07e694f81e57a93d885ff3ff51ebd31acc7260ec9ddfe8fcc4a9f97ec88f510c

Analysis

user interaction
yes
max time kernel
407s
max time network
406s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
idkikdikdikdikdidkdiddi.exe
Size 365KB
Sample260808-maek8avcrd
SHA256 07e694f81e57a93d885ff3ff51ebd31acc7260ec9ddfe8fcc4a9f97ec88f510c
MD5 07d015f6c4ad0f2e7857fb6ae9e07df3
SHA1 aff931e0e337a1e995b42c5fe297226b6e1ce213
SHA512 149064bba6d35f47cf5c881f7e8affd997f7000f2622c39deb888e1d7284967fa46dd9500ee968000643bd03482997c41550ecc53b2989226d52079ed64c71a3
SSDEEP 6144:txEZwfNSPYm1ESU3SPRpowRBZQbL1Ay6etyJOhcRXxZbdsanl6N:tTECjOZQbhd6C8acRhJ6anlo
TLSH
T14B847D19FBA404F9E1B7D17CC9634501EB727C9A4770AACF23A44AA61F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note

*** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. ID : 2C170C3C HOSTNAME : OAGGWFQT IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was on my server. good luck! discord.gg/B4ds5xKfvV guns.lol/C4N0F

Signatures

Disables Task Manager via registry modification
defense_evasion

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\acpiex.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\processr.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ndis.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\pvscsii.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\WdNisDrv.sys	cmd.exe
File opened for modification	C:\Windows\SysWOW64\Drivers\gmreadme.txt	cmd.exe
File opened for modification	C:\Windows\System32\drivers\bridge.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\ndiscap.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\scfilter.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\vhf.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\wanarp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\http.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\rdbss.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hidir.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\intelide.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mmcss.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tpm.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\BthMini.SYS	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\smbdirect.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\fs_rec.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Hsp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\MbbCx.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tdx.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\vmgencounter.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\devauthe.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\fastfat.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\globmerger.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\WdBoot.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\beep.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hyperkbd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\storqosflt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tdi.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\WindowsTrustedRTProxy.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\kmpdc.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\CEA.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\cdrom.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hidbatt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\CAD.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\vhdmp.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\flpydisk.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\gm.dls	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hvcrash.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\msfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Diskdump.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\en-US\hidscanner.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\volsnap.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\fileinfo.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\qwavedrv.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\WdfLdr.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\amdwps.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\hidbth.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\pci.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\evbda.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\kbdclass.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mspqm.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\winnat.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\EhStorPwdDrv.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Classpnp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\cnghwassist.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\Microsoft.Bluetooth.AvrcpTransport.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\tpm.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\PktMon.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\wtd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\acpitime.sys	cmd.exe

Manipulates Digital Signatures 2 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File opened for modification	C:\Windows\System32\wintrust.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wintrust.dll	cmd.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C4N0F.exe	idkikdikdikdikdidkdiddi.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	discord.com

Drops desktop.ini file(s) 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\AM83CD~1.159\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM6F13~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM7706~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMD54F~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMA1D4~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM2D5B~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM5C63~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Users\Admin\Documents\My Music\desktop.ini	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\desktop.ini	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Windows\WinSxS\AM1052~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM3D7A~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM0718~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Windows\WinSxS\AM8C1C~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMF6B4~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Windows\WinSxS\AM90D8~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM35BB~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AME61D~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM2879~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM7DA6~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM87B9~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM065C~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM6257~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMBEDF~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMA8BC~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMCA47~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Windows\WinSxS\AM4C16~1.115\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM4A4F~1.115\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM01A8~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMAEF3~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM1487~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Users\Admin\Documents\My Videos\desktop.ini	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Windows\WinSxS\AMF4D3~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM06DC~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Windows\WinSxS\AM5558~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM0290~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM3B18~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\PROGRA~2\desktop.ini	cmd.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
2	api.ipify.org

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\crypttpmeksvc.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\ja-JP\TestDtc.psd1	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\sisraid4.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\drvinst.exe	cmd.exe
File opened for modification	C:\Windows\System32\en-US\tracerpt.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\raschapext.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\ActionCenterCPL.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\activeds.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\SettingsHandlers_OneCore_BatterySaver.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\stclient.dll	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\mskeyprotcli.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\termsrv.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\c_magneticstripereader.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\NETATH~2.INF\eeprom_qca9377_1p1_NFA425_olpc_A.bin	cmd.exe
File opened for modification	C:\Windows\System32\en-US\mrinfo.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\qmgr.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\fdProxy.dll	cmd.exe
File opened for modification	C:\Windows\System32\wbem\AgentWmi.mof	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\DispBroker.Desktop.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\CertEnrollCtrl.exe.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\fwpuclnt.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\netelx.inf_loc	cmd.exe
File opened for modification	C:\Windows\SysWOW64\sppc.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\modemui.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\werui.dll	cmd.exe
File opened for modification	C:\Windows\System32\agentactivationruntime.dll	cmd.exe
File opened for modification	C:\Windows\System32\Dism\es-ES\LogProvider.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\rtucx21x64.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\fsutil.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\slc.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\EhStorAuthn.exe	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\SettingsHandlers_Geolocation.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\nettrace.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\gpscript.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\rasdial.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\en-US\Windows.Devices.PointOfService.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\UserAccountControlSettings.exe	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\dot3gpclnt.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\uk-UA\DaOtpCredentialProvider.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\olepro32.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wbem\Win32_Tpm.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Storage\Disk.cdxml	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\wvid.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Provisioning\provautologger_add.reg	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\SyncInfrastructure.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\cmbatt.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\en-US\setx.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\recdisc.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\wship6.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\SystemSettings.SettingsExtensibility.dll	cmd.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\MSFT_ServiceResource.schema.mof	cmd.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\wshext.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ERRDEV~1.INF\errdev.inf	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\AboutSettingsHandlers.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\DialogBlockingService.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wbem\en-US\netdacim_uninstall.mfl	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\SmbShare.Format.Helper.psm1	cmd.exe
File opened for modification	C:\Windows\System32\en-US\WorkFoldersGPExt.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\WmiMgmt.msc	cmd.exe
File opened for modification	C:\Windows\System32\nl-NL\windows.ui.xaml.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\bcd.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\spp\tokens\skus\CSVLK-~1\csvlk-pack-Volume-CSVLK-10-ul-oob-rtm.xrm-ms	cmd.exe
File opened for modification	C:\Windows\System32\dmclient.exe	cmd.exe
File opened for modification	C:\Windows\System32\ga-IE\comctl32.dll.mui	cmd.exe

Modifies termsrv.dll 1 TTPs 1 IoCs

Commonly used to allow simultaneous RDP sessions.

Remote Desktop Protocol

T1021.001

description	ioc	Process
File opened for modification	C:\Windows\System32\termsrv.dll	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ransom_note.bmp"	idkikdikdikdikdidkdiddi.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Trust Protection Lists\Mu\Entities.DATA	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\VBE6EXT.OLB	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Primitives.dll	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Locales\kn.pak.DATA	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zu	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHART.DLL	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GFX.DLL	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUTL.OLB	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\it-IT\msader15.dll.mui	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.5\System.Windows.Presentation.dll	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\CLICKT~1\STREAM~1.DLL	cmd.exe
File opened for modification	C:\Program Files\WindowsApps\MovedPackages	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL081.XML	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Windows Media Player\Media Renderer\RenderingControl.xml	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\ui-strings.js	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hu-hu	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_ie8.gif	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Locales\kk.pak.DATA	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql2000.xsl	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Trust Protection Lists\Mu\CompatExceptions	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Locales\mr.pak.DATA	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cy	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\nl.pak	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPCORE.DLL	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit-hover.svg	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\PROGRA~2\COMMON~1\System\msadc\en-US\msadcer.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\psuser_64.dll	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\ui-strings.js	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\Crashpad\reports	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\quz-PE	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationCore.resources.dll	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SECRECL.ICO	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationTypes.resources.dll	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\de-de\ui-strings.js	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Beta.msix.DATA	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Trust Protection Lists\Mu\TransparentAdvertisers.DATA	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\VisualElements\LogoDev.png.DATA	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MAPIPH.DLL	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-locale-l1-1-0.dll	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\WindowsSecuritySmallTile.scale-400.png	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\fr-FR\mpvis.dll.mui	cmd.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.TypeConverter.dll	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\vi_FEMININE.pak	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\LICENSE	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\calendars.properties	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\THMBNAIL.PNG	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\theme-dark\Threat.ico	idkikdikdikdikdidkdiddi.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\PresentationFramework.Classic.dll	cmd.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.5\de\System.Data.Entity.Design.Resources.dll	cmd.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\servicing\Packages\MI55DE~1.MUM	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMD9AA~1.1_J\DIAGPA~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM065A~1.1_N\kbd101.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMC369~1.1_J\UIRIBB~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\Backup\AME189~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\$$4009~1.CDF	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM3143~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\SETTIN~1\WOFD03~1.MAN	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI2ABB~1.MUM	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM7179~1.1_N\msdri.inf	cmd.exe
File opened for modification	C:\Windows\WinSxS\Backup\AM4166~2.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM0290~1.1_N\WI8339~1.WAV	cmd.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\PRFD9B~1.CDF	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM7C12~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM714A~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\X865FE~1.1_F\SMTPSE~1.RES	cmd.exe
File opened for modification	C:\Windows\Installer\$PATCH~1\Managed\68AB67~1\157~1.200\SYMBOL.TXT	cmd.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Assets\contrast-black\GetStartedAppList.targetsize-48_contrast-black.png	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM1C46~1.159\OOBE-C~3.HTM	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM2F94~1.1_I\SENSOR~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\$$_WAA~2.CDF	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM9197~2.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM56B5~1.MAN	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI41F5~1.MUM	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM30A5~1.1_E\infoctrs.dll.mui	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM4584~1.1_N\msls31.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\Backup\AM761A~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM3F0E~2.MAN	cmd.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-white\Home.EmptyStateNoRecent.svg	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM8675~1.115\AUDITP~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM23C0~1.174\r\w3dt.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM211F~1.159\SPPWIN~1.XRM	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMDC72~1.1_I\SSCORE~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM4EB1~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AMEB32~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AMAF5B~1.MAN	cmd.exe
File opened for modification	C:\Windows\SystemApps\LKG\MICROS~1.SEA\Cortana.UI\Assets\Icons\SmallTile.scale-400.png	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMB471~1.1_D\406.htm	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM275E~1.159\WIDE31~2.PNG	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM73A1~1.1_F\pubprn.vbs	cmd.exe
File opened for modification	C:\Windows\WinSxS\WOB034~1.145\r\mprdim.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM83C5~1.159\wcmapi.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AMB0F0~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMF257~1.115\vdsdyn.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM2A55~1.1_E\WININI~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\$$5DD4~1.CDF	cmd.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\$$E668~1.CDF	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM5A51~1.MAN	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MIEC77~1.MUM	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM6A8F~1.1_U\RSHX32~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\Catalogs\7dbb27692709eecf84f4cf1e1ab22432cbb100379a1f3e47721abdd6c22cb1cd.cat	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AMF061~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\WOAFE0~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\WO2788~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM6DD7~1.1_J\CL_LOC~1.PSD	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM12FB~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM631E~1.MAN	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MIFB95~1.MUM	cmd.exe
File opened for modification	C:\Windows\WinSxS\AME121~1.1_J\VMSERI~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM137D~1.MAN	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\HY1FB4~1.CAT	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM86F4~1.1_E\NETCFG~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM6DD9~1.1_F\MSFT_P~1.PSD	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM78CE~1.MAN	cmd.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2616	cmd.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3140	idkikdikdikdikdidkdiddi.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2556	LogonUI.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 2616	3140	idkikdikdikdikdidkdiddi.exe	91

C:\Users\Admin\AppData\Local\Temp\idkikdikdikdikdidkdiddi.exe
"C:\Users\Admin\AppData\Local\Temp\idkikdikdikdikdidkdiddi.exe"
1⤵
- Creates a file in the Startup directory
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rd C:\ /s /q
  2⤵
  - Drops file in Drivers directory
  - Manipulates Digital Signatures
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Modifies termsrv.dll
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Executes a command shell one-liner
  PID:2616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:792

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39cd055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2556

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:4040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C4N0F_launch.log

Path C:\Users\Admin\AppData\Local\Temp\C4N0F_launch.log
Size 563B
SHA256 c72d921339771ad37606fea72067c32a4cf0d5c167bc1a213d4f3dd432243a41
MD5 70855bd063771f76412af2747448fab9
SHA1 aa1cd50c84729e820174eaab00b2da0ef1999ce3
SHA512 d463c7fefa7192a64265ebc7044959a3712bed10086e9465957ee60f26ff96223d857ca66c6eddbb5ba97a14cd04316da68880f3fafc4a7bce41a955bb1a5d45
TLSH
T190F090410E29907C4FC21135043E23FA426801EA8FE2C2F562B1131EE56B78CA73AFB5
MD5 SHA1 SHA512 TLSH

Submit Download

C4N0F_launch.log

Path C:\Users\Admin\AppData\Local\Temp\C4N0F_launch.log
Size 1KB
SHA256 f921e4a1c1bc38858ccd43523bbe838bf1e19eb2328d08f4ed1058504ea6379c
MD5 3ef8ac85765817ce48113b89c33ae545
SHA1 7ad7f64ccaa4e30ff73ff3c7c3b1ea427880836d
SHA512 34e02dcb509bee6cb1c7f5805876978a26640f71ea6bddfb496dd6a4188bbe7b1be1694b8b9ad97dbc434514725bbbae1d7924e5bbb60fcd16ce195eda18ff1c
TLSH
T1A041B8411EA9906C5AC25131143D77FA466802AA8FE282F562B1021DE56B78CAB3AFB5
MD5 SHA1 SHA512 TLSH

Submit Download

C4N0F_~1.LOG

Path C:\Users\Admin\AppData\Local\Temp\C4N0F_~1.LOG
Size 2KB
SHA256 4e50c56d3230b2f08f92d90ff97f1320aafccba2bfc1260e14f1fc2b21469199
MD5 9147713790a13ecf3673a7cca1ae198a
SHA1 128642f163af09792f9c2a662f5d5c0753c6196e
SHA512 5d65695acfd53f5f242e2af18a0aa01d14a2d3a3636988643ac01e908e188081d6ea2dfc930b9f8f1f8f87f805eace574c4061c1fa0ed1dfb33c5e5f855c4fda
TLSH
T1C741CC410EA9946C5EC26131143D76FA466803EA4FE2C2F562B2031DE56B78CA73BFB5
MD5 SHA1 SHA512 TLSH

Submit Download

RANSOM~1.BMP

Path C:\Users\Admin\AppData\Local\Temp\RANSOM~1.BMP
Size 5.9MB
SHA256 1cab03d220a0eb77308d8bf486454b1c89ee93542c37deb6a7e1c69e61bd0fbf
MD5 72017001276af9b001dd03561dac2abe
SHA1 13b70eba95ae9a0b83a8421a0b9ea368e2c5e18e
SHA512 82f5ddbad244a2988d254e3f5a088d21607177ca3066fc3ea5ebd611b7430c2269f33b3cc36f34e0f3ece68ad679a4664b814d435ac0f2fc46b78710d8d5042b
SSDEEP 192:lxXJlUs9qonn1uRYfFlicOV31Z3XGgch6YQR9wMZ+/InHUBSzbyOSbZ3a92BZRPO:a61HGWrsH7GVm30hJKJeNuR12pjDy
TLSH
T1AE56D7783B5D2DF5FB8CD03060E25551CBB146FBA8A021D0AB6E83F9D6C21885F689F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupReset.locked

Path C:\Users\Admin\Desktop\BackupReset.locked
Size 232KB
SHA256 f06c14cb0b55face8c4b795931aeae5dc69995531b4de8da17b9e3ecada64c44
MD5 4fd7e9998d44a31cbaac2159c997ece4
SHA1 5f3e04bc7d3df95537a38f75f42cf1eb882dd9ea
SHA512 1d4944fdf8a28d69b1ba9eca875d7c5a506a5bf3f3b451d6b4c34b376ff76e39886748d3f1c2521d92cdb01c52fff42496b4ce452a3e9734e011c5914e3d8726
SSDEEP 6144:9rSA2j1XoFOyUuUWD7LRPLGmObP14jbSg:9CocjWwmNSg
TLSH
T10534230FACDC6CF5D16865B3DE106728E75A8860CE05CB904BAAEA034983ED55FEF507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompressResume.locked

Path C:\Users\Admin\Desktop\CompressResume.locked
Size 327KB
SHA256 1e04e7bee16973067054f4052808651763d4fadb4c66d9fb9574148e626fff78
MD5 8eba38a9fe66d0c1f863a31e4585d2c9
SHA1 914732a5ad994bbfda3168c66945033dd6f33b9a
SHA512 553e9572156bd40763a327ec3d4eab1268dfe3be87840de340060740b8a107f4883c85b973aa189bf4b3cb74264b3cb40b5eeb7a4c59569a3ae8b34a211be436
SSDEEP 6144:H+6jOD5Wzjh6a9BQZhT/+2Fjzln+/uSndwbL3NSNkNgZ:eXDvwBQZhSc/lxKdwbLdwp
TLSH
T1486423B73FE9B020596E60F1742D9A48171DC578077ECA1D2FE225C1B539AC3E512AF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DECRYPT_INSTRUCTIONS.txt

Path C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt
Size 605B
SHA256 1b34f5cda6abe47e8c0f508c27c4d39b446968ddec0745f5edd2c53b535b4d69
MD5 3ffa1d97db98a05f7c7a94f9879e4483
SHA1 775761b5b6a75de0148ef09ad451d8f2244c7cc1
SHA512 dcd419d45853034dc708c47ebdf28fea1a1563e711768347154979e4d4023b48b1becd9ef10c6498c33ffb266c09cc91d5d48142de54b9b92db0236209ee621d
TLSH
T114F0DD7FA407900116A324827A19BA63F3514249112E22062C1DD46C207D64AA6D348D
MD5 SHA1 SHA512 TLSH

Submit Download

EnterSplit.locked

Path C:\Users\Admin\Desktop\EnterSplit.locked
Size 127KB
SHA256 4408da0ecf7f712e4d0394380d4ae6012e3dfd6881a26f07675d70ae26eb3a2d
MD5 157128e94d5769c9e6db4abed5fe64ed
SHA1 607f73b269d811900d8a5284f97c4b751eb4d3bc
SHA512 4f642af3ebb220ee31a7231e3588fdc70789b1fb284e8cb403050aaa1982fc4e3ff520cb6be4ee1fd64ad00683bcd6a19d628e1f6c5e376bc5bc686d1b995207
SSDEEP 3072:uglB4qg5xWV+F28FjpG65NEpZsrKfsI9/k9i7Cf06VZZ20b:uiyZs+AqpG65N4aKVL7Ct300b
TLSH
T192D312022A40661194E0154F35F3BD221135DAF3B895F2B3AC96EFED2FD52599D80ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetEnter.locked

Path C:\Users\Admin\Desktop\GetEnter.locked
Size 179KB
SHA256 2361de4a171b5b2c2a8f5576df5bd2535f1ad01e9a86bebcf8deb675c1695dae
MD5 411fa34b15ce9f1f20658127c05a1f10
SHA1 eaa4ef6bd9b1c125c9d37a85caf4853ec908fe89
SHA512 e4c15f3f81c80ddf7d74e0e93d4b8520c8f8c5f81af79730204d99545bcefa3e8bb734f5180969ff2446ef68618b1fe3c9cdf9edb757a2f75eb61bd464fda448
SSDEEP 3072:0hZcwXnPMmKcICu/3WfjucIjBXIndUb92l/GcwCP2Y1G6731Byk9fqeFZNnoJ6M3:YqwXPMmKX9fWbuFdInyYCk2Y1r31Byqe
TLSH
T12404221067C7DD5449E352983E73C2738235098DBBC3C9BAF2E372588A83599758D9E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinRemove.locked

Path C:\Users\Admin\Desktop\JoinRemove.locked
Size 9KB
SHA256 ebf9f308cdf8a741ce46be63b6dd70a010cd15294f3d300b31ab02fa5af2788a
MD5 67a2c13855ab4aa8d3dff9156b8ffb24
SHA1 91823f846fa0200b8ed6e84b952a4883147efd86
SHA512 b7ab8ae6804966c3b5221abdb9dd80b09d282477072d8b5002f9d40c025cffd30fe6a9ce982a1b4a25e19d85e0a15870c5661aa925e9778e430e58d3d537af62
SSDEEP 192:UlI3AFlLpzgv4WauUv7xM/IsrpKGfJDll/zmXqep38RZBy/jS:UWQFl5gAWaZW/r/VepMzM+
TLSH
T1B622A055423D2C732C15F1EE991E945213FDB60113A11C20FEB80AFD67F25A9375E907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitSelect.locked

Path C:\Users\Admin\Desktop\LimitSelect.locked
Size 14KB
SHA256 806ace92a36685d694f4c74ca98b09c581d5d57d058e234f85be10ea25841320
MD5 472e84f2b67327e75eb89ace965bff77
SHA1 7118d270097df774bd0261973a97b2d13b60ad78
SHA512 197a96b555469c04d87162568292abb0b4cb29ff31a2d00353af694f89a91da87109ca83f56318f33f7fbc1b80b5b24059a19ec1e330a267e691a1f9eaf77d98
SSDEEP 384:UWQFl9vDdqVcNsjrN1kJQNTCgIcsYnOq8UMuXh4OKrRlaV:UdL9vhqVpR10QNtvOtYKRw
TLSH
T1ED62C0C0013F4D6B100BDAFCF8BC64C2227BB1D6E530B75125923BE893B69AE9960955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProtectClose.locked

Path C:\Users\Admin\Desktop\ProtectClose.locked
Size 253KB
SHA256 b076ba736b09a049020286e3def746b89616c68d5f0d53db463c784d3aee601b
MD5 93087b4e6ade272d64b9c526c0c56632
SHA1 ad6960fcf198679ece5d8cece8213d0f21383e0b
SHA512 cc084bf4c04213544af9f863aa37515914a88a1236247ce93d1d796d562f17006877ff6405c3672656f2522d2f473b213d94663cefd689d3c4505915e0e9e4b3
SSDEEP 6144:mrJRzl/veq5EZMTAGXPuKIZhlbfHiR0qeFfxN3kA8yV7HdH5:CJj/Gq5oM/XPubh96kfxN3IEl5
TLSH
T1C24423344DD20D020BF00E0D4EAFF8A661791AB6958BDE28527B0DD25BF6A5C0A71DA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnlockSkip.locked

Path C:\Users\Admin\Desktop\UnlockSkip.locked
Size 243KB
SHA256 0132e05ef26ec012f07bef0a03124ad5ad6583dd60bafc92db42ce88cad2cbdc
MD5 ff4b90e0526c8440ea9d593cc37c5d93
SHA1 602a533745cf146cd4d325ff02783f1cc98f3db0
SHA512 b95c1cff428f3a1752d90ec9684a4d6c64cc635ca95511656fe90b79c9d23e1d31392c8ba4a3065131114ea503a2462c7028791fe93f3419911387e3bfadcdbf
SSDEEP 6144:dlFwqopy3ep+AX8+PenQeCrKWeaux4eKhmrNsnjIci1q5+0HV:Rwfxt2nQRrKWeF2eKU6jICY01
TLSH
T1BB342318E8C55CA3B3BE2C39AE2ABFBC49956603B2D9404F9504877311055E2BD1AF6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WriteDisable.locked

Path C:\Users\Admin\Desktop\WriteDisable.locked
Size 455KB
SHA256 bb5c7c23fd8ba440cd8babd5dd709204d5366de59e9285a202a0e260b8a2c4a3
MD5 f2a1d5b6850666c3a33457ea688874e9
SHA1 6716d5a82648f84349d6fa854f56156ac61a4d3c
SHA512 2e5c6fd4aec38ad53455e95b19568b9b147e08869d8af37c9c0dc35c31a9f685adceabda1c6c2b3845fdf2289233bdd97f2c1e879d1df0576d3586797b5d8790
SSDEEP 6144:DBDjwMtKio24+4d1TNPB9t6bRNfB/rgJ19rEJJvMmyWzjAxSlOxfzaTuPYb:DZiioRL1JPBeRAREJJlzzjoSliEuwb
TLSH
T1CDA42349B4D6725AE3800F61998743BA3C93C4E0E83DC7AF5DFD69A04E522E9B142F1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.locked

Path C:\Users\Admin\Desktop\desktop.locked
Size 346B
SHA256 a499aac43fbfb28cd7a08c9387d89b7dbb151095522943f412539f86a05a69c2
MD5 779ba0d4bdb574b83e454441788cc254
SHA1 61c086a5e90151b3bfa8ef0ac3b8bd32f256c987
SHA512 f4c88d5c816b0b38209abe99aea634ca04701ed7651ecb120e5416d006dc529b55a22241210a54bb692d431e93e1ed39193286597293aa759a5f4050fa6845fe
TLSH
T137E0C075CFC44288DE0D0106FCB4AB6C00F60B5842084DB290B6B8B9C9A7D5D0640201
MD5 SHA1 SHA512 TLSH

Submit Download

ApproveExpand.locked

Path C:\Users\Admin\Documents\ApproveExpand.locked
Size 13KB
SHA256 6c71cbc3b8aa9289766f969f92ae95a8d0c5486d189fb32c0d331a6f8bbcda71
MD5 da097c51c98dd2d8276ac50eef8f7ddb
SHA1 a91d5ff54f19c68020165c05099c979cf9f503d8
SHA512 3998111436d73186eef709b09012d06232de38f399752aa159cc1cab6bbe0764ba14f2d631066975ddb4e1d858f9607f7880d13d9563c61818295f53049a4a96
SSDEEP 384:qWQPe62CKHKJQb/RcjuJKAI0DMYRdpaonDdG1y7gKOgi1:qdW6NKHK2beuJ3I+dlh7g1F1
TLSH
T19B52D04B89D258A639CBB5D04D345CF0024E68113EA1872015E93CBAF993DECB367913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InitializeOpen.locked

Path C:\Users\Admin\Documents\InitializeOpen.locked
Size 744KB
SHA256 a55ba84947318c090b18b3df7a6929c5ce8dabf522a8c2622fd6615ae6ce244a
MD5 a539a37ef0e066fb1e3aa343d2a3680d
SHA1 8635711b9ea133ab1b20e0760e160d732ed39dd8
SHA512 611f5d40e5a2a0522971f163c6e12cf881550aed7c1a020d49a2d34bbffaf8c50b269d6a309b51e9706ccbb4d937c6915de4a8a6a5e5ff3bf7930415350b9bd2
SSDEEP 12288:4NlOdlm2jvTfLgOBKbw0TwTs7PsLdtX6FJSQPXeCzlPirw2Z8Ji9jaub5N1exQD:My7vTfLPB+wlOCtX4SQ2Vjaulexc
TLSH
T1D7F423A536465319270DCAD3CCB4DD6B307EA825E96B95742271B1CEE2DB7BC0B003B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OutSubmit.locked

Path C:\Users\Admin\Documents\OutSubmit.locked
Size 19KB
SHA256 bad202f2f6e64f23a9a0dd3722e05b543e1d7a4bcfaa702f355175357a8881f8
MD5 2230d304997b59055ac79c30c11ccef0
SHA1 83a4c8b95071f1a0dd3eacbfe06d6acbe6fa5dc1
SHA512 33345b47335565f6ae7a0af764685ee404a2734739759bcfabf166c14ca6e0a571c6f3218821adf9ad485d43c2f15f9dc80adf7296cf847424fafbefde07bf4b
SSDEEP 384:qWQPe62p+k/Jw3MiSl7mhLnctIwtR0rHtCWpsC32phEnO47n:qdW6Irdmhjcx2btVas2/EnO8
TLSH
T11292F1D1CCB92CA83D5BD79D403C340E411059F4AFA3066552EFC9AFE6EA3AD384408D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Outlook Data File - ncmugltbwf.locked

Path C:\Users\Admin\Documents\Outlook Files\Outlook Data File - ncmugltbwf.locked
Size 265KB
SHA256 0128108582a7e8649fd602d7be2cdbf229e47f671ca75cf3fdcf50140ac5c1e3
MD5 8cd313fcb3e5d6dfb786e93ee9cce146
SHA1 9db72e136362a6d2a7170615d21a46b6486989b3
SHA512 9badf8cfe492b0f6306dec3839d76e33677be00f80d550b520f83dae63cc9da47d86d093c3e0154056382f69c37bba65fae61826e37b94581e1a2e3950e2c7e3
SSDEEP 6144:Nyr/xTZXof5VzGFlju8PgkJ56RoqcJl9XrKMHLp:NyFJof5VGFHgXRoq8llKMHV
TLSH
T10044231A9D077431B3829E90165F93D22EA917BC18C1FC96D75C9FDCA4C120B2A7FC8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShowDismount.locked

Path C:\Users\Admin\Documents\ShowDismount.locked
Size 12KB
SHA256 47ec5c1c8c0cbe133af7546e1f83a252f7fe27136d23b17af83c949618e36525
MD5 7aa95347000293e836473b9625472d22
SHA1 f8a378898f24b7eb7653d99f36b4afe0440247a0
SHA512 be7d713651d107d1ee34edf15c5ac778e67e99c8423e683d8c540d54377b72c2ba213c275c0b2dc4e161565cccf3fde9ba62708cad530d9b0344741884e5db42
SSDEEP 192:UlI3AFlLp66FkX5wspuCwJL5hni1QYIG9Ar5Z5oi37xH3qQgJo68e/QTAReuSKgU:UWQFlsXH25ihI4+KIxXqdyRe/OKaKgrQ
TLSH
T15742D0BED789BCE41C46E7F676A48D920EFC072A8F28313747A05D1DA312188ACEF155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitSend.locked

Path C:\Users\Admin\Documents\SubmitSend.locked
Size 1.6MB
SHA256 662ea14f88b0791e0db45f605f2dc6f42354a580011ded764aaf957149d728e3
MD5 c0e840786f957e64d8733f9e57907932
SHA1 5d7151bf098b68ab41f57007883daf3da7a5e368
SHA512 96c76fdda6dc12b89cb2704dab5469832e00c1a7c42a4d679b5f3ce46239465001c5d911cd4ad775c7ff4c140041438c365283e5bf5eb6b7e22675a53ea31f2b
SSDEEP 24576:0hFmXwOJGyUYch8Dq/yM1xot13NnWQoOjsRQpVzP/FgJlJj6hbdvKjyoxRh2xQq9:QFmXwOJGyNcyDAQBSJaXuIT0yoRlBC
TLSH
T14E7533AC27E6DA6DE63C68D1E748C144C2BFF59089B3B0BCA570CA647363372E55690C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnblockEdit.locked

Path C:\Users\Admin\Documents\UnblockEdit.locked
Size 18KB
SHA256 44cc566574faf2525d113d4b2a0322e7304949c74c88fab37c86337fc0e412f6
MD5 3c70f5abdd6e0e0e91645702cc1c4b59
SHA1 0c0c6eb6ae8d25c2cacc57fb257d6528f61f54c1
SHA512 440fc295b85cae37c5738743a6cf572f17ba593b9816355e7dee621dbd9ab0154a4cbfe81247b0ca93fbeb49c9e7983b143adf3c90a387f8f7641379f38cc8e5
SSDEEP 384:qWQPe62pl9x2nfh0v2gcGOWjVCDAxIsyYRseUJKEr35/ECzF:qdW6+9c5NgcxvAC1JRZE+
TLSH
T15682E0006D37FF0C96C4D5EAA36CB9E06DB0D0A02534E66CE99A470899E3D71E3668F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UseWrite.locked

Path C:\Users\Admin\Documents\UseWrite.locked
Size 11KB
SHA256 52f277501a30f50779b8723604c3f8b2fb6b9a196f07c118864d9ebb66a09215
MD5 dd3f69c531d2b26cca299111ae919002
SHA1 1fa5b500d3128653cde25ef7b6c5552bdd4ad918
SHA512 b04f063b683f743ffd81f2cb87a593f723f0e4c8c7fbcb74327ed13787574e38d46d7bbb7cf65cdf36a3ca08853639d8037ab88dc13758eca1dbe86d785c9905
SSDEEP 192:UlI3AFlLp7sySKzulI9aJ1NLQhhL8gTxCaZg+jNn307DsEW+iOP3TNib1qtbI+PR:UWQFlVsySKz14JnsoxaG+V36YObNlfJZ
TLSH
T1C842CF05DA345C0D19AF008DC4AC728912EDA305E2F64DA4479C1F3F1BEF2687C9DAD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.locked

Path C:\Users\Admin\Documents\desktop.locked
Size 466B
SHA256 39fed699e16b273f913293da352810d0218e32515aedf51d04acb0892352c66b
MD5 02fe65f7e1c15be18bd84372512ab090
SHA1 8e3a8c078ed595b8b49b6f10c0426ab83704908d
SHA512 641a3d9005bd14b2a3a4bf080afc3a6d151a4447e604dad9d1a0cf8fb8b321c195acbf115174cd58502c6c464b827c32e9a2f494201be7d114172ab76e51b526
TLSH
T11CF0547CCF80428C9D2D3403FD74BAAC00A64B0C41544DF1067678AB655B92E0200343
MD5 SHA1 SHA512 TLSH

Submit Download

CompressImport.locked

Path C:\Users\Admin\Pictures\CompressImport.locked
Size 111KB
SHA256 cc1e4e8767f27d8ee51c7296012c39c959215be9b296a529e85dc552adaf1ec8
MD5 a925f7b6a923d3f412f6066e697afc31
SHA1 f970bbe85ee69c51b7a290ee5df3b27167f5c208
SHA512 da82d67172636de918db99b4218404c7f31f2a09fb922965869fe5edccd73767223074136214e6777f215211436759546f4fd897f0a3776e6ffebaf7fde2a269
SSDEEP 3072:RLopVibTN2Ri0RJ+IZvJxeQahocEmx+92:RLwV8kba6hxOopmxA2
TLSH
T1E8B3125E01F856591BD04B5304F53A27CDDF41E226F410AAFAB06B53384F44B2BA7EAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismountMeasure.locked

Path C:\Users\Admin\Pictures\DismountMeasure.locked
Size 122KB
SHA256 cb3b5e4f6a4ba80b246c9e30b4d968b408ab9a746ee3798e527efe829e27c828
MD5 d15827faf2899c4ee0b847f7539bff9d
SHA1 a9f4666dfd5dadc4afdd36c1f3a614d9b8d8a988
SHA512 490eafdd8dcee00a52c4337a36b3b61abdd8ad4657df9c865f83fb2e9f0a9454b2b4a90d1b974535e34dda4ccfab614e334f2f01b455ed12807154ef9b9fa296
SSDEEP 3072:PZx0/mKDw88MSaWtxNq5MA7V8rCeAAh83+DcaHdQEBb:PZxUmKjhXWtO5MkVGzhlDca9Q0b
TLSH
T1C4C312EBC7A172DF83388E9B31942977FA26165A910460753146F070A2576BEE2CF3F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegisterUse.locked

Path C:\Users\Admin\Pictures\RegisterUse.locked
Size 196KB
SHA256 6d179ff7c9e64b3198b22f6fb9f3c20d28f0fb4d9464d55c2b836a14240d8edf
MD5 c56adf348fdb85c3a91924ff7f619f1c
SHA1 247f8445a73ff6d14f8e7679e142eb5a7c6264db
SHA512 8108fa174e6114795688d6e892a0585c40c4839c9013b798e441d15de2c94e10ab0ad928ce85526b0ebac383ff2bfb02ab1b5884599b9ab71bd4037f9e584d7f
SSDEEP 6144:uG/1kNH9TIWhAmj6OvZnrwmyvnQ/bYPn3oeTi:u8Q9TjhRj6OvZEvvnSbYPfi
TLSH
T1621423C80E6ED769F9F8F650D950864D5003BA79CF3889F492D721A96630EF1D3E124E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetReceive.locked

Path C:\Users\Admin\Pictures\ResetReceive.locked
Size 175KB
SHA256 9690af1e92689d3ea35bf8dd05d753af9fcd9effc787f3964efbc9536202b948
MD5 f189f4bfaaafbda34f3b4460e5d8d071
SHA1 98b9b2e59cb2fa648a0af8341df6cc236df10fad
SHA512 1e36dfe8d6ada28216bb99f7ae788308a319290f1939701a0356f2fa8373886318995346de767b12fbe363c24db6938072543a26e9744250346f470da0308762
SSDEEP 3072:BsUyjE/H0iM1sk351/eOuT+XoqEQyPdC6luJNuu0iW5OPUhKAT9GYuheglB:6UtE6k35buidTyVrr1iKOPUhhGYuw8B
TLSH
T183041247D59D3D8B546C71813ACBE13F021E98A7E6A86300EBC5A3D11EBC5FCB9A4970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevokeLock.locked

Path C:\Users\Admin\Pictures\RevokeLock.locked
Size 233KB
SHA256 37e8512aac84c0bc42f16d732accc19dd998b38076103ff837ac71c1f8f60ae1
MD5 088fd29f0e0ff81960ecb6899d25b5f3
SHA1 80c7c8e8f56a34c7acc1329c54073d293c8bbeed
SHA512 4bb4b4f5af402895e0b752ddeef77af41582803f06c9f503379faeeb62026ba31204a9012576c06c891ecf40a63ab0b63c81d9147c9bd3d1381972e7c9b18765
SSDEEP 6144:n/8Dv3yzv7O6bUf+6G6x0LFxl3bWxfXAk2ohWJiHvB1:0DKzvpbUf+mIPWXAbJs1
TLSH
T1133423ACBAFF198F6DA8C7851D3A51B713AF043CA00E242EE51C661DF18A921157B6D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShowUnregister.locked

Path C:\Users\Admin\Pictures\ShowUnregister.locked
Size 228KB
SHA256 47369e0dd597e1cb4f062e297d46970df47387f313378ede3d704aa299759659
MD5 e5db0c39d22207782f8873b944a6fa13
SHA1 bda89304b19db866be54937ef9f57e5cf8ebfe05
SHA512 f2c7acb9771d68c37b7f4ea7850e839680b22f4755bc94c1d2becc6770c88862d389425b91c18de6f6eb9db56ee9311e007014751c104a0aaa8876264ec5a764
SSDEEP 6144:FDSFHAF0826bwMVHyjUcj8aE0SU7LaQ9d7:wgF082+VMNjM0vvaQb7
TLSH
T10F3422C7DB08F676A5E1CEBA3BCE78B09B117A6C19D5450EB0358C99899B07733C8215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnlockSearch.locked

Path C:\Users\Admin\Pictures\UnlockSearch.locked
Size 106KB
SHA256 5b86101bc9af95dce17846af73a0b4c2652f2e319782142db837a91dba6b6038
MD5 1589f7b5fb523d5c43aaad5cd5e8f27c
SHA1 4ffdabe19a82d608eaaf9278dfe7f7fc64396994
SHA512 95840799b44bb5c92342f9617cad777c9a105ac4b6f5a54ebe176bb2cd1e2702da43123189520636c6d82fb5450ac8ddff121942091c53324e734a9cb3bca5cd
SSDEEP 3072:OVlKP7tYHN0U7FFk823fptTxVd2yLoQsQ7Zmf0BZ:EUytt7F+823zTxGyvnZo0v
TLSH
T1FAB312A5B044BC7BF888F19580EFBDB79D0A494C59D03AB728C19FC71BCB2D4A499861
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.locked

Path C:\Users\Admin\Pictures\desktop.locked
Size 568B
SHA256 3d0e92f1fabd5eeb0283d5c79ac09ade32bae553d3826752dd2459ce0e92c393
MD5 98292d8267b9fbb36fea67357a8d6b0a
SHA1 8edb06825cc501438caa00743727fd753be680c8
SHA512 f60555d46d978302557ba6a1dd95052c8bc99fac3b1952d1f8ae2e5c2621c9cc839fc94515d534e0b3ccad149dafe1dc24670c4d7c2cd332c3ef284b7860b176
TLSH
T1D6F0EBA84908920D5AAC4426FCB8EFA705EFDB0002698E7021B335BEC98AD2801C6D0D
MD5 SHA1 SHA512 TLSH

Submit Download

zfjFPtxl.locked

Path C:\Users\Admin\Pictures\zfjFPtxl.locked
Size 24KB
SHA256 ec3969fde9afa6dbdb582596dec038e5009f30a5970f94932fdc736e547e75ca
MD5 943ac2296a22e3889bcc80122358cedc
SHA1 b2238b1defd3325ac73a7939a971e60afa071a82
SHA512 70051ba2edde9fb69dfc4f8c31a23a0d5c8a2a2c3b88f67564f16d3737e32bc26f31b6f71b306ec45c705856d88e7de88109deed67d62e0a918770623ffe2a54
SSDEEP 384:5b5g3XNcBPJYnfQI43ntrnDntb8BfqJdOWZ+kEY2XbOJbQjHwQfbIPWATL6SmEmA:0H6PmfKtrnDvGWDEY2LO5iQtPl/+u
TLSH
T194B2D11B10B61A07F5B51BCBC0CC40DAB9E6C63AEFD35F6626CA75037E426941259D0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads