307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
Size 1007KB
Sample260818-jpan2aydkb
SHA256 307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975
MD5 937d43f31299ad1064540e859c1b4f89
SHA1 f783c7c4788ba5fc9248940c9f02db43e12d90b1
SHA512 9a51690ba8c724635692bbc4b4cc77ed21fc60e23aaa601416804544ba1729df9d7d9a53a0cd704619e611cc3de1df1df58bab6e79380ad479a6c5e6628eaf2d
SSDEEP 24576:Ohtl5TZiUytlMLUUclKmpN1VEBKRbaiWCkfOtEU8js:Ohtl5Izf7TEBKR5tkfOtEUQs
TLSH
T1DF251203FE00C3F1E0659974A7A5DB399A3EBA436E25865B931CFD1CCD916B09B9B01C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Loads dropped DLL 10 IoCs

pid	Process
6000	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
6000	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
6000	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
6000	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
6000	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
3108	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
3108	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
3108	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
3108	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
3108	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe"	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe"	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\windows\»¬»ü.reg	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
File created	C:\windows\»¬»ü.bat	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
File opened for modification	C:\windows\»¬»ü.reg	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
File opened for modification	C:\windows\»¬»ü.bat	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5112	cmd.exe
1812	cmd.exe
1652	cmd.exe
4144	cmd.exe
2684	cmd.exe
4204	cmd.exe
5116	cmd.exe
6008	cmd.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2092	6000	WerFault.exe	87
5192	3108	WerFault.exe	100
3276	6000	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile"	cmd.exe

Runs .reg file with regedit 8 IoCs

pid	Process
5372	regedit.exe
5364	regedit.exe
4088	regedit.exe
2896	regedit.exe
2488	regedit.exe
2104	regedit.exe
3176	regedit.exe
5240	regedit.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
6000	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
6000	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
6000	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
6000	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
6000	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
6000	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
3108	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
3108	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
3108	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
3108	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
3108	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
3108	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 6000 wrote to memory of 1812	6000	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe	88
PID 6000 wrote to memory of 5112	6000	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe	89
PID 6000 wrote to memory of 5116	6000	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe	90
PID 6000 wrote to memory of 6008	6000	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe	92
PID 5116 wrote to memory of 5372	5116	cmd.exe	98
PID 6008 wrote to memory of 5364	6008	cmd.exe	99
PID 5112 wrote to memory of 4088	5112	cmd.exe	101
PID 3108 wrote to memory of 4204	3108	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe	104
PID 3108 wrote to memory of 2684	3108	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe	105
PID 3108 wrote to memory of 1652	3108	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe	106
PID 3108 wrote to memory of 4144	3108	307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe	107
PID 1812 wrote to memory of 2896	1812	cmd.exe	114
PID 4204 wrote to memory of 2488	4204	cmd.exe	116
PID 4144 wrote to memory of 2104	4144	cmd.exe	117
PID 2684 wrote to memory of 3176	2684	cmd.exe	118
PID 1652 wrote to memory of 5240	1652	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
"C:\Users\Admin\AppData\Local\Temp\307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\windows\»¬»ü.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s ╗¼╗ⁿ.reg
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:2896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\windows\»¬»ü.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s ╗¼╗ⁿ.reg
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:4088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\windows\»¬»ü.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s ╗¼╗ⁿ.reg
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:5372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\windows\»¬»ü.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:6008
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s ╗¼╗ⁿ.reg
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:5364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6000 -s 664
  2⤵
  - Program crash
  PID:2092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6000 -s 716
  2⤵
  - Program crash
  PID:3276

C:\Users\Admin\AppData\Local\Temp\307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
C:\Users\Admin\AppData\Local\Temp\307597cbaef9829c1703cecb8609be3dd3689794857832bc5958b0e8de64d975.exe
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\windows\»¬»ü.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s ╗¼╗ⁿ.reg
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:2488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\windows\»¬»ü.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s ╗¼╗ⁿ.reg
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:3176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\windows\»¬»ü.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s ╗¼╗ⁿ.reg
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:5240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\windows\»¬»ü.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s ╗¼╗ⁿ.reg
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:2104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 644
  2⤵
  - Program crash
  PID:5192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 6000 -ip 6000
1⤵
PID:5396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3108 -ip 3108
1⤵
PID:5948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6000 -ip 6000
1⤵
PID:2176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dp1.fne

Path C:\Users\Admin\AppData\Local\Temp\E_N60005\dp1.fne
Size 128KB
SHA256 abebbb0981d3d51eb63abcfa68be98da0cae4e6e3b143dd431fc845d1457dbd2
MD5 07201b1fd5f8925dd49a4556ac3b5bab
SHA1 a76afbb44376912f823f2b461507c28d2585a96c
SHA512 0cf673ce1b6cad38f0211231e876f00f6a8397a5f3e71680046f4a216bbe0f47f4541e5f5b49364310e41a04cce14703459725c3d9f052f9da13624e73753e12
SSDEEP 1536:tiDSn+hfeTpCwAncpZ6Z8HTiQjl1sYiKG3oe/:UDTReTgwAcp9lqKG3o
TLSH
T138D39E4959C384FBE464193C84F357BA9F3F290336978E9FDB08D6582C622186B533E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iext.fnr

Path C:\Users\Admin\AppData\Local\Temp\E_N60005\iext.fnr
Size 204KB
SHA256 8c8254cb49f7287b97c7f952c81edabc9f11f3fa3f02f265e67d5741998cf0bf
MD5 856495a1605bfc7f62086d482b502c6f
SHA1 86ecc67a784bc69157d664850d489aab64f5f912
SHA512 35a6e580cd362c64f1e1f9c3439660bd980ec437bd8cabbdc49479ceb833cd8cb6c82d2fb747516d5cfcf2af0ba540bc01640171fbe3b4d0e0a3eeeaa69dd1d9
SSDEEP 3072:qOs+pOZXaFAO0shQe9lkvelFv76OD5KoUThiL5t3gIn:C+0cB+vebJ6iLTF
TLSH
T118148D0375A1C1B5C35F1A3E09126B36B7BB99518FD0CF536F10DE9D3E36844A82B62A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krnln.fnr

Path C:\Users\Admin\AppData\Local\Temp\E_N60005\krnln.fnr
Size 1.2MB
SHA256 4bed8a6e4e1548fddee40927b438132b47ef2aca6e9beb06b89fcf7714726310
MD5 1eece63319e7c5f6718562129b1572f1
SHA1 089ea3a605639eb1292f6a2a9720f0b2801b0b6e
SHA512 13537d1dd80fa87b6b908361957e8c434ca547a575c8c8aab43423063e60cb5523fb1843a467ae73db4a64d278c06b831551e78ae6d895201f7ef0c5b162c1ab
SSDEEP 24576:CveDp1soGSplcN0pgTpD1vRcsatXL/rxdcwwWB5XR:CunVe0pG1a7/UwwWTR
TLSH
T18555AE02F99680F1C70D2530087A7B7EBE7D46860B148BE79BA4FF695C32181E93765E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shell.fne

Path C:\Users\Admin\AppData\Local\Temp\E_N60005\shell.fne
Size 60KB
SHA256 90284c2ead0598faa715cc90c1f53b83b916099c918ce7f816f0b4550ff55ac6
MD5 98174c8c2995000efbda01e1b86a1d4d
SHA1 7e71a5a029a203e4ab0afc68eee18c39f4ab4097
SHA512 a37059062a99cd2a9fae15850b49068752ccf0be9f1d86c3f812a689b7c4d024771ec2b66adf9ce950bc5b8b117d457aba87d586cf112a1a30239531bfc8cd06
SSDEEP 768:eeZWaAKT41c1IYc8HBbrYNYVw2Fj9oNIqF42eofVU:eBKT4fkrymV7oNIqC8f6
TLSH
T144533A096C830077E199093183C24BF65FBE6D433EE365BFCF6084952EA1199956AEF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spec.fne

Path C:\Users\Admin\AppData\Local\Temp\E_N60005\spec.fne
Size 72KB
SHA256 0c9e6eb8648f4bf5c585d5344035e91c3249bb9686a302503b4681b7ba828dc0
MD5 bd6eef5ea9a52a412a8f57490d8bd8e4
SHA1 ab61ad7f66c5f6dfb8d28eba1833591469951870
SHA512 1c43e50270eed071c8ef35e1c4695a93b9f98e668d4aebb44eb3b620efd2624b381554d2daf2d017f764b485e060abd589216043adea19eac94028ce66cc2025
SSDEEP 768:zFYJh2NrjSv4ol1WAHcTtEWC9Vm0yws7oP8NiB9EhyTWV/h2nokCqytGSgtvag/:zrrev4olRHcTtD0y7o0YUKokC7Idp
TLSH
T11973AF126991C0B3C0E8523978E30B3BDF3FB8115ED686938F7AD9961D31372A91B603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

»¬»ü.bat

Path C:\Windows\»¬»ü.bat
Size 41B
SHA256 48cc7976a0b5b7d1b64236ee149b4a0bc4a63d92f7d096af229b07fda7b3d1aa
MD5 0e506e9ab5e9ecd67c8c90cfd069583c
SHA1 3a3aa322757e1fd85c46c8ab14ec422757dc1d17
SHA512 a5d850e459bd103dd994af79decd1f73957d4462da6cdbc87b227a3edec8aa5a836f894da9dc10ca6ed6238549263c5bb2a096d536cb3c3033085016b91a0a81
MD5 SHA1 SHA512

Submit Download

»¬»ü.reg

Path C:\windows\»¬»ü.reg
Size 192B
SHA256 95be608ae9da0702df5aec75a6a40ac496179892d5b5664b90506144e0e3d66b
MD5 569e0efb4985b49fa904d607ab0db8ea
SHA1 732a7c41141d8cc6c12fd4a00f70975625ee0aa4
SHA512 6296b222ab350d1cf12cfc81bbcc3c274bad751777fd345d2d1760e1b469712666ea7be0f2b8e533c00608eec210105c7b248635e0359f57524ed0ea0a27ee22
TLSH
T178C0125603E56445F7B33A915EF5A5508F32BD94182590DC11D6820E40A1D105422BBB
MD5 SHA1 SHA512 TLSH

Submit Download

»¬»ü.ico

Path C:\»¬»ü.ico
Size 12KB
SHA256 9b9280125fe7be5dfdea2f7d2b5179ad6dea6c4e17f8160dffde9b8789d7ee33
MD5 e1535179cae11a30d68b8e10f7b3c4af
SHA1 88b1173fa047f3a238fadd9ab093f0b28217f44c
SHA512 431f41c5b5a34e3c4c46b2316af479cc54f84a78db07bea5154c62e8b53f3fcbc0b79d8ac2bfa3cd220cc7a6d2d735742c31c0b37df05cad733d8001d05a3ec5
SSDEEP 192:2SEePsfKATB5cQ8hgilWRfKx3UIHoJKtTM0UW9:REisfKATB2Q8hgilmKJ0KRU4
TLSH
T16E42E9B2D512F9C3DCA27433E131179449F3722ABAE68D954D1C3F4ECFDA114A60D689
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3108-43-0x0000000002220000-0x0000000002261000-memory.dmp

Download

memory/3108-61-0x0000000002390000-0x00000000023A7000-memory.dmp

Download

memory/3108-63-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/6000-30-0x0000000002450000-0x0000000002467000-memory.dmp

Download

memory/6000-0-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/6000-12-0x0000000002400000-0x0000000002441000-memory.dmp

Download

memory/6000-64-0x0000000000400000-0x0000000000433000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads