Analysis
- max time kernel
149s - max time network
128s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
27/04/2026, 22:33
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe
- Size 1.0MB
- Sample260427-2gr78aav61
- SHA256 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a
- MD5 3daa5d869ff50d629e9715f583b0ab0c
- SHA1 44d69bbac3172ca8693c8df6601c2c64c36ec8e7
- SHA512 0e48dfb02b8ece161ea85f9faf2ffd6ff1f64fd7df488ebe5c2dabc9ec81fc67ced49de480b2331a9dedeb17a4a3f526fd06c9f3416067166a9ba083b866a409
- SSDEEP 24576:TRaZROMOm8FN7TjsPnzt2heeRhQbJEOeamEuuO3:tkxOm+7TjsPnztyDMmaPi
- TLSH T156357D5973A851A9FEB7E037CA52C607C7B1788A42778B1F01E04AB67F736711A1E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe 4668 e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe"C:\Users\Admin\AppData\Local\Temp\e13d6ed7e2dbfe3590039cfe5f0db660d89b7395a76f9e288bbb60b27ba33d9a.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4668
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\launcher_config.ini
- Size 345B
- SHA256 48b0098fb8d9305b751bc9f6facdc02f2c62597fceeafec390356788d777b135
- MD5 4cbbdd739e2e4a7fb05177e2cf94bb06
- SHA1 e2e1efede55bb9236e04b0a33e6f90c2855b71da
- SHA512 6157f0fdf2b3ef3eeb72be3a6018bd943e6ddd603761db7d33a2bac465186ad260c6b90bf50bffc4e4976b057689fc4fd924b3964a4ffd01fa55c0899c15ab1d
- TLSH T1FAE02DC00E102882F076F4ACE8971BC0E0AAB04A488140B6FF2886DE5EAD42C12E8A03
- MD5 SHA1 SHA512 TLSH