44c0596db68f8883326675a31b2a07ef5db34bb01461a508721c6c01ceced07d

Analysis

max time kernel
137s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
Size 256KB
Sample260820-ph3dcszwbx
SHA256 44c0596db68f8883326675a31b2a07ef5db34bb01461a508721c6c01ceced07d
MD5 83f675ef9c33779f738fe7c41f2e681b
SHA1 5fb103f315686d82839cb5df580cb264bcfaaefd
SHA512 dd04c2dedd5c4dbc6709c20d2ac85f20a01eb2a49a30bec227c7bdc9a5f6069b73c6a76fa1b2de67293149f8da2baa6cfd1f0b29d1be138798a6eb4dd6fda448
SSDEEP 6144:+RwW8fQ7EZJRnUJN233iXDmBuQojqWN/281Lp8eaWifuajn4bVLP:+yW847EXRs+3iSuzqWNeMieaWiJj4btP
TLSH
T13D44120071D391F6E95A913BD1F68DF5F26BBE2A006C597B5F85C6B02B31206D6BC087
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note

*** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. ID : 2C170C3C HOSTNAME : WBOMRQRB IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was on my server. good luck! discord.gg/B4ds5xKfvV guns.lol/C4N0F

Signatures

Disables Task Manager via registry modification
defense_evasion

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\ufxsynopsys.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\WdFilter.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\IndirectKmd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\MTConfig.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\SerCx.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\usbaudio2.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\USBHUB3.SYS	cmd.exe
File opened for modification	C:\Windows\System32\drivers\HyperVideo.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\mshidumdf.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\appid.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\asyncmac.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\CEA.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\smbdirect.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\nsiproxy.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\storvsc.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\NfcCx.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\cng.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\tsusbflt.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\processr.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tbs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\HidLampArray.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\WdiWiFi.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\amdwps.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\rdpdr.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Microsoft.Bluetooth.Legacy.LEEnumerator.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rdpbus.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Wdf01000.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\pmem.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\iorate.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\CAD.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\volmgrx.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\fileinfo.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\serial.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\BthA2dp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\vmbus.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\p9rdr.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\acpiex.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\acpitime.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ataport.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\fs_rec.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\globmerger.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\http.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hwpolicy.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\isapnp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\sermouse.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\TsUsbFlt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\wacompen.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\fastfat.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\scfilter.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\sbp2port.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\en-US\SensorsCx.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Kerb3961Kernel.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\luafv.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\SensorsCx.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\wimmount.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\csc.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hidclass.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mspqm.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\atapi.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\MTConfig.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mouhid.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\raspppoe.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\UsbXhciCompanion.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\BthHfEnum.sys	cmd.exe

Manipulates Digital Signatures 1 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File opened for modification	C:\Windows\System32\wintrust.dll	cmd.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C4N0F.exe	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com

Drops desktop.ini file(s) 11 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Users\Admin\Documents\My Videos\desktop.ini	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Users\Admin\Documents\My Music\desktop.ini	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\desktop.ini	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
2	api.ipify.org

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Chakrathunk.dll	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\Licenses\OEM\IOTENT~2\license.rtf	cmd.exe
File opened for modification	C:\Windows\System32\tt-RU\WWAHost.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\c_28603.nls	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\chkdsk.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\IME\IMETC\IMTCLNWZ.EXE	cmd.exe
File opened for modification	C:\Windows\System32\l3codeca.acm	cmd.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.Windows.Bcd.Cmdlets\Microsoft.Windows.Bcd.Cmdlets.psd1	cmd.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\uk-UA\MSFT_WaitForAll.schema.mfl	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\eaphost.inf_amd64_229c48e6536dde4f\eaphost.inf	cmd.exe
File opened for modification	C:\Windows\System32\spp\tokens\skus\ENTERP~1\EnterpriseS-Volume-CSVLK-1-ul-phn-rtm.xrm-ms	cmd.exe
File opened for modification	C:\Windows\System32\uk-UA\windows.storage.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\difxapi.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\BasicRender.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ialpssi_i2c.inf_amd64_8e00e1aed7fbdf70\ialpssi_i2c.inf	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\NETATH~2.INF\eeprom_ar6320_3p0_NFA344A_power1213_DE_5459.bin	cmd.exe
File opened for modification	C:\Windows\System32\Dism\de-DE\ImagingProvider.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\netnwifi.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\wvmbusvideo.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\ActionCenter.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\wbem\en-US\cimdmtf.mfl	cmd.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\NetworkTransition\MSFT_NetISATAPConfiguration.types.ps1xml	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\FirewallAPI.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\hidvhf.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\fc.exe	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\pautoenr.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\wbem\en-US\ndisimplatcim.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\amsiproxy.dll	cmd.exe
File opened for modification	C:\Windows\System32\config\DEFAULT.LOG1	cmd.exe
File opened for modification	C:\Windows\System32\downlevel\api-ms-win-core-debug-l1-1-0.dll	cmd.exe
File opened for modification	C:\Windows\System32\en-US\SpaceAgent.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\msacm32.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\Windows.Data.Pdf.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\IoTAssignedAccessLockFramework.dll	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\DaOtpCredentialProvider.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DragDropExperienceDataExchangeDelegated.dll	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\ReAgentTask.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\uk-UA\PCPKsp.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\uk-UA\PeopleBand.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\Winlangdb.dll	cmd.exe
File opened for modification	C:\Windows\System32\AtBroker.exe	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\iagpio.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\Netserv.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\HalExtIntcLpioDma.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\en-US\uicom.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\msvcp140_clr0400.dll	cmd.exe
File opened for modification	C:\Windows\System32\uk-UA\SecurityHealthAgent.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\wbem\portabledevicetypes.mof	cmd.exe
File opened for modification	C:\Windows\System32\am-ET\comdlg32.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\certCredProvider.dll	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\DeviceUpdateAgent.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_b78633a7607613a0\e2xw10x64.sys	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\c_smrdisk.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\en-US\webservices.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\werui.dll	cmd.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\PcsvDevice\PcsvDevice.types.ps1xml	cmd.exe
File opened for modification	C:\Windows\System32\DafDnsSd.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\PRNMS0~2.INF\prnms015.PNF	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\PrintQueue.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\en-US\DafGip.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\btpanui.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\usermgrcli.dll	cmd.exe
File opened for modification	C:\Windows\System32\cs-CZ\WWAHost.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\wdma_usb.inf_loc	cmd.exe

Modifies termsrv.dll 1 TTPs 1 IoCs

Commonly used to allow simultaneous RDP sessions.

Remote Desktop Protocol

T1021.001

description	ioc	Process
File opened for modification	C:\Windows\System32\termsrv.dll	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ransom_note.bmp"	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACETXT.DLL	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\System\ole db\xmlrwbin.dll	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\ui-strings.js	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\InModuleScope.Tests.ps1	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sv-se\ui-strings.js	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\it-IT	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dtplugin	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ppd.xrm-ms	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\dd_arrow_small.png	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\es-ES\wmpnssui.dll.mui	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\New-Fixture.ps1	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Locales\hr.pak.DATA	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\PROGRA~2\COMMON~1\System\msadc\adcjavas.inc	cmd.exe
File opened for modification	C:\PROGRA~2\COMMON~1\System\Ole DB\msdadc.dll	cmd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\example_icons.png	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\penchs.dll	cmd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\onenote.x-none.msi.16.x-none.tree.dat	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libcompressor_plugin.dll	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\es\WindowsBase.resources.dll	cmd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\PREVIEW.GIF	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\PROGRA~1\WINDOW~1\en-US\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\ui-strings.js	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\cstm_brand_preview2x.png	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-si\ui-strings.js	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.5\System.Management.Instrumentation.dll	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\ink\fr-FR\tabskb.dll.mui	cmd.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.Primitives.dll	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ja.properties	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	cmd.exe
File opened for modification	C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.0\es\UIAutomationProvider.resources.dll	cmd.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sl_FEMININE.pak	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Sybase.xsl	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\sl.pak.DATA	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\EUROTOOL.XLAM	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ja-jp\ui-strings.js	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\de-de\ui-strings.js	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\vi_MASCULINE.pak	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Expressions.dll	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\ui-strings.js	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\main.css	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\MI21EC~1.1_N\MACHIN~1.PCK	cmd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\PlayStore_icon.svg	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\WidevineCdm	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-cn	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\ink\micaut.dll	cmd.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\vga950.fon	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\HYFB0F~1.CAT	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI0CA5~1.CAT	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI2CFF~1.CAT	cmd.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\core\js\oobe-chrome-contentview-vm.js	cmd.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\StartMenu\Assets\FileIcons\24\email.scale-100.png	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe.config	cmd.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WindowsBackup\Assets\AppList.targetsize-32.png	cmd.exe
File opened for modification	C:\Windows\Fonts\corbeli.ttf	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI4A8E~1.MUM	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI25B8~1.MUM	cmd.exe
File opened for modification	C:\Windows\diagnostics\system\IESecurity\TS_Blockpopups.ps1	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\de\DataSvcUtil.resources.dll	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-HgsClient-Core-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI928A~2.MUM	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI5AD9~1.CAT	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-SearchEngine-Client-Package-base-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat	cmd.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-black\Personalize.svg	cmd.exe
File opened for modification	C:\Windows\Fonts\Candaraz.ttf	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\InstallUtil.resources.dll	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.RegularExpressions.dll	cmd.exe
File opened for modification	C:\Windows\PolicyDefinitions\filtermanager.admx	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI7E65~1.CAT	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI4A21~1.CAT	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.tlb	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\MSBuild.resources.dll	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Management.dll	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\CO9A0C~1.CAT	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI135C~1.MUM	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MIADCB~1.CAT	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\NlsData0009.dll	cmd.exe
File opened for modification	C:\Windows\servicing\FODMET~1\metadata\DesktopTargetCompDB_FOD_th-th.xml	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\HYE161~1.CAT	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-PhotoBasic-PictureTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.26100.712.cat	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MIEC49~1.MUM	cmd.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\Formatter\htmlScriptFinder.js	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI9B59~1.MUM	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI95B2~1.MUM	cmd.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\DESKTO~1\17.js	cmd.exe
File opened for modification	C:\Windows\Globalization\Sorting\SortWindows63.nls	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\V20~1.507\es\System.xml.Resources.dll	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI7EF5~1.MUM	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI3530~1.CAT	cmd.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\vcomp140_app.dll	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI8523~1.CAT	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI1602~1.CAT	cmd.exe
File opened for modification	C:\Windows\diagnostics\system\WindowsUpdate\RS_WaaSMedic.ps1	cmd.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\images\logo.targetsize-30_contrast-black.png	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\HY421C~1.MUM	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI4297~1.MUM	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI0210~1.CAT	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\RUF679~1.CAT	cmd.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\AppxSignature.p7x	cmd.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Assets\contrast-white\GetStartedAppList.targetsize-72_altform-unplated_contrast-white.png	cmd.exe
File opened for modification	C:\Windows\diagnostics\system\Power\it-IT\RS_AdjustScreenBrightness.psd1	cmd.exe
File opened for modification	C:\Windows\INF\c_fscompression.inf	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.mof	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\System.Security.resources.dll	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.WorkflowServices.resources.dll	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.Activities.Core.Presentation.resources.dll	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-OneCore-Graphics-Required-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1000.cat	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MI9903~2.MUM	cmd.exe
File opened for modification	C:\Windows\diagnostics\scheduled\Maintenance\fr-FR\DiagPackage.dll.mui	cmd.exe
File opened for modification	C:\Windows\Media\chimes.wav	cmd.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5668	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1580	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 5668	1580	2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti.exe"
1⤵
- Creates a file in the Startup directory
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rd C:\ /s /q
  2⤵
  - Drops file in Drivers directory
  - Manipulates Digital Signatures
  - Drops file in System32 directory
  - Modifies termsrv.dll
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Executes a command shell one-liner
  PID:5668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C4N0F_launch.log

Path C:\Users\Admin\AppData\Local\Temp\C4N0F_launch.log
Size 1KB
SHA256 f5cbbededcb94d6a52cb952436d58cb380d9921f182817ee561744bfc1a67fe6
MD5 73702c8a5f0f169d584a9620e8310693
SHA1 2646034a66de9072d250e703676326a4287092fd
SHA512 66a687db7dfe8214214eef6da4352e10f97716a2227981ac4a0491da0144ba9b93cbb158a0bcfbe1e1c88aacee4d5449769e02dc6819a7d038ce572b977403b5
TLSH
T12D2167C31E29E46C5A416131142E76B9CA7003684EE1DBF542F3011DA6677CCAA2AFB5
MD5 SHA1 SHA512 TLSH

Submit Download

C4N0F_~1.LOG

Path C:\Users\Admin\AppData\Local\Temp\C4N0F_~1.LOG
Size 1KB
SHA256 740a92fb25970ab63b7906bb9699cfb584f507eea97b30fab05b196bd23153af
MD5 5159e5489f92e9e5ba5be419c285d6ac
SHA1 259bf711878616b15f86ff58906c47e76e9976b9
SHA512 04878824a093eabe16d843ef05e8400b0bae420cf50da65a5203934705a65190eb0243e202f9e4c06a7a8e896994dcee08be8b011660ea2f06af1dc04d10164f
TLSH
T1E731ACC31E29A46D5E416131142F76B9CEB003584FE1EAF542F3011DA656BCCAA2EFB6
MD5 SHA1 SHA512 TLSH

Submit Download

RANSOM~1.BMP

Path C:\Users\Admin\AppData\Local\Temp\RANSOM~1.BMP
Size 5.9MB
SHA256 1cab03d220a0eb77308d8bf486454b1c89ee93542c37deb6a7e1c69e61bd0fbf
MD5 72017001276af9b001dd03561dac2abe
SHA1 13b70eba95ae9a0b83a8421a0b9ea368e2c5e18e
SHA512 82f5ddbad244a2988d254e3f5a088d21607177ca3066fc3ea5ebd611b7430c2269f33b3cc36f34e0f3ece68ad679a4664b814d435ac0f2fc46b78710d8d5042b
SSDEEP 192:lxXJlUs9qonn1uRYfFlicOV31Z3XGgch6YQR9wMZ+/InHUBSzbyOSbZ3a92BZRPO:a61HGWrsH7GVm30hJKJeNuR12pjDy
TLSH
T1AE56D7783B5D2DF5FB8CD03060E25551CBB146FBA8A021D0AB6E83F9D6C21885F689F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectCheckpoint.locked

Path C:\Users\Admin\Desktop\ConnectCheckpoint.locked
Size 9KB
SHA256 239e292c4b29c91f9a9c277ea80d15c0cc97dad447683948fa5f1d4b10355a0f
MD5 3d802a7a31281b14bbdb6f48b5971606
SHA1 8e1e3e7189ef40ddfc564e500936cafca3a96c82
SHA512 2b93f917a4332929a4f909247d779d5a6fd55647fd478303359da5043507fc98dbf151e61fbece265c56f5591d18b1fdc84117e5bc14b11563997821b2340e2d
SSDEEP 192:UlI3AFlLpOWE0auUv7+4De2QX9QXbcjGmoGsu+xOSjecD9GMN2D:UWQFlIz0aZbe2e9ibcjuGAOanoMN8
TLSH
T1A812CFEA41232A5B914187029C3CD422ABEEDF11A7AB5C78C53539DDCB71A0DEE5B023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DECRYPT_INSTRUCTIONS.txt

Path C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt
Size 605B
SHA256 fe4917eeb908164b0edf5eee51ed0fe58ac47919c39e9469a103eeb2a9db9f57
MD5 320178e5ac13523079b9f418752b5c5b
SHA1 aa73124a0a827ea6eb9b175eb73511d4cef14d72
SHA512 f7cbe7f8034cac71bf9abe08edfc0b6c8f8b45aa6f3b7d0626ea1f5bff6fc53df87729a3b6ebbff4dc14382eb5939894d8f2fb5e4d6edaba05ee8a6b62a5679b
TLSH
T196F0DD7FB407900206A324827A19BA63F3514289012E22022C1DD46C207D64AA6D348D
MD5 SHA1 SHA512 TLSH

Submit Download

EditProtect.locked

Path C:\Users\Admin\Desktop\EditProtect.locked
Size 9KB
SHA256 0cd05555faf597f6f6672aade9dc3149559ab383293b3804e91249e4195c5eec
MD5 2f287565157f560e70ee498ee5849b5b
SHA1 fed6d5db41dc1bf7669b71ff5c5d667032d4e57d
SHA512 e65049dfff6979486954347360ddb48e82aa654967b2c250564747c04e572f0a4d77b33357e7bb23f83cdae7ea536cd3a2714b38086e2a6f6ffade02c3ab1c71
SSDEEP 192:UlI3AFlLpW7fxuYAIaREijjcqFVu2baNFmVnyBumR/VES06PFnQEVL:UWQFlGn7aRxjpM2baady9JVn06Pp3VL
TLSH
T11022CEFBC22F41D70252DB8614A6498339E5D8010E30B3368F326A8DB776142AAEFD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchAssert.locked

Path C:\Users\Admin\Desktop\SwitchAssert.locked
Size 825KB
SHA256 90dfe28e7a6eecdfcaf4f1b1e49594b65fd0ab96cdde592179f79f97d3a58d75
MD5 6c6037bd9841eafc5f2b74f78d3e8e12
SHA1 cfcc28fa31ad3aaf60750c769cc822cb2e57e230
SHA512 2148967885ea4bb444b7d90f7375fa0087dbebc7877a122ca6acc45843143dccd1a3d9da1dabf6f140f14aeb8714ae02c9b21446f6a33bae2bb0322910c7dc3f
SSDEEP 24576:MooPfbwLByL/5tC/EKlVD2h6yy3anLike532bd7BEZO5:zoPfaByLLC/EIq4anLpeVaBEZO5
TLSH
T19805331A8EA8AF24F6C93B9447A1FE7F638954496E717C6F531013A1C2330E925E4FD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnlockUse.locked

Path C:\Users\Admin\Desktop\UnlockUse.locked
Size 793KB
SHA256 3d9ee78d2cb2343b05e451e2ae44b3d7629f5fc8365244a3822465bbf6cba76b
MD5 e91420c79163276bf3fa0980758cba90
SHA1 b9f8b70a0941ae2fb2f5d7882e1bb58fe29e659d
SHA512 651c8a3628e9e7018d1d4024bd7e9d9d0a3e4a12a3605bbddc259c53aa9e95822501d2187ed9a237c6800767b5f6320994a155de0b6e5c9d621c5ae993b19013
SSDEEP 24576:VZQHta38y2d5a97NSOBPUfNOTDuraR2xo2f9GsMFl+:vKkITaJZVaOTqra4G2VRJ
TLSH
T1030533379C8890B2245FA01FB559A429AE1DF8B52CE791510C389437870763DBEB7FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.locked

Path C:\Users\Admin\Desktop\desktop.locked
Size 346B
SHA256 a499aac43fbfb28cd7a08c9387d89b7dbb151095522943f412539f86a05a69c2
MD5 779ba0d4bdb574b83e454441788cc254
SHA1 61c086a5e90151b3bfa8ef0ac3b8bd32f256c987
SHA512 f4c88d5c816b0b38209abe99aea634ca04701ed7651ecb120e5416d006dc529b55a22241210a54bb692d431e93e1ed39193286597293aa759a5f4050fa6845fe
TLSH
T137E0C075CFC44288DE0D0106FCB4AB6C00F60B5842084DB290B6B8B9C9A7D5D0640201
MD5 SHA1 SHA512 TLSH

Submit Download

DisableUnprotect.locked

Path C:\Users\Admin\Documents\DisableUnprotect.locked
Size 11KB
SHA256 f219e0d5defba244efa536924370928285a21f8b970a95ab11261fb02933a595
MD5 c9be74f8f869205a3904e88cc18e73b2
SHA1 3e829eba0ffb40d972a17607f43480acbfb097bf
SHA512 72336fdad616e5e4089224f504c57bda4bcf0e402735461fc130f509552d2788e26a11633fd16095f3b850eef4085479016e40e6f15bdcea0d2ae1801a6be1a8
SSDEEP 192:UlI3AFlLpa8aFpuCwJY49I7wb50JA2MeQt0SJZVWCNfsHuKZuxT+Y9NtnTb/1CTx:UWQFlk84m9IkbOJA9Tv8juKlK/TL1CTx
TLSH
T11832CFE989B220088C69DFFDD2FB129520F8D15345B8AF41B7D50D5FFB0950A702F2A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinUndo.locked

Path C:\Users\Admin\Documents\JoinUndo.locked
Size 1.2MB
SHA256 fe677a9ec3a7254822039402eb1514ee5aef73db40fd1c338116b912c28fafa5
MD5 b3f9aa0cb3377ba7cb431155af3fa241
SHA1 5987767a179e7f0df0d53d891582bb8c7dfcfc5e
SHA512 733a6943566c48be65da64d8c10d47ec2491de1a19f0acd833cc91c63b22810cf9b732b4bd5c8cb7fd5e528848967f34aa8bd33554c218651ccb9c265d9d5413
SSDEEP 24576:KGj8W6bs1Z9bYc/vbWZMrOyHKgy0nZhphgINC6kMLu0vEe/Oq:Kp/sr9LbWCr9KgFLO6kMLx
TLSH
T18E453322A3D6EB8BE57BB698541E100694291AF0B52DF5D424C6036E4DAFF17FF03C4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NewMeasure.locked

Path C:\Users\Admin\Documents\NewMeasure.locked
Size 835KB
SHA256 4798f3ab662a396247882b690e84023ba1e36231333b5a6490aa9810f84a5b7f
MD5 e91210e70c83aebee1c206b3d5c2f3e8
SHA1 79334f3fa98906a893b72a922af68d84a3537436
SHA512 2a238545e7750d1f6a79bd1c9586197108b4b7e63121737d606b383deffedecccf6192f5d62a56e4b872a7d784d120c34878443d7c89f944f4876757e0acb30a
SSDEEP 24576:40j2BUxHk4W839+8aD1p3L8DemQENlVfVbCPwMkjb:rj2BUp7pt3aD3b8DmE1fUG/
TLSH
T1CE0523B4D3BD601B2447B5D630916BF10AAC18B4FCF5E362345A386946B4B8769FCA34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Outlook Data File - ialofdhpvj.locked

Path C:\Users\Admin\Documents\Outlook Files\Outlook Data File - ialofdhpvj.locked
Size 265KB
SHA256 9165e15f2a4bae040acde235e8a9b523bdeff3503b2fda4460d915983ca63416
MD5 7ced96a8a8e0f0260cc6961bc19edd11
SHA1 85e6976762a5d5fd267532816e5bc27f4df48344
SHA512 6ecd79dd756b00ed2ebeddc98f77cec27d2d78c3f994e8fc6cca8bbbfdb014c86c259c84fd9c2f7dcb111d91a04b8730b53529094ec4372eda85bd19be6c1a84
SSDEEP 6144:IyDVf8cloQuoufte/umgOPgkJ56RoqcJl9XrKMHLp:IyJ8cloQuoy0vgQgXRoq8llKMHV
TLSH
T10A4423175D027976B353DE80127F87D33FA913BC14D0E9A5D36C8FACA9811071A7AE8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResolveUnregister.locked

Path C:\Users\Admin\Documents\ResolveUnregister.locked
Size 12KB
SHA256 03a8087a19c4c81a4ed9dd38eba82a47054c7834ffc2465f3dfb27b52fd2c291
MD5 797d18b4af5d50ab5932f2c1f8d5faec
SHA1 3f0f3fcf557a68606356e5a6a44dc34aecb49dd1
SHA512 186b99de40c75dafac8bdce6596fddca266b73f712659358de62de966d8cd8b5f368720e8535aa7abc0f609100ea6a78ae4ce1fc12da60a4b182910d21693fdb
SSDEEP 384:UWQFloxsta/Io5FXZPty0SwJ3eofCCOi5:UdL4jtvS1MCCf5
TLSH
T1ED42BFA14E8528D91501C60C9C98AFF368B7F020074D63326ABC47EDE3F5964EB1B4DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SkipFind.locked

Path C:\Users\Admin\Documents\SkipFind.locked
Size 14KB
SHA256 1d4479bc754cfb295e80118cae481fd97275146c9c46de943463df606a041bef
MD5 482986ba651d57f79e538e4b1cbf874b
SHA1 3afa487535fcac27b956a0ad1186d1d863437c61
SHA512 0165a133e78bdb52e18d552fc82309f8cb675db8d86947458dfee619bed77579c828f932ba13ce0a5facd4afb418731bc729c124e91d744d1e21f18cc34e9fca
SSDEEP 384:UWQFlFk1lhOePj2DB1kcB+mi7NYG8RacMmXkv:UdLKRjThmi7NYG8Racq
TLSH
T10952CFEC97C4AC340E0E94282F5C763A66AFEF50A2456A311F01281D85D77343A965E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WatchReceive.locked

Path C:\Users\Admin\Documents\WatchReceive.locked
Size 619KB
SHA256 bc8b949070328085f0b21e3ce0e95f8053fdca7c57e74b39c0eaae285d8fb2e8
MD5 6e3dfb2438fd7f65127cf09e1996827b
SHA1 0df1af3242c08f72e93fc3d1e270ec4753a3b00a
SHA512 d8df048e83b069ed4dcd8b86028db64849cb14a29ba61eacbeced60ce2cc47c8842c7eb34de577cae381889bcac271a5823b863db088f21186116b03109ac7da
SSDEEP 12288:ofWQBezKRrZRL7+yRI6dKwUO6StL3MybKmWlTxwBPuc+uc1vXTEUDdEWLVRkqB:oR6aL7+mUpy3MybKJ9yB2crc1rEUxRLb
TLSH
T159D423B1C662BB14B45870703AA322AAE684C6B2C371F1106734F9787CFA71125F76DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.locked

Path C:\Users\Admin\Documents\desktop.locked
Size 466B
SHA256 39fed699e16b273f913293da352810d0218e32515aedf51d04acb0892352c66b
MD5 02fe65f7e1c15be18bd84372512ab090
SHA1 8e3a8c078ed595b8b49b6f10c0426ab83704908d
SHA512 641a3d9005bd14b2a3a4bf080afc3a6d151a4447e604dad9d1a0cf8fb8b321c195acbf115174cd58502c6c464b827c32e9a2f494201be7d114172ab76e51b526
TLSH
T11CF0547CCF80428C9D2D3403FD74BAAC00A64B0C41544DF1067678AB655B92E0200343
MD5 SHA1 SHA512 TLSH

Submit Download

FpxHdcLwDS.locked

Path C:\Users\Admin\Pictures\FpxHdcLwDS.locked
Size 24KB
SHA256 ce5af3c80f42ffce8d436bde9fa1c7a3784c09d09c7c8c09b44fadfe104dc915
MD5 c8a195cad2cf4723d721abc940833fd2
SHA1 5b641d1157ad630afeb15f5d2822b4e157b872a7
SHA512 e4d5dce088851bd1bdce11057fd9bcb0b966de3a1bf26744e49f26998a5242cd96ada3de5f48a6db7c230bcf931b0563c47b71128ec44da57076b1d2d8731368
SSDEEP 384:5b5g3XNcBPJYnfQI43ntrnDntb8BfqJdOWZ+kEY2XbOJbQjHwQfbIPWATL6SmEma:0H6PmfKtrnDvGWDEY2LO5iQtPl/+pK
TLSH
T1C9B2E11B10B71A17F4B12BCBC0CC40DAB9E6C63AEFD35F6726DA75033E526A41259D0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InitializeMerge.locked

Path C:\Users\Admin\Pictures\InitializeMerge.locked
Size 884KB
SHA256 b7ed35f1c4374021f2261b01b89945c725f0c4fed03b696c000b537a9fe50b90
MD5 6cbf291de7f1a44d19f1b9a1d0fbc709
SHA1 53726b0bce1597912ba23ebdb7b370ddc25e8507
SHA512 c534cd5669a03198ac39d357d94bcbba99929b368303df009f05f888bcf39c2378105116270ec167e2ececad9fd0aaf635a93a4d65781cec096ed35efd37373f
SSDEEP 24576:3C/qtAeAOzZC8xR9ktoUvQS9SO1YmI6N7LEi:zuRQCIRmvQODkQn3
TLSH
T198153395391018478233CC913DF1AEBCD190748FBE95317CFA7B47E39A6A9A5230D7A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PushResume.locked

Path C:\Users\Admin\Pictures\PushResume.locked
Size 612KB
SHA256 ee68c0b30a87337f12efb7b4dbd055aa0f09d46a1a2fc78cc7a527652a5abd62
MD5 27a424a55659e621b09dcb13c520f75a
SHA1 98debf485bca582688c9deb1eba72c7019fdf0a0
SHA512 214d01b42b07395ff9684d1fba1e8dade374df5f63a7db5b1076bb28a19c573890d5caf8c9ebc5eda0783f5558ab214e813c2b29f5ea801f9839fa804d70bb35
SSDEEP 12288:lOsSnIs7vGtwWv8uNGcCdpd0rEDioGQopUarLU6hHs7UzJTsyzZfyhH:ldmGekCJOYDLGQo7HSIDzZ6hH
TLSH
T1EDD423ED50F1B816B33CC9FF1FF4FDB6A252124760AC18AE0158156910A56E2BF365E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchRegister.locked

Path C:\Users\Admin\Pictures\SwitchRegister.locked
Size 1.2MB
SHA256 032378f816a8e9dbfa02c3565ad675b992dd8424174cf768e814766fccec5e7e
MD5 16aa9555234af8a108f0765f04d7fbab
SHA1 33593e79390c5755e45c7f07283502c2e86f2f2b
SHA512 a932e85e7954d8204379f66a2967e4fbc0eaff7fff8f1fe8f67ac60ce4a99fcc11abb701b465bf0b0056b90fc39826d19d643d379d9018ab4286b7fd3e26ac71
SSDEEP 24576:XEPWBtYIvhWMHPl72Z7hnqMoIAeAO0IrWF5C65NAH/v2N3t0dG28rimP+PQ:XE+IKSx9oItAO1rWF5vSHn2N2jho
TLSH
T14B45331FD215665D1DA3A04041563BD2AF0DCB6AB6272A27CF30EACB1FAB2344D9CD35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.locked

Path C:\Users\Admin\Pictures\desktop.locked
Size 568B
SHA256 3d0e92f1fabd5eeb0283d5c79ac09ade32bae553d3826752dd2459ce0e92c393
MD5 98292d8267b9fbb36fea67357a8d6b0a
SHA1 8edb06825cc501438caa00743727fd753be680c8
SHA512 f60555d46d978302557ba6a1dd95052c8bc99fac3b1952d1f8ae2e5c2621c9cc839fc94515d534e0b3ccad149dafe1dc24670c4d7c2cd332c3ef284b7860b176
TLSH
T1D6F0EBA84908920D5AAC4426FCB8EFA705EFDB0002698E7021B335BEC98AD2801C6D0D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1580-15-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/1580-18-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/1580-8-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/1580-95-0x00007FF7D5610000-0x00007FF7D561E000-memory.dmp

Download

memory/1580-10-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/1580-11-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/1580-12-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/1580-14-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/1580-0-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/1580-17-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/1580-9-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/1580-19-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/1580-94-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/1580-22-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/1580-13-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/1580-26-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/1580-7-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/1580-16-0x0000000140000000-0x0000000140061000-memory.dmp

Download

memory/1580-166-0x00007FF7D5610000-0x00007FF7D561E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads