aa342f0e7ba9367b30f974387486817e1ed532d0bc9c64a86c3fd2763d67f80b

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_[DL] Top.Rated.Software.September.20.2008.Pack-DLFT .exe
Size 485KB
Sample260910-ct7e8stflg
SHA256 aa342f0e7ba9367b30f974387486817e1ed532d0bc9c64a86c3fd2763d67f80b
MD5 9fcea0bc6a2defb00a6b3e4144e18d1c
SHA1 3860b67c633c3205dc827a5ecd343582b3b3676a
SHA512 05e7a2fb1cea81e0695b4830378002699c82629b4e3adf38609f6472fd1259176938d530dff4de1513cc2599beedb50ace99d0d4a3ca23859af6b57b3c8e4159
SSDEEP 12288:1AHm8hzQOKdrCP75X6m0Xd/gC0r7aOoEU8emji:eQ9dGPtX6m0XdId7HN
TLSH
T11EB4CFE13CC0AABBDA5241F14D58CA509252FC7EDF0729C737BE3FC586392EA4521A52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Looks for VMWare drivers on disk 2 TTPs 1 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\SysWOW64\drivers\vmmouse.sys	jaffacakes118_[DL] Top.Rated.Software.September.20.2008.Pack-DLFT .exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	jaffacakes118_[DL] Top.Rated.Software.September.20.2008.Pack-DLFT .exe

Executes dropped EXE 23 IoCs

pid	Process
1740	nzm.exe
1844	Keygen.exe
2488	nzm.exe
4368	winupdate.exe
1256	winupdate.exe
4176	winupdate.exe
3852	winupdate.exe
1776	winupdate.exe
2988	winupdate.exe
2996	winupdate.exe
452	winupdate.exe
3356	winupdate.exe
4688	winupdate.exe
3300	winupdate.exe
1364	winupdate.exe
1524	winupdate.exe
4248	winupdate.exe
3648	winupdate.exe
4136	winupdate.exe
3432	winupdate.exe
3676	winupdate.exe
2620	winupdate.exe
3772	winupdate.exe

Loads dropped DLL 1 IoCs

pid	Process
1844	Keygen.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\winupdate.exe	nzm.exe
File opened for modification	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\winupdate.exe	nzm.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 1740 set thread context of 2488	1740	nzm.exe	90
PID 4368 set thread context of 1256	4368	winupdate.exe	92
PID 4176 set thread context of 3852	4176	winupdate.exe	100
PID 1776 set thread context of 2988	1776	winupdate.exe	106
PID 2996 set thread context of 452	2996	winupdate.exe	108
PID 3356 set thread context of 4688	3356	winupdate.exe	111
PID 3300 set thread context of 1364	3300	winupdate.exe	113
PID 1524 set thread context of 4248	1524	winupdate.exe	115
PID 3648 set thread context of 4136	3648	winupdate.exe	117
PID 3432 set thread context of 3676	3432	winupdate.exe	119
PID 2620 set thread context of 3772	2620	winupdate.exe	121

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_[DL] Top.Rated.Software.September.20.2008.Pack-DLFT .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nzm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nzm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1740	nzm.exe
4368	winupdate.exe
4176	winupdate.exe
1776	winupdate.exe
2996	winupdate.exe
3356	winupdate.exe
3300	winupdate.exe
1524	winupdate.exe
3648	winupdate.exe
3432	winupdate.exe
2620	winupdate.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 1740	3284	jaffacakes118_[DL] Top.Rated.Software.September.20.2008.Pack-DLFT .exe	87
PID 3284 wrote to memory of 1844	3284	jaffacakes118_[DL] Top.Rated.Software.September.20.2008.Pack-DLFT .exe	88
PID 1740 wrote to memory of 2488	1740	nzm.exe	90
PID 1740 wrote to memory of 2488	1740	nzm.exe	90
PID 1740 wrote to memory of 2488	1740	nzm.exe	90
PID 1740 wrote to memory of 2488	1740	nzm.exe	90
PID 1740 wrote to memory of 2488	1740	nzm.exe	90
PID 2488 wrote to memory of 4368	2488	nzm.exe	91
PID 4368 wrote to memory of 1256	4368	winupdate.exe	92
PID 4368 wrote to memory of 1256	4368	winupdate.exe	92
PID 4368 wrote to memory of 1256	4368	winupdate.exe	92
PID 4368 wrote to memory of 1256	4368	winupdate.exe	92
PID 4368 wrote to memory of 1256	4368	winupdate.exe	92
PID 1256 wrote to memory of 4176	1256	winupdate.exe	99
PID 4176 wrote to memory of 3852	4176	winupdate.exe	100
PID 4176 wrote to memory of 3852	4176	winupdate.exe	100
PID 4176 wrote to memory of 3852	4176	winupdate.exe	100
PID 4176 wrote to memory of 3852	4176	winupdate.exe	100
PID 4176 wrote to memory of 3852	4176	winupdate.exe	100
PID 3852 wrote to memory of 1776	3852	winupdate.exe	105
PID 1776 wrote to memory of 2988	1776	winupdate.exe	106
PID 1776 wrote to memory of 2988	1776	winupdate.exe	106
PID 1776 wrote to memory of 2988	1776	winupdate.exe	106
PID 1776 wrote to memory of 2988	1776	winupdate.exe	106
PID 1776 wrote to memory of 2988	1776	winupdate.exe	106
PID 2988 wrote to memory of 2996	2988	winupdate.exe	107
PID 2996 wrote to memory of 452	2996	winupdate.exe	108
PID 2996 wrote to memory of 452	2996	winupdate.exe	108
PID 2996 wrote to memory of 452	2996	winupdate.exe	108
PID 2996 wrote to memory of 452	2996	winupdate.exe	108
PID 2996 wrote to memory of 452	2996	winupdate.exe	108
PID 452 wrote to memory of 3356	452	winupdate.exe	110
PID 3356 wrote to memory of 4688	3356	winupdate.exe	111
PID 3356 wrote to memory of 4688	3356	winupdate.exe	111
PID 3356 wrote to memory of 4688	3356	winupdate.exe	111
PID 3356 wrote to memory of 4688	3356	winupdate.exe	111
PID 3356 wrote to memory of 4688	3356	winupdate.exe	111
PID 4688 wrote to memory of 3300	4688	winupdate.exe	112
PID 3300 wrote to memory of 1364	3300	winupdate.exe	113
PID 3300 wrote to memory of 1364	3300	winupdate.exe	113
PID 3300 wrote to memory of 1364	3300	winupdate.exe	113
PID 3300 wrote to memory of 1364	3300	winupdate.exe	113
PID 3300 wrote to memory of 1364	3300	winupdate.exe	113
PID 1364 wrote to memory of 1524	1364	winupdate.exe	114
PID 1524 wrote to memory of 4248	1524	winupdate.exe	115
PID 1524 wrote to memory of 4248	1524	winupdate.exe	115
PID 1524 wrote to memory of 4248	1524	winupdate.exe	115
PID 1524 wrote to memory of 4248	1524	winupdate.exe	115
PID 1524 wrote to memory of 4248	1524	winupdate.exe	115
PID 4248 wrote to memory of 3648	4248	winupdate.exe	116
PID 3648 wrote to memory of 4136	3648	winupdate.exe	117
PID 3648 wrote to memory of 4136	3648	winupdate.exe	117
PID 3648 wrote to memory of 4136	3648	winupdate.exe	117
PID 3648 wrote to memory of 4136	3648	winupdate.exe	117
PID 3648 wrote to memory of 4136	3648	winupdate.exe	117
PID 4136 wrote to memory of 3432	4136	winupdate.exe	118
PID 3432 wrote to memory of 3676	3432	winupdate.exe	119
PID 3432 wrote to memory of 3676	3432	winupdate.exe	119
PID 3432 wrote to memory of 3676	3432	winupdate.exe	119
PID 3432 wrote to memory of 3676	3432	winupdate.exe	119
PID 3432 wrote to memory of 3676	3432	winupdate.exe	119
PID 3676 wrote to memory of 2620	3676	winupdate.exe	120
PID 2620 wrote to memory of 3772	2620	winupdate.exe	121
PID 2620 wrote to memory of 3772	2620	winupdate.exe	121

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_[DL] Top.Rated.Software.September.20.2008.Pack-DLFT .exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_[DL] Top.Rated.Software.September.20.2008.Pack-DLFT .exe"
1⤵
- Looks for VMWare drivers on disk
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Users\Admin\AppData\Local\Temp\nzm.exe
  "C:\Users\Admin\AppData\Local\Temp\nzm.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Users\Admin\AppData\Local\Temp\nzm.exe
    C:\Users\Admin\AppData\Local\Temp\nzm.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Windows\SysWOW64\winupdate.exe
      C:\Windows\system32\winupdate.exe 1120 "C:\Users\Admin\AppData\Local\Temp\nzm.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4368
    - - C:\Windows\SysWOW64\winupdate.exe
        
        C:\Windows\SysWOW64\winupdate.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1256
      - C:\Windows\SysWOW64\winupdate.exe
        
        C:\Windows\system32\winupdate.exe 1148 "C:\Windows\SysWOW64\winupdate.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4176
        
        C:\Windows\SysWOW64\winupdate.exe
        
        C:\Windows\SysWOW64\winupdate.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3852
        
        C:\Windows\SysWOW64\winupdate.exe
        
        C:\Windows\system32\winupdate.exe 1120 "C:\Windows\SysWOW64\winupdate.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1776
        
        C:\Windows\SysWOW64\winupdate.exe
        
        C:\Windows\SysWOW64\winupdate.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\SysWOW64\winupdate.exe
        
        C:\Windows\system32\winupdate.exe 1120 "C:\Windows\SysWOW64\winupdate.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Windows\SysWOW64\winupdate.exe
        
        C:\Windows\SysWOW64\winupdate.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Windows\SysWOW64\winupdate.exe
        
        C:\Windows\system32\winupdate.exe 1120 "C:\Windows\SysWOW64\winupdate.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3356
        
        C:\Windows\SysWOW64\winupdate.exe
        
        C:\Windows\SysWOW64\winupdate.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4688
        
        C:\Windows\SysWOW64\winupdate.exe
        
        C:\Windows\system32\winupdate.exe 1120 "C:\Windows\SysWOW64\winupdate.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3300
        
        C:\Windows\SysWOW64\winupdate.exe
        
        C:\Windows\SysWOW64\winupdate.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1364
        
        C:\Windows\SysWOW64\winupdate.exe
        
        C:\Windows\system32\winupdate.exe 1120 "C:\Windows\SysWOW64\winupdate.exe"
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1524
        
        C:\Windows\SysWOW64\winupdate.exe
        
        C:\Windows\SysWOW64\winupdate.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4248
        
        C:\Windows\SysWOW64\winupdate.exe
        
        C:\Windows\system32\winupdate.exe 1124 "C:\Windows\SysWOW64\winupdate.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3648
        
        C:\Windows\SysWOW64\winupdate.exe
        
        C:\Windows\SysWOW64\winupdate.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4136
        
        C:\Windows\SysWOW64\winupdate.exe
        
        C:\Windows\system32\winupdate.exe 1120 "C:\Windows\SysWOW64\winupdate.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Windows\SysWOW64\winupdate.exe
        
        C:\Windows\SysWOW64\winupdate.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3676
        
        C:\Windows\SysWOW64\winupdate.exe
        
        C:\Windows\system32\winupdate.exe 1120 "C:\Windows\SysWOW64\winupdate.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2620
        
        C:\Windows\SysWOW64\winupdate.exe
        
        C:\Windows\SysWOW64\winupdate.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3772
- C:\Users\Admin\AppData\Local\Temp\Keygen.exe
  "C:\Users\Admin\AppData\Local\Temp\Keygen.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1844

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x494 0x410
1⤵
PID:2332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Keygen.exe

Path C:\Users\Admin\AppData\Local\Temp\Keygen.exe
Size 52KB
SHA256 7cae62ba19a7f198b5e9a7c59e31a0d5b75382baba416e3b18e20bc41a5a66e0
MD5 b1fc14eeb478a72a39abbe8c5385b2b8
SHA1 db45472bbfeeb2976ba1815aca861b96e9d2b5b6
SHA512 2b8ba6cd545032bb6cc2ead734372b2e3c238ca69ed6103267f257011097c03aa7a5b526bd35b4fd5ae9ef2454f57cee26dfa87d38a46c3c5812ef9d77ef952c
SSDEEP 1536:h9O+ysIXQZzLWTkz6e4y+p299EuIOsLmR:/uXQZ/WTkz6a+8DINs
TLSH
T17933E046E9DDD049E72181B30F63CB2CC68EAE0510489A27B79C76597FB3B8B47CA51C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bassmod.dll

Path C:\Users\Admin\AppData\Local\Temp\bassmod.dll
Size 9KB
SHA256 844eb66a10b848d3a71a8c63c35f0a01550a46d2ff8503e2ca8947978b03b4d2
MD5 780d14604d49e3c634200c523def8351
SHA1 e208ef6f421d2260070a9222f1f918f1de0a8eeb
SHA512 a49c030f11da8f0cdc4205c86bec00653ec2f8899983cad9d7195fd23255439291aaec5a7e128e1a103efd93b8566e86f15af89eba4efebf9debce14a7a5564b
SSDEEP 192:Yjtr1Et860Vu6tAo2j+feMnkqtDXuulsa7k0yRlm7/Pdl:AtU8Zu6K+feJCuwsL00la/Pd
TLSH
T19D127C8596D008B2C16E2070DAD579ADA77B75E00AC9EF436ED309A48CCEF63DC8C706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nzm.exe

Path C:\Users\Admin\AppData\Local\Temp\nzm.exe
Size 280KB
SHA256 1d22e37a8b0bc15b7b0873f8783846086b688853dc1935382ffbfa83e3e99ff0
MD5 630a85990935eb25ccb37f0649ec3dd6
SHA1 157ccac4c30add444168813964304f63963a5c2e
SHA512 b456a561ab94d265ca07a077d626fc529cdcfe99fba5325de136992cc38cbc9798e647a62d233030dbe5401606bc3748c161a032429f0b8aab81ce7eca5c1e97
SSDEEP 6144:Ppp8ArbPiWPThRjkO9Y5DakT3mPN1shm/h:PECbPiWPAOqlxmPZ5
TLSH
T1A754DFE122B30825E214E9B1D4916FE02742DE9D6AFEC722046B1E739470E91FD9DF27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/452-82-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/1256-50-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/1364-103-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/1844-48-0x0000000000400000-0x000000000048B000-memory.dmp

Download

memory/1844-23-0x0000000000400000-0x000000000048B000-memory.dmp

Download

memory/2488-44-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/2488-33-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/2488-32-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/2488-29-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/2988-71-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/3284-0-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/3284-24-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/3284-1-0x000000000041B000-0x000000000041C000-memory.dmp

Download

memory/3676-135-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/3852-60-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/4136-124-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/4248-114-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/4688-92-0x0000000000400000-0x000000000051B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads