conti | d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
Size 322KB
Sample260905-halbjsyckf
SHA256 d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc
MD5 9152cb45994adab4dc27c33ee72a66e1
SHA1 ab0c3361bf3ab8b7c40883b2d3107aa7f1d7428b
SHA512 72476572d55860c7655a846ab8a7d32fa4c5ac08d4eb68a75a8a9733a243998dc5835e2014fbb823615f2e8f16d82d7252812098294a8d823ecd981a5490d681
SSDEEP 6144:kbIcqOrL3sxz5nq0d2Uyr7COWDzO2beJf/kCeg4ZRD:5cqOHEVnqnUy/COWDzneJW
TLSH
T118649D30BA90C036E0B71DF445B6C3B8692B7DB2972451CBE2D42BEA56346E5DC31B87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery execution conti persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Path

C:\ProgramData\readme.txt

conti

Ransom Note

All of your files are currently encrypted by CONTI ransomware. If you try to use any additional recovery software - the files might be damaged or lost. To make sure that we REALLY CAN recover data - we offer you to decrypt samples. You can contact us for further instructions through: Our website TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.top YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded your data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us ASAP. ---BEGIN ID--- LBCiop0VqOZuBBpA5nE826srUH9zTB8NeLk9dWX69K4nuopOjult1Wz9EY5DwmXn ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.top

Signatures

Family: Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
ransomware conti
Renames multiple (9209) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 31 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Public\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\readme.txt	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\am.pak	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\en-GB.pak.DATA	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main-selector.css	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-sl\readme.txt	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\PlayStore_icon.svg	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\BA949A2F-231F-4842-9726-ECBF6B94739A\readme.txt	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.LEX	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\bg_patterns_header.png	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\pl.pak	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\[email protected]	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\zh-TW.pak	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\acrobat_parcel_generic_32.svg	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ul-oob.xrm-ms	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ul-oob.xrm-ms	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ul-oob.xrm-ms	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\OWSHLP10.CHM	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\readme.txt	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\readme.txt	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pl-pl\readme.txt	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File created	C:\Program Files (x86)\Common Files\System\msadc\en-US\readme.txt	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.JP.XML	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\BLUEPRNT.ELM	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\ml.pak	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CONVERT\1033\OLAPPTR.FAE	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\kk.pak.DATA	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\LEVEL.INF	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\THMBNAIL.PNG	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_checkbox_partialselected-default_18.svg	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\SpreadsheetCompare_k_col.hxk	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-pl.xrm-ms	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\css\readme.txt	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Info2x.png	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\ui-strings.js	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\readme.txt	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\added.txt	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\readme.txt	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\AUTHORS.txt	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-pl.xrm-ms	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\THMBNAIL.PNG	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\selection-actions2x.png	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pt-br\readme.txt	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview2x.png	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCHART.CHM	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\x.cur	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\readme.txt	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN020.XML	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hu\readme.txt	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fil_NEUTER.pak	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner.gif	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ro-ro\ui-strings.js	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2980	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4108	4304	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
4896	EXCEL.EXE
1476	EXCEL.EXE
2468	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeBackupPrivilege	728	vssvc.exe
Token: SeRestorePrivilege	728	vssvc.exe
Token: SeAuditPrivilege	728	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4364	WMIC.exe
Token: SeSecurityPrivilege	4364	WMIC.exe
Token: SeTakeOwnershipPrivilege	4364	WMIC.exe
Token: SeLoadDriverPrivilege	4364	WMIC.exe
Token: SeSystemProfilePrivilege	4364	WMIC.exe
Token: SeSystemtimePrivilege	4364	WMIC.exe
Token: SeProfSingleProcessPrivilege	4364	WMIC.exe
Token: SeIncBasePriorityPrivilege	4364	WMIC.exe
Token: SeCreatePagefilePrivilege	4364	WMIC.exe
Token: SeBackupPrivilege	4364	WMIC.exe
Token: SeRestorePrivilege	4364	WMIC.exe
Token: SeShutdownPrivilege	4364	WMIC.exe
Token: SeDebugPrivilege	4364	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4364	WMIC.exe
Token: SeRemoteShutdownPrivilege	4364	WMIC.exe
Token: SeUndockPrivilege	4364	WMIC.exe
Token: SeManageVolumePrivilege	4364	WMIC.exe
Token: 33	4364	WMIC.exe
Token: 34	4364	WMIC.exe
Token: 35	4364	WMIC.exe
Token: 36	4364	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4364	WMIC.exe
Token: SeSecurityPrivilege	4364	WMIC.exe
Token: SeTakeOwnershipPrivilege	4364	WMIC.exe
Token: SeLoadDriverPrivilege	4364	WMIC.exe
Token: SeSystemProfilePrivilege	4364	WMIC.exe
Token: SeSystemtimePrivilege	4364	WMIC.exe
Token: SeProfSingleProcessPrivilege	4364	WMIC.exe
Token: SeIncBasePriorityPrivilege	4364	WMIC.exe
Token: SeCreatePagefilePrivilege	4364	WMIC.exe
Token: SeBackupPrivilege	4364	WMIC.exe
Token: SeRestorePrivilege	4364	WMIC.exe
Token: SeShutdownPrivilege	4364	WMIC.exe
Token: SeDebugPrivilege	4364	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4364	WMIC.exe
Token: SeRemoteShutdownPrivilege	4364	WMIC.exe
Token: SeUndockPrivilege	4364	WMIC.exe
Token: SeManageVolumePrivilege	4364	WMIC.exe
Token: 33	4364	WMIC.exe
Token: 34	4364	WMIC.exe
Token: 35	4364	WMIC.exe
Token: 36	4364	WMIC.exe

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
4896	EXCEL.EXE
4896	EXCEL.EXE
4896	EXCEL.EXE
4896	EXCEL.EXE
4896	EXCEL.EXE
4896	EXCEL.EXE
4896	EXCEL.EXE
4896	EXCEL.EXE
4896	EXCEL.EXE
4896	EXCEL.EXE
4896	EXCEL.EXE
4896	EXCEL.EXE
1476	EXCEL.EXE
1476	EXCEL.EXE
1476	EXCEL.EXE
1476	EXCEL.EXE
1476	EXCEL.EXE
1476	EXCEL.EXE
1476	EXCEL.EXE
1476	EXCEL.EXE
1476	EXCEL.EXE
2468	EXCEL.EXE
2468	EXCEL.EXE
2468	EXCEL.EXE
2468	EXCEL.EXE
2468	EXCEL.EXE
2468	EXCEL.EXE
2468	EXCEL.EXE
2468	EXCEL.EXE
2468	EXCEL.EXE
2468	EXCEL.EXE
2468	EXCEL.EXE
2468	EXCEL.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 2980	4304	d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe	90
PID 2980 wrote to memory of 4364	2980	cmd.exe	92

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe
"C:\Users\Admin\AppData\Local\Temp\d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc.exe"
1⤵
- Creates a file in the Startup directory
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0C36772D-FED4-44D6-BB3B-DFAC9C8AF0EC}'" delete
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0C36772D-FED4-44D6-BB3B-DFAC9C8AF0EC}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 2052
  2⤵
  - Program crash
  PID:4108

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\RemoveGet.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4896

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:728

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "C:\Users\Admin\Desktop\WriteDebug.xltx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1476

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\RemoveGet.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4304 -ip 4304
1⤵
PID:1800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

readme.txt

Path C:\ProgramData\readme.txt
Size 856B
SHA256 d0c542fe6e09f423e149632946be5a4ed683a0d48aa7d04288996bef70114d15
MD5 d693e0fbc9bec1c2753b7aa7a6ef1b4f
SHA1 af902a3fd660548dcf725fce7a2aa6edaeb956a2
SHA512 389fb895ac58e7fa4f6754f23a7d2c34556f95ff71ef5267998032f03278b655c2501b2bc82f9a1928c4e0366d3d1605ca8e3d254a0d136b228e0518238f331c
TLSH
T1B711125F325CD155D8C0B8E3334BF22AF3A394AAF5B19100A8E9159433667E4962B1AB
MD5 SHA1 SHA512 TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
Size 1KB
SHA256 ddec95efaa75c8dcbac35a44df1f95f44ca70f40bc9640986595f7bd72c97995
MD5 5439fd300a53ff3529a77080453770f2
SHA1 fe6e738a8331c6e10ed443e8f427f373614cb684
SHA512 ead78b382c9599c2dd60386119ed0e3e5445a7e63f19731cb14b869a3b9ebfd06e60df8fccf519441e223761e49549f24d75e2d21fbd6355c783185f60a3e90c
TLSH
T1C9312B13423865817C84F848B1DDCD133CB5B6C1BCD8481B590D71242F3A7DBBB5550C
MD5 SHA1 SHA512 TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92
Size 2KB
SHA256 a93b58ae24b44ad10c455d6aa3faf300e21dd97b08adf2f4f43ad2c0547f8b98
MD5 9fef2eda0d41bce3684e60893e35fcad
SHA1 b8e80ae07da8062a83cf3d85e7c2115590115901
SHA512 8a83927ac262bafa0da99d674a502e704a609b16cba11a48bfdfcc2c06646b1d5638a0e310d8ec3aae96b62b9366edc0a3b66579aa657197d290822bc3c3ec1f
TLSH
T1B9414C75F79F0487E42902BB05E2E213E2F5132ECC7CB4D7B5A1107261B3A64B1D7221
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 471B
SHA256 9afa67d5856d03b7425667ad59a4ed6454cd3fa4479e1c205b556b0c6b7ac929
MD5 affc1a17f68dafcbf587a5ccba4ef4a0
SHA1 7c03064a906fad6b6ad82e3d2bdfa82d69abd853
SHA512 6a1e2fc0355d7c051c5383bee3be494b19e88808245efe70562ddd27a6044b07a395ad2181342e39eb3bb56dcdd1b7489acb3211b887b7dae182e8c675c115fb
TLSH
T124F0D41744ECDC517E5B45DC33E8673A2C50116A10B81705607544D6161A77FF30603E
MD5 SHA1 SHA512 TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
Size 426B
SHA256 e8e766dbca4060a362c423deae7c816dc620dce661f8f8325046d8f736e944b6
MD5 444034ae1cef2223c8486acce6a3294a
SHA1 dae0d69c50d63745f0fb0f229e6200cb779ece27
SHA512 a320dfed8536a81574d333506925c60714021152b0add02d7c4a9eb7eba303957193343710ca58abe21e722d75470d8a2d107e4c4c47dbacbf77f5a200f7e211
TLSH
T19DE0D8543AFD502DE3766E7C0BE95A7E6B2EF22318046A79576442181745D900D21733
MD5 SHA1 SHA512 TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92
Size 422B
SHA256 75aa354a55b63620c0aaa7a7aa52d18136e4061ae91ddadb730fec57a9dc9537
MD5 e207a7c4c21854803a26f385b10705a4
SHA1 cfa282d65bb37b7771ba45852a255ac8d2027527
SHA512 87d8193f1bc84cc0c386c4f74304da9b7bfd506547943d252fce7dae8b1d2633ab4a4c12a9865c4c06edbf4b7007bda752e78158978a3a088082bb80f21419e0
TLSH
T1EBE068603AFD4028E2356E7C07D85B2EAB2EF2630404AA752320030C1515E800E25B32
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 412B
SHA256 dfae489edbbd935e3bd4523c65fc7009be1f1e748fe009b480b35d884711d42f
MD5 c5c7209f8d97a94a34755361fa8dd5c2
SHA1 c0d6b05573c53b6c123c952c2a91b0c393fc27d3
SHA512 fde983f82bde6547cf374c85c10fbd0461ebbdd7151fe2486d64ed56944e0295c9edbbe1213462b6d0734206828b441467643fade39d4bc16627622ccb8087d6
TLSH
T15DE0C02025F7411DF1F5DB3807E579209596F1561865A2B11FD01704660AA00DC12D30
MD5 SHA1 SHA512 TLSH

Submit Download

Excel.CampaignStates.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.CampaignStates.json
Size 555B
SHA256 c3ae5c30cb585ea0c3c2652abbd5f689e4b81fe6c92dfdcdbfd0f073ddd28193
MD5 d38502f5d7dc634a1076184d97f8aebf
SHA1 6c39eca1b2e87b8aa9fd65f518a3c0d9fcc20da4
SHA512 c26ede455d26357fa5e658ffad0acdf46223f5e6d5d2a58d3bc08cf676156c7552b2a203638c80696d6fff97b9e4cf95146c2b414007cf68f9d2dce52b34759b
TLSH
T15BF0E10299734643D9039871B4B0284E9DD61D35271649687CBC83A153DA92C1830861
MD5 SHA1 SHA512 TLSH

Submit Download

Excel.CampaignStates.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.CampaignStates.json
Size 21B
SHA256 138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c
MD5 f1b59332b953b3c99b3c95a44249c0d2
SHA1 1b16a2ca32bf8481e18ff8b7365229b598908991
SHA512 3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4
MD5 SHA1 SHA512

Submit Download

Excel.GovernedChannelStates.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.GovernedChannelStates.json
Size 417B
SHA256 200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c
MD5 c56ff60fbd601e84edd5a0ff1010d584
SHA1 342abb130dabeacde1d8ced806d67a3aef00a749
SHA512 acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e
TLSH
T1B1E03758D5B8D45DE94325026BB173960D329691F9DAE03C2D3DC00EB5DC2BF4A1C20F
MD5 SHA1 SHA512 TLSH

Submit Download

Excel.Settings.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.Settings.json
Size 621B
SHA256 55af798232c10900194bae00e4b659eb306e82d779a394730da7d5d723a1400d
MD5 d2a065a7fb2855783850303455eb541a
SHA1 afb5c029cf21d24c1490ce709add767758241dc6
SHA512 220e15a89992195dcd424557b7310ec1963f98e452ee6e2232f870f7947babf4d626d94b4be60c78777984d9bc89f10c266f31898b357d6579a3e5b2116bd347
TLSH
T128F0DD84EB95A7F0E20E233A8AC405F75E9695B0E36836AF295041A0C06A2119C9192F
MD5 SHA1 SHA512 TLSH

Submit Download

Excel.Settings.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.Settings.json
Size 87B
SHA256 6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31
MD5 e4e83f8123e9740b8aa3c3dfa77c1c04
SHA1 5281eae96efde7b0e16a1d977f005f0d3bd7aad0
SHA512 bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9
TLSH
T10FB01206089401BD405D500084445A5B035470510144241853046206107E9E20368C33
MD5 SHA1 SHA512 TLSH

Submit Download

Excel.SurveyEventActivityStats.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.SurveyEventActivityStats.json
Size 548B
SHA256 1da9fb55a481f0fb122b83134d43447bdefebdff54fc0ce5a568fb4855027f2c
MD5 9e1f460d2c81aefd118592ac5468a3a6
SHA1 1bae0a93825956aef35e6ded16b618f73291414a
SHA512 f4fa556ac0a82246325e1fd1488fb8965aca4c792df119fa1cb1f9455a5ef089cbea49aab2ff5de4cbc16a1f3a126321ff44418a46c64467e73ae28d6936f967
TLSH
T15FF0C05E1A425181EB03C97D8391AB281E4565B802A23ADF02EACA36356B759BCE16C0
MD5 SHA1 SHA512 TLSH

Submit Download

Excel.SurveyHistoryStats.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.SurveyHistoryStats.json
Size 548B
SHA256 b856bfc0c17debdccde86d519a20d8bdb3cdcec63b4aec465fe7b081db387a59
MD5 f69a77977f8c408d2b2757ecf52c9187
SHA1 3b834be238d00497ce4f79cfce52e75ce46e9a89
SHA512 90d3e0ed5526dbe73f4e6dda29fb2397b1173acabd2931f83b13283b07c11a859e69e29089bfd42c5e37c998f728f6068edee9a9e2e89ba4b5849ac3a598b6ca
TLSH
T10BF020062F0BF2AAD394BE3228367973E3A004C22298A18D7F8660A049401362ECA121
MD5 SHA1 SHA512 TLSH

Submit Download

Excel.SurveyHistoryStats.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.SurveyHistoryStats.json
Size 14B
SHA256 88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3
MD5 6ca4960355e4951c72aa5f6364e459d5
SHA1 2fd90b4ec32804dff7a41b6e63c8b0a40b592113
SHA512 8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d
MD5 SHA1 SHA512

Submit Download

9877662E-B1B0-4995-B504-B88F83DAB3D1

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\9877662E-B1B0-4995-B504-B88F83DAB3D1
Size 192KB
SHA256 64ea31ecd0f5c9866f6abc21cb9ab26e59219c1fa8b16b6f78cca0a1102e5929
MD5 443bd32f3636a64b8cc6329526cd4595
SHA1 7a33be2a8e2deeb12d873193e29a18e060ee8e29
SHA512 2226e47a03f3447eb3f07fbdb24a0bb9f2238dffb5f9df45426da14a6f053eaeb1600ab85b9a318d46b41d15b34b0fbf2b5b185eba3bace0159c96240c740018
SSDEEP 1536:xrVe3b3yFK6ZbMxsghEa8e7HWsDXjj/mL9cAZl1p5ihs7VXXBEKD0aO7qamZdGVm:Gke7HWsDXjj/0X257cV
TLSH
T1641412A6B2C75C628B33049D5B57A094FE6E12A708D5202873FAF3578FF2E1CB547291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

excel.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Size 1.4MB
SHA256 7ce0d3bb953e59ded3b5e9233fb5958f7acd68f4a7551462a68ed1b223ac6f9d
MD5 9790a9414f9a8f7b93cfdabd6777bd19
SHA1 64bcc90ca0dc9cf4444e193792099c27c604955e
SHA512 bdd3164aed44fb66c9fe9f02f4cd09b6f1c02ff9d7f86df880ff01b824bccf685f1378847b5d3deb4676e9f70f234bfcee6f9915a6f585c3492c7aa6aa13de09
SSDEEP 6144:LqfYEGBv9vrPoc6fm50eki2bkILZLlSq1E38OBZ:JB1vLoc6fm50eki2bkILZLlSq1E38On
TLSH
T1A565DF84E0D365136B39E61193A29EEEEFB541A39AC46140305D27BB9F37CC90D4BA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mip_sdk.miplog

Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
Size 15KB
SHA256 fca8662113a9dfe5bf5ff5ca0e4b100727e4f91836280ad354e45d01f5bab22f
MD5 f10067e2361845a70dc77591b5116be0
SHA1 396c9d9ae094394549265433aaa0004672b3ceea
SHA512 7f8deeb5f0e20670b875897c1696f27f179f3cf85403205bf3e47bb2400ba80eb3aa0da6b0b2ef1e4170102324d4330f600cc18ba3f162f58a348498e54f3c63
SSDEEP 384:Dejm90SphLINnQcTqD3KhC+IZ5v8rbRrn+3Z3vzJvWbwlo3ZfiD:SS90SphL80D6hC5v8r1r+3BvzJebG
TLSH
T1BA72D0C5348A87CBA163FF3679EAC7AD4B0324889CC545CAF812E3875B35096F1644AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mip_sdk.miplog

Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
Size 14KB
SHA256 2f8fdad8069d0e8c47044d4c896770cf9dd01c6e4cdd0b0411c5c8c4e69b57f4
MD5 47db244bab9681f44248ac977213cc4f
SHA1 dd72d3d89c26dac5b79ea564679143aadf43614d
SHA512 7621ac41312412d877c26ce9b739660a517428d79d063988f6a50978add3089ec174e40fee2e652dd3021d9ff6bdf9c1b6c11531d06970124d8e90eedaae8ea5
SSDEEP 192:kj6k9+Iz6OZTIjHF9aGzFXsIZ6XYQvjuc9WgzdZZu4Clj/Z9ynzS0ZZgnjQK9aul:LIrGpcdoQOgNCwn0uul
TLSH
T1DF6234A3925DC5EB98357F1773D337618809362A26CB650D5B280349318BB294FFAF29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

excel.exe.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal
Size 8KB
SHA256 00b68e78040752eb28c4beb97d9fbc7b18a03b5e60e19933d3faebbd7c2b7f7d
MD5 a99a511617bce062a62fc21b19948d5b
SHA1 7d1c0c9e2f44404a03d82ee7c3a3c8049cbde7e6
SHA512 c3a890668d89ab8bf67b22adc9dac0165b39fd7ee7783af30cd9806e24f7b3ab4041dcfdf09ee7cff0d66489295723e476af15a53b1af11c654af74c6752aa82
SSDEEP 24:KbDqt8VtbDBtDi4kZERDHTqt8VtbDBtDi4kZERDf:qDO8VFDYMTTO8VFDYML
TLSH
T14D02B1C27AB87561E09A61F7C9B31367077D9269043392A32DB25492ECC18CAD4265FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

excel.exe.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal
Size 16KB
SHA256 4d8c2689164ee895df66fa293434fdabf26d0ec98497463d53d7ccd3e8c9b110
MD5 95fa726d6bb29c37fdfe01e6940ea262
SHA1 14d1dc4827a3e5a55a85e15d3a041e47cfacabe0
SHA512 e1c61a9fa547a165e1d6b600b96345cfeb6853192e27706db31fdb8152e45333ca482b91e8d739f099ea276715913dfcbcbbdb796a8b20cd6eb3aee60bc3e60c
SSDEEP 48:qDO8VFDYMTTO8VFDYMNjO8VFDYMPlMQO8VFDYML:qjVG0jVGqjVGY6QjVGC
TLSH
T13272C2C176B87161E09A61F7C9B3136B077DD269043392A72DF25892ECC18CAD4265FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 69151b3b2eec963850d0a662910c67e1bc3a6e9b286d44a190576d8ca928268a
MD5 bc01c1d1495c101ca85e7e69f9aa210e
SHA1 13ed0fcd80165e11e9daeba96af226a879d1a12b
SHA512 0be2313a61fead2b6edee06fb02f1559dc6b83a53af644910255acce6a71106427855e197f9ce0063a918cb1e952223d8d07e95caf6de3c7d430a00012b4ad10
TLSH
T1F841484C6AE91149B3776E5A9FF6A86E487FBD372E0BD19E00510D8F0623A00C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Size 2KB
SHA256 2fa6acb303e61761abb83845f00f44cc6fc1b1646dd1bafab735c8174cfe42b2
MD5 481b2c9b13a08725a33db863b5c93570
SHA1 027e0fae78f225e1e718b50c7e8726eb9abe5b2e
SHA512 05ce850d26552612ed7044e43aa470f818762c8997874d74e2e7f8a72175fde4874f1d201e39d09bad5618c47787707e731f2676b48d43af923e286ff9eaec90
TLSH
T1D3512758B6ED1544B3776E469FF6B86E88BBBD732E16959D10120E4E0A33B00C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

RemoveGet.xlsx.LNK

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\RemoveGet.xlsx.LNK
Size 522B
SHA256 42d225a2350df79e62d7ffbe24b90156cd9eaf595522071c7ad0129e5f86ccde
MD5 9107316460077d03e9e602aaf41fc1dd
SHA1 cb1e53908205d8500875b0f5962d9c28577ea83e
SHA512 8149fe0307d17746265739e3199e65f1a21460c91de1179aa17a4704dd905b062567c2c0f7e74584cc978660408931350fdbaaa51e71d90ae7a713571d7019e4
TLSH
T145F05C4F0FAB3F17C2684732917DA75CC9346D00EAF84B1C6180415529D5950C1A5F15
MD5 SHA1 SHA512 TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 882B
SHA256 58e1330ba764049a0b5d12407be1313dea35bb32e59c3cf437e8eed27e96bb75
MD5 57aabfc227b1ce462fa1228cfc6879de
SHA1 b84566a3e935eb6f729092b45f539aa79de73fd6
SHA512 e5972aa11ab1e59fb15d75ce780ece6f1a39e040221b2fc80cb2abeb5fc1ffde81d646896f135c2ea5d21aa9ae1c1d26c40f1bd11e1254de5cae207090b60bf2
TLSH
T173119642F6281525DA818BB428A6BDBD8E5531656B31C195F7613508FF4710952822AD
MD5 SHA1 SHA512 TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 348B
SHA256 4d5f80a826efca4de744e3aa0b9b871d9d83bed2ccbc34d28b9f43932948101d
MD5 c6452954a6d9aead2eb96e034c548caa
SHA1 54233432c5a0ef72289855175024bea2250f4776
SHA512 bdf90d73260507b4d9660f6535f6abda2395e2eec4a9e2c2c6f699b0167540f2b3d39b82db6f951610b01ef320750f90f3fc64e77f8edde07cefeaceb0be924b
TLSH
T101E04F977338DBF9937D116438788CE04BF18C54D75D022501EC4DD20C10A032197998
MD5 SHA1 SHA512 TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 1KB
SHA256 cf0da75194125d5c6390a79c12dde0bfb77f8bcaf3c719df1e3827836ba4dbfe
MD5 c80ca03be14210e63c67737df8896a16
SHA1 44d6639055ab764d317c08e873d57670fe3f0521
SHA512 2c08d31c69a8b7e2d8a8f1f9a780d27e2b19f5dc07b6b093e14ad290589503a24a5287fba75043aaaa7cadd662cf8332daa5e2f6730478f50eb6e8266716c153
TLSH
T19B41F2020FAB6F97D0688731962DFB8DDE207952DB54A61E7384512E3E61C408A1DB26
MD5 SHA1 SHA512 TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 1KB
SHA256 1849fb0faa4b1ef4be23e44b0c1292d2d94ef4655fe37d0c25bcf8066fe6e304
MD5 06bd0fb9cb55e68d4566ae758e75eafc
SHA1 326515e193b585a92fb021188d2e086cf8465c97
SHA512 792dba413b04bf884ee7cd3511bb881b76c55954538fb3326a736e2d7ed9ee02d68c522a53f45b6a3687b93d4250853ebe1a28a8d5344dd23163c26c7175eca3
TLSH
T16D41F2020FAB6F97D0688731962DFB8DDE207952DB54A61E7384512E3E61C408A1DB26
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1476-693-0x00007FF7ED290000-0x00007FF7ED2A0000-memory.dmp

Download

memory/1476-695-0x00007FF7ED290000-0x00007FF7ED2A0000-memory.dmp

Download

memory/1476-650-0x00007FF7EB040000-0x00007FF7EB050000-memory.dmp

Download

memory/1476-651-0x00007FF7EB040000-0x00007FF7EB050000-memory.dmp

Download

memory/1476-692-0x00007FF7ED290000-0x00007FF7ED2A0000-memory.dmp

Download

memory/1476-694-0x00007FF7ED290000-0x00007FF7ED2A0000-memory.dmp

Download

memory/2468-702-0x00007FF7EB040000-0x00007FF7EB050000-memory.dmp

Download

memory/2468-703-0x00007FF7EB040000-0x00007FF7EB050000-memory.dmp

Download

memory/4304-2078-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/4304-22618-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/4304-22619-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/4304-644-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/4304-14-0x00007FF82D210000-0x00007FF82D405000-memory.dmp

Download

memory/4304-18002-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/4304-654-0x00007FF82D210000-0x00007FF82D405000-memory.dmp

Download

memory/4304-6291-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/4896-6-0x00007FF82D210000-0x00007FF82D405000-memory.dmp

Download

memory/4896-729-0x00007FF82D210000-0x00007FF82D405000-memory.dmp

Download

memory/4896-7-0x00007FF7ED290000-0x00007FF7ED2A0000-memory.dmp

Download

memory/4896-12-0x00007FF7EB040000-0x00007FF7EB050000-memory.dmp

Download

memory/4896-9-0x00007FF82D210000-0x00007FF82D405000-memory.dmp

Download

memory/4896-11-0x00007FF82D210000-0x00007FF82D405000-memory.dmp

Download

memory/4896-10-0x00007FF82D210000-0x00007FF82D405000-memory.dmp

Download

memory/4896-8-0x00007FF82D210000-0x00007FF82D405000-memory.dmp

Download

memory/4896-5-0x00007FF7ED290000-0x00007FF7ED2A0000-memory.dmp

Download

memory/4896-4-0x00007FF82D2AD000-0x00007FF82D2AE000-memory.dmp

Download

memory/4896-2-0x00007FF7ED290000-0x00007FF7ED2A0000-memory.dmp

Download

memory/4896-3-0x00007FF7ED290000-0x00007FF7ED2A0000-memory.dmp

Download

memory/4896-13-0x00007FF7EB040000-0x00007FF7EB050000-memory.dmp

Download

memory/4896-1-0x00007FF7ED290000-0x00007FF7ED2A0000-memory.dmp

Download

memory/4896-643-0x00007FF82D210000-0x00007FF82D405000-memory.dmp

Download