Overview

overview

10

Static

static

3

261114-b8a...ed.zip

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    156s
  • max time network
    94s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-es
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/11/2026, 01:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    261114-b8a5xabx4s_pw_infected.zip
  • Size 154KB
  • Sample261114-cctstabx9t
  • SHA256 c9f910b3e1bda4565a6ca8833201d7f241cd3c6bb78c59f956965d1046a4b50e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionfogimpactpersistenceprivilege_escalationransomwarestealer

Malware Config

Extracted

Path

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\readme.txt

  • fog

Ransom Note
  • If you are reading this, then you have been the victim of a cyber attack. We call ourselves Fog and we take responsibility for this incident. You can check out our blog where we post company data: xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion You might appear there if you opt out of our communication. We are the ones who encrypted your data and also copied some of it to our internal resource. The sooner you contact us, the sooner we can resolve this incident and get you back to work. To contact us you need to have Tor browser installed: 1. Follow this link: xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion 2. Enter the code: 1KQOWFH2KYTLDJKX7ZTJDNMX 3. Now we can communicate safely. If you are decision-maker, you will get all the details when you get in touch. We are waiting for you.
URLs

  • http://xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion

  • http://xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion

Signatures

  • Family: Fog Ransomware

    Fog ransomware is used to attacks educational organizations and was first seen in the spring of 2024.

    ransomwarefog
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (8096) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 1 IoCs
  • Queries Windows Firewall configuration 1 TTPs 2 IoCs

    Lists Windows Firewall rules and allowed ports on the host, showing which network traffic or programs can communicate without being blocked.

    discovery
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 13 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Connections Discovery 1 TTPs 2 IoCs

    Attempt to get a listing of network connections.

    discovery
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\261114-b8a5xabx4s_pw_infected.zip
    1⤵
      PID:5728
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2548
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap13969:116:7zEvent3931
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:4124
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap14145:186:7zEvent2567
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:1928
      • C:\Users\Admin\Desktop\a9a4e89aaae8dc3638e3ca0f277ee37c0f3d14cd89f4972de591a531a6302fdd.exe
        "C:\Users\Admin\Desktop\a9a4e89aaae8dc3638e3ca0f277ee37c0f3d14cd89f4972de591a531a6302fdd.exe"
        1⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: RenamesItself
        • Suspicious use of WriteProcessMemory
        PID:2804
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c net config Workstation
          2⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1616
          • C:\Windows\SysWOW64\net.exe
            net config Workstation
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4952
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 config Workstation
              4⤵
              • System Location Discovery: System Language Discovery
              PID:5948
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c systeminfo
          2⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2416
          • C:\Windows\SysWOW64\systeminfo.exe
            systeminfo
            3⤵
            • System Location Discovery: System Language Discovery
            • Gathers system information
            PID:1000
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c hostname
          2⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3836
          • C:\Windows\SysWOW64\HOSTNAME.EXE
            hostname
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1696
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c net users
          2⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4996
          • C:\Windows\SysWOW64\net.exe
            net users
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2680
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 users
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2596
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c ipconfig /all
          2⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6008
          • C:\Windows\SysWOW64\ipconfig.exe
            ipconfig /all
            3⤵
            • System Location Discovery: System Language Discovery
            • Gathers network information
            PID:2948
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c route print
          2⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2928
          • C:\Windows\SysWOW64\ROUTE.EXE
            route print
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2992
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c arp -A
          2⤵
          • Network Service Discovery
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5192
          • C:\Windows\SysWOW64\ARP.EXE
            arp -A
            3⤵
            • Network Service Discovery
            • System Location Discovery: System Language Discovery
            PID:4780
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c netstat -ano
          2⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • System Network Connections Discovery
          • Suspicious use of WriteProcessMemory
          PID:5824
          • C:\Windows\SysWOW64\NETSTAT.EXE
            netstat -ano
            3⤵
            • System Location Discovery: System Language Discovery
            • System Network Connections Discovery
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:2640
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c netsh firewall show state
          2⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6116
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall show state
            3⤵
            • Queries Windows Firewall configuration
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:1152
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c netsh firewall show config
          2⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4932
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall show config
            3⤵
            • Queries Windows Firewall configuration
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:2400
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c schtasks /query /fo LIST /v
          2⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4160
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /query /fo LIST /v
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5444
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c tasklist /SVC
          2⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5312
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /SVC
            3⤵
            • Discovers running processes
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:3200
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c net start
          2⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2808
          • C:\Windows\SysWOW64\net.exe
            net start
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4652
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 start
              4⤵
              • System Location Discovery: System Language Discovery
              PID:5208
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c DRIVERQUERY
          2⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4280
          • C:\Windows\SysWOW64\driverquery.exe
            DRIVERQUERY
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2136
        • C:\Windows\system32\vssadmin.exe
          C:\Windows\Sysnative\vssadmin.exe delete shadows /all /quiet
          2⤵
          • Interacts with shadow copies
          PID:5448
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5416

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            2
            T1059

            Windows Command Shell

            1
            T1059.003

            Windows Management Instrumentation

            1
            T1047

            Persistence

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Privilege Escalation

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Defense Evasion

            Direct Volume Access

            1
            T1006

            Indicator Removal

            2
            T1070

            File Deletion

            2
            T1070.004

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Windows Credential Manager

            1
            T1555.004

            Discovery

            Network Service Discovery

            1
            T1046

            Peripheral Device Discovery

            1
            T1120

            Process Discovery

            1
            T1057

            Query Registry

            1
            T1012

            Software Discovery

            1
            T1518

            Security Software Discovery

            1
            T1518.001

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Connections Discovery

            1
            T1049

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Inhibit System Recovery

            2
            T1490

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            ja.pak.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\ja.pak.flocked
            • Size 1.3MB
            • SHA256 4ddbb7ad006562e1ab6b8564c1d08f2094517eb27123498c0353083fcece74fa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mr.pak.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\mr.pak.flocked
            • Size 2.1MB
            • SHA256 8cea28434b57acc68b78c609dd105e4ec8899d1f98d86121c990270a5826d359
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sr.pak.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\sr.pak.flocked
            • Size 1.7MB
            • SHA256 e0a3573a0a4ca118b15b2af9bbd88737c7124b424bca18cbca6cc1cb65e72f1d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tt.pak.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\tt.pak.flocked
            • Size 1.7MB
            • SHA256 a71438e1b4692a9c978bba4df27f9c2a5532f2d9d34b5f2e6771fa8bcade6edb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            uk.pak.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\uk.pak.flocked
            • Size 1.7MB
            • SHA256 3f96aca362e63c0fec4dfe352a8260a4d9630ad8314ffefd0587e0f40d9fdc49
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            icudtl.dat.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\icudtl.dat.flocked
            • Size 11.5MB
            • SHA256 cc0a4f0e66bf27653700b67dc95cca563f87324fdc42fc76dcd75493ed51b2c4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            af.pak.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Locales\af.pak.flocked
            • Size 995KB
            • SHA256 bccefacd7b8094e7c99a4e6d64da56158b3d7cbb59a86045eb167df386a00bde
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bn-IN.pak.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Locales\bn-IN.pak.flocked
            • Size 2.2MB
            • SHA256 174e070958d6fd4b6688394e558d419eda01d149b674e9229a047974d183db16
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            km.pak.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Locales\km.pak.flocked
            • Size 2.2MB
            • SHA256 0891f3e8d4935656524b5d15783c789033740b8adfaff9e573bb9b718ebc3866
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pl.pak.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Locales\pl.pak.flocked
            • Size 1.1MB
            • SHA256 ebea3db0d099631d39f460249988423cf18d92dc147fad4853331b8ab20e6a15
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vi.pak.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Locales\vi.pak.flocked
            • Size 1.2MB
            • SHA256 44433c240b61d5336c3cf4d88ac4f9ae192b2ab14a31cf73504b94fb1c7ea4ed
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            da.pak.DATA.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Locales\da.pak.DATA.flocked
            • Size 992KB
            • SHA256 380bb052c558c02f72de9832d5c29bc51a04ff587901a6e075dc0898d754a9d3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            gu.pak.DATA.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Locales\gu.pak.DATA.flocked
            • Size 2.1MB
            • SHA256 84c26f122bfe895e17e65bd68784ccf996657dc94ec5538a02799742e9abbb1a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            it.pak.DATA.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Locales\it.pak.DATA.flocked
            • Size 1.1MB
            • SHA256 84c15c91ddbc7817173a3d1f5708e907468f8617b8018c526ac333634220087a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            lb.pak.DATA.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Locales\lb.pak.DATA.flocked
            • Size 1.0MB
            • SHA256 dbee5cfb6bd1b5d0b1750f23aa70575b82f716a19209b365392bccff48a56916
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ml.pak.DATA.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Locales\ml.pak.DATA.flocked
            • Size 2.5MB
            • SHA256 109d0c92cfcfeb1c3e4f3775cf9cd1d2d571204bd19b39fcad5a51d6e2b26fda
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            or.pak.DATA.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Locales\or.pak.DATA.flocked
            • Size 2.3MB
            • SHA256 02af7bf1d62c5203366daec64425defdf42f7e5ad72976ad1ee7dde06c73a724
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pa.pak.DATA.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Locales\pa.pak.DATA.flocked
            • Size 2.1MB
            • SHA256 c1d8e9ff5af4ba71a8c75c3dc66f94213340061b222c49c3ba17c2b691afe11e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sr-Cyrl-BA.pak.DATA.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Locales\sr-Cyrl-BA.pak.DATA.flocked
            • Size 1.6MB
            • SHA256 f8adce06cdec73c95ee1e9c4f3fd7cb0cebab828a3e22f0ded082fe9117250f6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sr.pak.DATA.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Locales\sr.pak.DATA.flocked
            • Size 1.6MB
            • SHA256 3ebbbe87582593ec8ca955c15218f6e2c1fb7abc71b5fda5377f1d479ab17788
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SmallLogoCanary.png.DATA.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\VisualElements\SmallLogoCanary.png.DATA.flocked
            • Size 15KB
            • SHA256 f68b850327d40fa4c1e7ce611a2a24d587ae79616a7008e39c956e840d9cc9d9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            show_third_party_software_licenses.bat.flocked
            • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat.flocked
            • Size 832B
            • SHA256 3d5145ca761ae78a80088f9c4dcc68e05f36c8dbd426e596ac5a983d5210755d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            et.pak.DATA.flocked
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\et.pak.DATA.flocked
            • Size 1006KB
            • SHA256 31ba3405cc9d4b0ccc997beb908626c99e5935569eeab0794455b6696b74155a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            it.pak.DATA.flocked
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\it.pak.DATA.flocked
            • Size 1.1MB
            • SHA256 4676f1db504668b1fb687fb007e850a4527f16571b72df1d162b98494c3c47bb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            kn.pak.DATA.flocked
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\kn.pak.DATA.flocked
            • Size 2.4MB
            • SHA256 3d4ad69e28b5d3ea075b65dd099c69ff8a1075cd35953617a0a04c3a1bb6375d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mk.pak.DATA.flocked
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\mk.pak.DATA.flocked
            • Size 1.7MB
            • SHA256 454c56608d88beb4e4fb236a4414800e75d3f2d8f07d1099056c156fda2e4ca9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ml.pak.DATA.flocked
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\ml.pak.DATA.flocked
            • Size 2.6MB
            • SHA256 85e510434efe47a46133154a8a42579d58c07a730fac3893f8b6b3b49253cc3c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            te.pak.DATA.flocked
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\te.pak.DATA.flocked
            • Size 2.3MB
            • SHA256 9d5fe768ac282447779f24ee4430356df025424288649d47e725ce93d64cf203
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            th.pak.DATA.flocked
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\th.pak.DATA.flocked
            • Size 2.0MB
            • SHA256 1834d3c1d9cf804f2e0c6d01c5c29b1ffb805201cdb658043815588f64000290
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            readme.txt
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\readme.txt
            • Size 837B
            • SHA256 4478fff2df7db69e1afef769db2796b2cc9aabf83b6e9d4929858487a2fdf532
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            el_FEMININE.pak.flocked
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\el_FEMININE.pak.flocked
            • Size 64B
            • SHA256 e814ef1e6cbb2e0800d491adbe3dfb4010bd06d65c795c08ade59664ac60ab7e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dotnet-host-6.0.27-win-x64.msi.flocked
            • Path C:\ProgramData\Package Cache\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}v48.108.8828\dotnet-host-6.0.27-win-x64.msi.flocked
            • Size 736KB
            • SHA256 f9c46d41cfc55abae7b6508b71cb263ea2d1a73c8e21715920dc8584e4ff90b1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DbgLog.sys
            • Path C:\Users\Admin\Desktop\DbgLog.sys
            • Size 4KB
            • SHA256 785509793a86fcec72ab91a642a372f3b12c47505b1df4431b28997e102e54c8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            a9a4e89aaae8dc3638e3ca0f277ee37c0f3d14cd89f4972de591a531a6302fdd.exe
            • Path C:\Users\Admin\Desktop\a9a4e89aaae8dc3638e3ca0f277ee37c0f3d14cd89f4972de591a531a6302fdd.exe
            • Size 233KB
            • SHA256 a9a4e89aaae8dc3638e3ca0f277ee37c0f3d14cd89f4972de591a531a6302fdd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cd3228f521e95f23279e611ec5c6506c814e474de4d3158891f6655d4c8834c1.zip
            • Path C:\Users\Admin\Desktop\cd3228f521e95f23279e611ec5c6506c814e474de4d3158891f6655d4c8834c1.zip
            • Size 153KB
            • SHA256 cd3228f521e95f23279e611ec5c6506c814e474de4d3158891f6655d4c8834c1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ApproveOut.mid.flocked
            • Path C:\Users\Admin\Downloads\ApproveOut.mid.flocked
            • Size 983KB
            • SHA256 470563bcc533594ef3932db738b68c518d80abe52795b80792760a16a1bf6e25
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ClearBlock.mpeg2.flocked
            • Path C:\Users\Admin\Downloads\ClearBlock.mpeg2.flocked
            • Size 1.2MB
            • SHA256 28eb7d06cea2ad99b6068a1d0567fdf6a033c23e600a80126187b00a11231af4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DebugGroup.xltm.flocked
            • Path C:\Users\Admin\Downloads\DebugGroup.xltm.flocked
            • Size 491KB
            • SHA256 81505eeba2f7b462b95aa0b1d111756ca8d3677223d93beb054884924000321a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/2804-7-0x0000000001470000-0x000000000148B000-memory.dmp
            Download

            memory/2804-9-0x0000000010000000-0x000000001001E000-memory.dmp
            Download

            memory/2804-21-0x0000000010000000-0x000000001001E000-memory.dmp
            Download