Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-01-2025 02:36
Behavioral task
behavioral1
Sample
6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe
-
Size
147KB
-
MD5
c09185c157831e4915c255d7002941f4
-
SHA1
beca597f2c2c120c3d74163501a81f56664ff4f7
-
SHA256
6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757
-
SHA512
a843854ca79f4d98938635612d20f3d5b79d8661ee91d1ae130b2deffe95e44d7028f76b8b221c87fab0638afe5baf3c55e8348f8aa10dddc90133167a3c17bf
-
SSDEEP
3072:SqJogYkcSNm9V7DnfX/91c6G+Mqc+2EIEMF+T:Sq2kc4m9tDnfXPc6g+2XEMF
Score
10/10
Malware Config
Extracted
Path
C:\5VFg9o5tW.README.txt
Ransom Note
------Dear managers!------
If you are reading this, it means your network has been attacked. What does that mean?
We hacked your network and now all your files, documents, client database, projects and other important data safely encrypted with reliable algorithms.
we also have a copy of all your data.
WARNING!!! You don't have to go to the POLICE, etc. Otherwise we will not be able to help you.
You cannot acces the files right now. But do not worry. You can get it back! It is easy to recover in a few steps.
As proof, we can decrypt any 3 files you provide.
We are not interested to ruin your business. We want to get ransom and be happy.
Please bring this information to your team leaders as soon as possible.
In case of a successfull transaction, we will restore your systems within 4-6 hours and also provide security recommendations.
-----------------------WARNING-----------------------
If you modify files - our decrypt software won't able to recover data
If you use third party software - you can damage/modify files (see item 1)
You nedd cipher key / our decrypt software to restore you files.
The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions.
-----------------------RECOVERY-----------------------
Use email: [email protected]
Alternative email address: [email protected] ([email protected])
ID message: c5337115f1d1a
Signatures
-
Renames multiple (609) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation CF85.tmp -
Deletes itself 1 IoCs
pid Process 2632 CF85.tmp -
Executes dropped EXE 1 IoCs
pid Process 2632 CF85.tmp -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2632 CF85.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp 2632 CF85.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeDebugPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: 36 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeImpersonatePrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeIncBasePriorityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeIncreaseQuotaPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: 33 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeManageVolumePrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeProfSingleProcessPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeRestorePrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSystemProfilePrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeTakeOwnershipPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeShutdownPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeDebugPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeBackupPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe Token: SeSecurityPrivilege 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2632 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 85 PID 2372 wrote to memory of 2632 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 85 PID 2372 wrote to memory of 2632 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 85 PID 2372 wrote to memory of 2632 2372 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe 85 PID 2632 wrote to memory of 4440 2632 CF85.tmp 86 PID 2632 wrote to memory of 4440 2632 CF85.tmp 86 PID 2632 wrote to memory of 4440 2632 CF85.tmp 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe"C:\Users\Admin\AppData\Local\Temp\6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\ProgramData\CF85.tmp"C:\ProgramData\CF85.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\CF85.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:4440
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5e4fc2feedef5286aa085f23c936b63cd
SHA131ebee57f99865bc2feea276e7784fbe662539d9
SHA256c193ba6d385cdc24a735dd0d2a88266a574191271ece2256a2b6a1f3e0e66610
SHA512e09d69a4f4cb204323d576577c1ebae3ea0b797991e7eaf7c436d654802292a2295d3c9e724b3beacbde8c1c299a6c5bd84f2f399969e874a9383727a866750f
-
Filesize
1KB
MD517e3459297cd54cf124d089248ff395b
SHA1617e2ddd0a69a242d4da510d32670a170ff667fa
SHA25694aaefad5d5a9fea79e9271941a5e874951cceac46a110ef0f1de841051f6421
SHA512280536a672423a4bf4df1cb7cd49bd0a7a3f731dfe4543359a84d3a82d734e3882386b336af62a77e2763cbe7fe9e4ff6ae852241dd61ab702cda1b0d2f02e13
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize147KB
MD501bed908cb0117c42429fb9e28d47a82
SHA190e70146fccbcc757dcbf760a91be22e1fdd2a17
SHA25687c4d9bc83464e20f9b80174ca41a4223d9793b92eed6212900ae8322a0e1ecd
SHA51230b0da17f0a390e41b0a1a41a6e540f757c9b21c9419805df065fae32027763e6f1fe8d983e13fc24a9215df56c2bf5715a836157d33c513c30219ca0c81b3e1
-
Filesize
129B
MD50693a710cf8577060a279ef175f0c0b1
SHA152bf24324fcd01dc2c1dbec65cafb19773616a24
SHA25611639c381fe0f3abc8335417523466fa1e029c02b5eeaa1da7c9539306f2b732
SHA5128eccc0fe788fb3cf995aa465d88ac867d76f3780f85e850d1384467dc3dd3b48dedb7751a78234f8f61161e0837bf99502ed4ffb1d824fd81d24be352b4fbdf2