SHA256 5ebbfc6df60e21044486a5df3cb47ccdcd7a4d5f197804555715ffd9bf6c5834
        • MD5 SHA1 SHA512 TLSH

        icons.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png.fun
        • Size 7KB
        • SHA256 7c78b3da50c1135a9e1ecace9aea4ea7ac8622d2a87b952fc917c81010c953f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icons_ie8.gif.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_ie8.gif.fun
        • Size 7KB
        • SHA256 97f6348eaa48800e603d11fa22c62e10682ad919e7af2b2e59d6bd53937618f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icons_retina.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_retina.png.fun
        • Size 15KB
        • SHA256 aecde4eb94a19095495d76ef3189a9abd45bcfd41acbed7705d22b4c7d00aa77
        • MD5 SHA1 SHA512 SSDEEP TLSH

        new_icons.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png.fun
        • Size 8KB
        • SHA256 904372666ca3c40f92b20317d92ca531678958affbc34591401e338146fe0ecb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        new_icons_retina.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons_retina.png.fun
        • Size 17KB
        • SHA256 2dee41184747742fbdc527b2023d67fecec1ccdfdf258439a06cd75d4fd33f43
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rhp_world_icon.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.fun
        • Size 448B
        • SHA256 7a27d891097df183fbf0031e3894bdac0ce77aef15d666ddd9f6a04e9836fb27
        • MD5 SHA1 SHA512 TLSH

        rhp_world_icon_2x.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.fun
        • Size 624B
        • SHA256 a91790b778026db625c9dedfe1c6d94b884818b33d7977e86b2f9c2f3c500796
        • MD5 SHA1 SHA512 TLSH

        rhp_world_icon_hover.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.fun
        • Size 400B
        • SHA256 ae2facd997527426fc4def82e0db68be29b44499bfff86a28c36f7c31b177d4f
        • MD5 SHA1 SHA512 TLSH

        rhp_world_icon_hover_2x.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.fun
        • Size 560B
        • SHA256 5e8ec278a273be22199884d519a79f748801baa3a45b76e57569fdfffe96e7fb
        • MD5 SHA1 SHA512 TLSH

        rhp_world_icon.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.fun
        • Size 400B
        • SHA256 9433084e61062d2b709c1390e298ddaf3fb0226656662c04c0b7026a44dee750
        • MD5 SHA1 SHA512 TLSH

        rhp_world_icon_2x.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.fun
        • Size 560B
        • SHA256 9095e9b4759e823e96984981af41b7a9915a5ecaa6be769f89c13484cef9e0f5
        • MD5 SHA1 SHA512 TLSH

        rhp_world_icon_hover.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.fun
        • Size 400B
        • SHA256 341976b4fe312824d02512d74770a6df9e1c37123781655532bd9cd97ea65fa9
        • MD5 SHA1 SHA512 TLSH

        rhp_world_icon_hover_2x.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.fun
        • Size 560B
        • SHA256 7805ac9d0e05d560023e5aabed960d842e4f3ec2aa3db45a9cfb541688e2edb1
        • MD5 SHA1 SHA512 TLSH

        example_icons.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons.png.fun
        • Size 688B
        • SHA256 6f9c7ebec5a707de439e3fd2e278fdfa07a39465d56157b70b24f091509bf76f
        • MD5 SHA1 SHA512 TLSH

        example_icons2x.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons2x.png.fun
        • Size 1KB
        • SHA256 1ca0cfc2df0354c8d886285ae5e743d9c7cc030e1afd68ac113c0f2ce43ad5fa
        • MD5 SHA1 SHA512 TLSH

        bg_pattern_RHP.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png.fun
        • Size 192B
        • SHA256 76f8ed1dd50e50c7d62b804a0d6901a93e5534787d7b38467933d4c12ce98a0d
        • MD5 SHA1 SHA512 TLSH

        bg_patterns_header.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png.fun
        • Size 704B
        • SHA256 112f72ef2bc57de697b82b731775fba3f518d1ae072120cd11b732bf4a782e36
        • MD5 SHA1 SHA512 TLSH

        illustrations.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png.fun
        • Size 8KB
        • SHA256 7c5b1d8469e232a58359ccbcb89e619c81c20e6d2c7579e4292eb9a19849bc5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        illustrations_retina.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png.fun
        • Size 19KB
        • SHA256 aa638be6e1107ed1f14e8430abedd6f6d0a837a31b1b63e6a7741d6d417eddc2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ui-strings.js.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.fun
        • Size 832B
        • SHA256 73acdc730d8a9ec8f340c724b4db96fc222bb1eaf836cec69dfe3fab8d6ac362
        • MD5 SHA1 SHA512 TLSH

        ui-strings.js.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.fun
        • Size 1KB
        • SHA256 d6c290e942ee665d71e288229423a1f1866842988eac01f886910b0ec383aa9b
        • MD5 SHA1 SHA512 TLSH

        ui-strings.js.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.fun
        • Size 1KB
        • SHA256 a955039cd9e53674395f4b758218e4d59c89e99a0c4d2a909e49f6008b8f5dd4
        • MD5 SHA1 SHA512 TLSH

        bun.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.fun
        • Size 2KB
        • SHA256 3fb25ddd378ab756ec9faa56f16b76691cf6d9c7405bb9a09ce542a6f5b94e44
        • MD5 SHA1 SHA512 TLSH

        cstm_brand_preview.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.fun
        • Size 2KB
        • SHA256 7f1238332901b740cde70db622abcfb533fc02f71e93101340073552f4820dad
        • MD5 SHA1 SHA512 TLSH

        cstm_brand_preview2x.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.fun
        • Size 4KB
        • SHA256 e9847d0839d3cf1039bebdc49820ee7813d70941347ce420990592e5e3bd998e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dd_arrow_small.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.fun
        • Size 304B
        • SHA256 8469b8a64e80d662eec71c50513f6d295ef4a3a9992763dbcac9d81253cef9d5
        • MD5 SHA1 SHA512 TLSH

        dd_arrow_small2x.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.fun
        • Size 400B
        • SHA256 cf10d2a22b638cf0978cf30ecaf39ecb5bb0e3ad78cd920afa433ad60cc1290d
        • MD5 SHA1 SHA512 TLSH

        nub.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.fun
        • Size 1008B
        • SHA256 22a34c8321384fc7682102e40d082e7812232a9109e4d4e8fa2152fda3f260f6
        • MD5 SHA1 SHA512 TLSH

        share_icons.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.fun
        • Size 1KB
        • SHA256 4e96529c023168df8dde241a9acdbf4788ea65bc35605e18febff2b2071f1e24
        • MD5 SHA1 SHA512 TLSH

        share_icons2x.png.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.fun
        • Size 2KB
        • SHA256 d153ed6c5ea8c2c2f1839f8dadcc730f61bd8cd86ad732bab002a258dea1d037
        • MD5 SHA1 SHA512 TLSH

        ui-strings.js.fun

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.fun
        • Size 848B
        • SHA256 7a75b8ec8809c460301f30e1960b13c518680792e5c743ce7e9a7f691cfafc38
        • MD5 SHA1 SHA512 TLSH

        DisplayLanguageNames.en_US_POSIX.txt.fun

        • Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.fun
        • Size 32KB
        • SHA256 a193ee2673e0ba5ebc5ea6e65665b8a28bd7611f06d2b0174ec2076e22d94356
        • MD5 SHA1 SHA512 SSDEEP TLSH

        History.txt.fun

        • Path C:\Program Files\7-Zip\History.txt.fun
        • Size 6KB
        • SHA256 e1e37f68e0e82c0c08e895b802eee46ecd902aa899d1ca6919e2b231ce7ae18d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        af.txt.fun

        • Path C:\Program Files\7-Zip\Lang\af.txt.fun
        • Size 4KB
        • SHA256 215920abeb6db9cefdf80f7ed4335debcce21556d8e4f43287693c0725973fad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        an.txt.fun

        • Path C:\Program Files\7-Zip\Lang\an.txt.fun
        • Size 7KB
        • SHA256 a5bc53bfbcd13267e0cb5b379af6db5eccc6154ec22ebd4d79ad8f52bf62b741
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ar.txt.fun

        • Path C:\Program Files\7-Zip\Lang\ar.txt.fun
        • Size 12KB
        • SHA256 1eed8d767e01cee18657c83fd5c10f9557bc901272c8558982617c33251c827e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ast.txt.fun

        • Path C:\Program Files\7-Zip\Lang\ast.txt.fun
        • Size 4KB
        • SHA256 8130071c1ba38f30c260467a111e98e3c821660df8ff89b8d95bd55cbfc6c978
        • MD5 SHA1 SHA512 SSDEEP TLSH

        az.txt.fun

        • Path C:\Program Files\7-Zip\Lang\az.txt.fun
        • Size 10KB
        • SHA256 d7abeca0c93feb4bde5c21f1047803d772204e1fd828b0d68d4acfa13a89666b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ba.txt.fun

        • Path C:\Program Files\7-Zip\Lang\ba.txt.fun
        • Size 10KB
        • SHA256 28a47e1c24946ee0b00f996e0ade390278dea4d6941e927c2257f963bfaaf90b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        be.txt.fun

        • Path C:\Program Files\7-Zip\Lang\be.txt.fun
        • Size 11KB
        • SHA256 10b48816db4f550cbc1b41791560ee594278d209f29a654e7887991358bc2bb8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bg.txt.fun

        • Path C:\Program Files\7-Zip\Lang\bg.txt.fun
        • Size 17KB
        • SHA256 389673b5f153554369e5f3c0ee7603bd27a75b8dbd2ab0ac61ac216a3fcfaa30
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bn.txt.fun

        • Path C:\Program Files\7-Zip\Lang\bn.txt.fun
        • Size 14KB
        • SHA256 71b07f12c1d6cb71c39c9dff275930b186db1ebc30b70b49d5ec1c8cc5fb4306
        • MD5 SHA1 SHA512 SSDEEP TLSH

        br.txt.fun

        • Path C:\Program Files\7-Zip\Lang\br.txt.fun
        • Size 4KB
        • SHA256 ec6a27d9df06b20827500ebf91a0e2b5592cc0c7f3dee8b555140c902de3205e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ca.txt.fun

        • Path C:\Program Files\7-Zip\Lang\ca.txt.fun
        • Size 8KB
        • SHA256 baffa46a8432569eacb2b4adfa6b5db15a0ea5c680b692c80ea38b3cabd75747
        • MD5 SHA1 SHA512 SSDEEP TLSH

        co.txt.fun

        • Path C:\Program Files\7-Zip\Lang\co.txt.fun
        • Size 11KB
        • SHA256 0c5b1cc6452e5df903f987919350a8f67fcc7d6d0a84d9c23d2688843c2d825d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cs.txt.fun

        • Path C:\Program Files\7-Zip\Lang\cs.txt.fun
        • Size 9KB
        • SHA256 201c6e22d553b9aa532be6c89eb957c19fef222b0b2d3e98ecc8ed3ef1813a80
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cy.txt.fun

        • Path C:\Program Files\7-Zip\Lang\cy.txt.fun
        • Size 4KB
        • SHA256 54eaaa09d9f8d01d21e2e03355365e525433747997a31e21e8f2a8c4031aba32
        • MD5 SHA1 SHA512 SSDEEP TLSH

        da.txt.fun

        • Path C:\Program Files\7-Zip\Lang\da.txt.fun
        • Size 7KB
        • SHA256 55bbcf4d061116fe795358e93fa8c1c48bae86504f0b7d4bb47e0a34040d1209
        • MD5 SHA1 SHA512 SSDEEP TLSH

        de.txt.fun

        • Path C:\Program Files\7-Zip\Lang\de.txt.fun
        • Size 9KB
        • SHA256 0a997f4b2fd8a1ab593146ae8b21374f211255701d01d80b2125b7f05a9b666a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        el.txt.fun

        • Path C:\Program Files\7-Zip\Lang\el.txt.fun
        • Size 17KB
        • SHA256 0b83fcd5188d88d85f356a024c3eb1a1b1a629285b9eeaaa5d33a730502d02da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        eo.txt.fun

        • Path C:\Program Files\7-Zip\Lang\eo.txt.fun
        • Size 4KB
        • SHA256 82fbcc4d7d2ee6edb5fb3390d1b0759f93ad4319ad1528989bdff214f7d1f1dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es.txt.fun

        • Path C:\Program Files\7-Zip\Lang\es.txt.fun
        • Size 10KB
        • SHA256 a347b92d7292f184d7376b6d3b6d26f009e729d0d9fc5403595da7bb5b1e4255
        • MD5 SHA1 SHA512 SSDEEP TLSH

        et.txt.fun

        • Path C:\Program Files\7-Zip\Lang\et.txt.fun
        • Size 6KB
        • SHA256 8e8468e0f2ff72f3bc3ca9feb128bd6d0293930ee620629ec3e6803e0c1fe427
        • MD5 SHA1 SHA512 SSDEEP TLSH

        eu.txt.fun

        • Path C:\Program Files\7-Zip\Lang\eu.txt.fun
        • Size 8KB
        • SHA256 c457ec38ce7890e157866a5cbb677a58a5db9fb608bd03fb46e3955e87e3dcd8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ext.txt.fun

        • Path C:\Program Files\7-Zip\Lang\ext.txt.fun
        • Size 7KB
        • SHA256 f6a294d7c97e930fc3d7cebcd1f70a5eb8395c8cb158229b3f7a4466b369c2dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fa.txt.fun

        • Path C:\Program Files\7-Zip\Lang\fa.txt.fun
        • Size 12KB
        • SHA256 b59c630d8f8c5240b54b0d47c63abe37c3feb1c84bccae5a9638fd7b5317af59
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fi.txt.fun

        • Path C:\Program Files\7-Zip\Lang\fi.txt.fun
        • Size 8KB
        • SHA256 845e62d634b30d4fde1bd776a0b5ff15b815c844c46c914eb1364d2fae7ef0c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fr.txt.fun

        • Path C:\Program Files\7-Zip\Lang\fr.txt.fun
        • Size 10KB
        • SHA256 86ab91b998eb14e0308f537b8335d0aacfdb3ef4d61bb9e3bc09764e5710d4af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fur.txt.fun

        • Path C:\Program Files\7-Zip\Lang\fur.txt.fun
        • Size 6KB
        • SHA256 5ee45de54a089b5c842facd13a2336a2ee537b67a53ed9f715246d544a3db882
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fy.txt.fun

        • Path C:\Program Files\7-Zip\Lang\fy.txt.fun
        • Size 5KB
        • SHA256 35bff34507d446d9cf8f29708d02738fbea11109da9db2dc290a535beabc6c9f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ga.txt.fun

        • Path C:\Program Files\7-Zip\Lang\ga.txt.fun
        • Size 7KB
        • SHA256 a0e47ca500a4b14eafcdc72b501abf95aef0986dfc161d30fae1d012f46655c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gl.txt.fun

        • Path C:\Program Files\7-Zip\Lang\gl.txt.fun
        • Size 8KB
        • SHA256 8921acdf808d765a2fbad895d292212861ed037fdfddf542660f3d34c9e73214
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gu.txt.fun

        • Path C:\Program Files\7-Zip\Lang\gu.txt.fun
        • Size 16KB
        • SHA256 74af77ab0bb99f57753f2fd2c6b431a1d5999e53ac0222d533832c160db58b1e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        he.txt.fun

        • Path C:\Program Files\7-Zip\Lang\he.txt.fun
        • Size 10KB
        • SHA256 220e14afa7f08cac460574c8c8eb401d2c88d30dde99db2a86bca2cfd261c419
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hi.txt.fun

        • Path C:\Program Files\7-Zip\Lang\hi.txt.fun
        • Size 17KB
        • SHA256 0f4bb19408a7f8211879aae556717dd298d74b184a6f0370108b2fb3d58aa135
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hr.txt.fun

        • Path C:\Program Files\7-Zip\Lang\hr.txt.fun
        • Size 7KB
        • SHA256 87eb45a11ead4584848c06791479788449691ef5d53563aa31a80b381c7ce748
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hu.txt.fun

        • Path C:\Program Files\7-Zip\Lang\hu.txt.fun
        • Size 10KB
        • SHA256 54ccabcc916cedba04cad56a20d4cc2caba71dc7a0e5922770b922e8c9a8087e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hy.txt.fun

        • Path C:\Program Files\7-Zip\Lang\hy.txt.fun
        • Size 13KB
        • SHA256 71f599d7977f909e0cd27db322f0503cb1889fdba1aa5b7b884003f6edafb24a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        id.txt.fun

        • Path C:\Program Files\7-Zip\Lang\id.txt.fun
        • Size 8KB
        • SHA256 cd877f3eca52af1b6faa5d9fb042c0697acca2677312a01915380582cd0a0527
        • MD5 SHA1 SHA512 SSDEEP TLSH

        io.txt.fun

        • Path C:\Program Files\7-Zip\Lang\io.txt.fun
        • Size 4KB
        • SHA256 b3d8f86f969f358ef1bad7fcbd5f7229f6ddaefeb93064022903d4058d82631a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is.txt.fun

        • Path C:\Program Files\7-Zip\Lang\is.txt.fun
        • Size 8KB
        • SHA256 810d7614347274738eccc72107110ebbf87e13924c4e268c39460e09fbc9a9bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        it.txt.fun

        • Path C:\Program Files\7-Zip\Lang\it.txt.fun
        • Size 9KB
        • SHA256 786278e438a74a20072de6813708d19bb317baed2da6ff9ec77143eb0d237f88
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ja.txt.fun

        • Path C:\Program Files\7-Zip\Lang\ja.txt.fun
        • Size 12KB
        • SHA256 d36769772ee2c55a17713a47ff53e4bf33eb5026954a46e21b98d5fb3faca14e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ka.txt.fun

        • Path C:\Program Files\7-Zip\Lang\ka.txt.fun
        • Size 17KB
        • SHA256 9fea4357439ccf8082d1a56de42ebcf5ecddd1756797f18f5376086d0ea2e6f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kaa.txt.fun

        • Path C:\Program Files\7-Zip\Lang\kaa.txt.fun
        • Size 7KB
        • SHA256 a6802ac96630b94813fb974e04e7c3b091ba1e71d45c5a2563f627b9665257eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kab.txt.fun

        • Path C:\Program Files\7-Zip\Lang\kab.txt.fun
        • Size 7KB
        • SHA256 5cc92d910c02a69021ff150706e6d24a81c7d540c11791a9c2abf985d75b6483
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kk.txt.fun

        • Path C:\Program Files\7-Zip\Lang\kk.txt.fun
        • Size 10KB
        • SHA256 4bec9b8b7d35e541890b29ce553653f1102c85e5079221385be24eeb5bfc1e87
        • MD5 SHA1 SHA512 SSDEEP TLSH

        License.txt.fun

        • Path C:\Program Files\7-Zip\License.txt.fun
        • Size 5KB
        • SHA256 6928ebe23a5192f9a39998018d4c9f937933c8ceb73d1b87dc98e37fe8d2a3b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        readme.txt.fun

        • Path C:\Program Files\7-Zip\readme.txt.fun
        • Size 1KB
        • SHA256 058b7314705106841287f9ab654bc53ff83c267ec5dc2c40f3bd7fe3d72fa95e
        • MD5 SHA1 SHA512 TLSH

        invalid32x32.gif.fun

        • Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.fun
        • Size 160B
        • SHA256 98b6c2ddfefc628d03ceaef9d69688674a6bc32eb707f9ed86bc8c75675c4513
        • MD5 SHA1 SHA512 TLSH

        AppXManifest.xml.fun

        • Path C:\Program Files\Microsoft Office\AppXManifest.xml.fun
        • Size 4.3MB
        • SHA256 3b4db1a71a8468213ea85c7b64c2b0fbe6058baf80a6b1eb4e3679a4c157ef1b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FileSystemMetadata.xml.fun

        • Path C:\Program Files\Microsoft Office\FileSystemMetadata.xml.fun
        • Size 288B
        • SHA256 8da639138fdc0d0601a22b8c0c7d31617e6089d50d3540ddb418e4610b1daf2f
        • MD5 SHA1 SHA512 TLSH

        ThinAppXManifest.xml.fun

        • Path C:\Program Files\Microsoft Office\ThinAppXManifest.xml.fun
        • Size 3KB
        • SHA256 ebf2e3f0a9c63ee4bdc272fc69f64fe46974900e3784ee537a3a9f1d7f9ea1be
        • MD5 SHA1 SHA512 TLSH

        firefox.VisualElementsManifest.xml.fun

        • Path C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.fun
        • Size 560B
        • SHA256 b45e9f96d5a59de1d8c8f963db51cce1168b0fc885d822375c0bb31745e56efb
        • MD5 SHA1 SHA512 TLSH

        private_browsing.VisualElementsManifest.xml.fun

        • Path C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml.fun
        • Size 560B
        • SHA256 5177a663d27f980e9dd5fe2dbcf69604dc518a361e1ba5639eab57757829258c
        • MD5 SHA1 SHA512 TLSH

        PopReset.3g2.fun

        • Path C:\Program Files\PopReset.3g2.fun
        • Size 657KB
        • SHA256 c02c220cdd137b3b269667b84571957ae8b2fb5e1d7883a0075f016f0698fd4b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ReadComplete.wma.fun

        • Path C:\Program Files\ReadComplete.wma.fun
        • Size 572KB
        • SHA256 2b4d3e2a8e040e55b7d2e1e58c1e8322b81503e2e1aa9639bd2df807b4883177
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RedoDebug.mp4.fun

        • Path C:\Program Files\RedoDebug.mp4.fun
        • Size 1.0MB
        • SHA256 2dd0f625423fb2f7b1e13ec60ac1607b402ea674e8fb26c951008d6826de9b57
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SaveTrace.xltx.fun

        • Path C:\Program Files\SaveTrace.xltx.fun
        • Size 402KB
        • SHA256 dbaf90d22b9e54dc2be5751d26f646a5855cf3b26b37dadd64f0b0c938eb3b8d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StopExpand.pptm.fun

        • Path C:\Program Files\StopExpand.pptm.fun
        • Size 699KB
        • SHA256 cbc5c0aff3235d60416dccbfc4ee3060a5f3db404ac374abe453ce8ec1a36304
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE.txt.fun

        • Path C:\Program Files\dotnet\LICENSE.txt.fun
        • Size 9KB
        • SHA256 c631987151c792fb2fa1ff92e9443ba5ef7cc3c54342e47d07fc5489fd91f534
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ThirdPartyNotices.txt.fun

        • Path C:\Program Files\dotnet\ThirdPartyNotices.txt.fun
        • Size 93KB
        • SHA256 e2246b14ea8ac20349ecf4d8f3531d805618f6950e39ac23b00827852ead3cf9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ReAgent.xml.fun

        • Path C:\Recovery\WindowsRE\ReAgent.xml.fun
        • Size 1KB
        • SHA256 4e2a4eb71b7bd5efc5356b0e5092c2e7495249c321b4f3cc4fe300e727f9b529
        • MD5 SHA1 SHA512 TLSH

        drpbx.exe

        • Path C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
        • Size 283KB
        • SHA256 3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        settings.dat.fun

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat.fun
        • Size 8KB
        • SHA256 36537e56d60910ab6aa548e64ca4adafdcabde9d60739013993e12ba061dfd65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        {1F75593E-8A65-4507-B7CA-4A93910687E2} - OProcSessId.dat.fun

        • Path C:\Users\Admin\AppData\Local\Temp\{1F75593E-8A65-4507-B7CA-4A93910687E2} - OProcSessId.dat.fun
        • Size 16B
        • SHA256 619e246fc0ac11320ff9e322a979948d949494b0c18217f4d794e1b398818880
        • MD5 SHA1 SHA512

        Address.txt

        • Path C:\Users\Admin\AppData\Roaming\System32Work\Address.txt
        • Size 34B
        • SHA256 7373fc45b008cbaa3d86ecee56c74ba1291ddc2983c0637ba894281d0ae091e4
        • MD5 SHA1 SHA512

        EncryptedFileList.txt

        • Path C:\Users\Admin\AppData\Roaming\System32Work\EncryptedFileList.txt
        • Size 407KB
        • SHA256 45ffaf740daffd60bc2f409be813ac7fdcb62e0001d141d99a2698f42de79f0f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/4204-6-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/4204-0-0x00007FFDC3C6A000-0x00007FFDC3C6B000-memory.dmp

        memory/4204-2-0x0000000001690000-0x00000000016C8000-memory.dmp

        memory/4204-4-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/4204-3-0x000000001C150000-0x000000001C61E000-memory.dmp

        memory/4204-5-0x000000001C6C0000-0x000000001C75C000-memory.dmp

        memory/4204-9-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/4204-1-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/4204-7-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/5068-254-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/5068-255-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/5068-12-0x00000000012F0000-0x00000000012F8000-memory.dmp

        memory/5068-245-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/5068-14-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/5068-15-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/5068-16-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/5068-17-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/5068-246-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/5068-257-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/5068-256-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/5068-247-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/5068-253-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/5068-252-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/5068-250-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/5068-251-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/5068-249-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/5068-248-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/5940-10-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/5940-244-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp

        memory/5940-13-0x00007FFDC3970000-0x00007FFDC43A8000-memory.dmp