Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 04:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Daemon Tools Pro 4.10.0215_wk5cavdp.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Daemon Tools Pro 4.10.0215_wk5cavdp.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target jaffacakes118_Daemon Tools Pro 4.10.0215_wk5cavdp.exe
- Size 850KB
- Sample260910-fgclwaybqe
- SHA256 e4e22dd1cdeb4be9c8499c2182bb7a90cf869f9d634cfe6b3f9d79fd07c8870b
- MD5 62d3775d4d36bd66aee87f5d4fa44a90
- SHA1 00b9a5385703b8209094178c2cd68dfea41c668d
- SHA512 d94352adf25516dca5ee7c5b3f8e1d9a7d61bde083ddfe114966491b0f505dec8f806668b781a805c653f96ee5f11ffd2a70a51a117da77e65438a91a8e5060d
- SSDEEP 6144:inXM5ywIYkIEzb/wq1g/dGXdv40QyBG65m2K:inA/Ezbr1MdG9SyR5pK
- TLSH T1EC057C71B4C23977E2D6FCF32268DA6452F05C468A4EA901C0717FD089B2663DF95E1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 4152 proxy.exe 2360 proxy.exe 4932 proxy.exe 3760 proxy.exe - Loads dropped DLL 2 IoCs
pid Process 2360 proxy.exe 2360 proxy.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internet = "C:\\Program Files (x86)\\proxy.exe" proxy.exe Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\internet = "C:\\Program Files (x86)\\proxy.exe" proxy.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\MSWINSCK.ocx jaffacakes118_Daemon Tools Pro 4.10.0215_wk5cavdp.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 5644 set thread context of 4732 5644 jaffacakes118_Daemon Tools Pro 4.10.0215_wk5cavdp.exe 89 PID 4152 set thread context of 2360 4152 proxy.exe 91 PID 4932 set thread context of 3760 4932 proxy.exe 94 -
resource yara_rule behavioral2/memory/4732-2-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/memory/4732-4-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/memory/4732-7-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/memory/2360-25-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/memory/4732-26-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/memory/2360-38-0x0000000000400000-0x0000000000440000-memory.dmp upx - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\proxy.exe jaffacakes118_Daemon Tools Pro 4.10.0215_wk5cavdp.exe File opened for modification C:\Program Files (x86)\proxy.exe jaffacakes118_Daemon Tools Pro 4.10.0215_wk5cavdp.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language proxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Daemon Tools Pro 4.10.0215_wk5cavdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Daemon Tools Pro 4.10.0215_wk5cavdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language proxy.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{39977C62-C383-463D-AF61-C71220634656}\AlternateCLSID = "{6E5311A1-325D-4FFD-9AF4-B373F02AE458}" proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} proxy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Compatibility Flags = "1024" proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\AlternateCLSID = "{6E5311A1-325D-4FFD-9AF4-B373F02AE458}" proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{39977C62-C383-463D-AF61-C71220634656} proxy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{39977C62-C383-463D-AF61-C71220634656}\Compatibility Flags = "1024" proxy.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458} proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\MiscStatus\ = "0" proxy.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\CONTROL proxy.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{39977C62-C383-463D-AF61-C71220634656}\CONTROL proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\VersionIndependentProgID\ = "MSWinsock.Winsock" proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\Implemented Categories proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{39977C62-C383-463D-AF61-C71220634656}" proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\Control proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0 (SP6)" proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0 (SP6)" proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\MiscStatus\1 proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\ProgID\ = "MSWinsock.Winsock.1" proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\Version proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\ proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\Implemented Categories proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0 proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\MiscStatus\1\ = "132497" proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656} proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\InprocServer32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx" proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\VersionIndependentProgID\ = "MSWinsock.Winsock" proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\Version\ = "1.0" proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\TypeLib proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\InprocServer32 proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\VersionIndependentProgID proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment" proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\Programmable proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\ToolboxBitmap32 proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32 proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1" proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\TypeLib proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx, 1" proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx" proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32 proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\ = "Microsoft WinSock Control, version 6.0 (SP6)" proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\InprocServer32\ThreadingModel = "Apartment" proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39977C62-C383-463D-AF61-C71220634656}\ProgID proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control proxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0 proxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" proxy.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4732 jaffacakes118_Daemon Tools Pro 4.10.0215_wk5cavdp.exe 2360 proxy.exe 3760 proxy.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 5644 wrote to memory of 4732 5644 jaffacakes118_Daemon Tools Pro 4.10.0215_wk5cavdp.exe 89 PID 5644 wrote to memory of 4732 5644 jaffacakes118_Daemon Tools Pro 4.10.0215_wk5cavdp.exe 89 PID 5644 wrote to memory of 4732 5644 jaffacakes118_Daemon Tools Pro 4.10.0215_wk5cavdp.exe 89 PID 5644 wrote to memory of 4732 5644 jaffacakes118_Daemon Tools Pro 4.10.0215_wk5cavdp.exe 89 PID 5644 wrote to memory of 4732 5644 jaffacakes118_Daemon Tools Pro 4.10.0215_wk5cavdp.exe 89 PID 4732 wrote to memory of 4152 4732 jaffacakes118_Daemon Tools Pro 4.10.0215_wk5cavdp.exe 90 PID 4152 wrote to memory of 2360 4152 proxy.exe 91 PID 4152 wrote to memory of 2360 4152 proxy.exe 91 PID 4152 wrote to memory of 2360 4152 proxy.exe 91 PID 4152 wrote to memory of 2360 4152 proxy.exe 91 PID 4152 wrote to memory of 2360 4152 proxy.exe 91 PID 4932 wrote to memory of 3760 4932 proxy.exe 94 PID 4932 wrote to memory of 3760 4932 proxy.exe 94 PID 4932 wrote to memory of 3760 4932 proxy.exe 94 PID 4932 wrote to memory of 3760 4932 proxy.exe 94 PID 4932 wrote to memory of 3760 4932 proxy.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Daemon Tools Pro 4.10.0215_wk5cavdp.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Daemon Tools Pro 4.10.0215_wk5cavdp.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Daemon Tools Pro 4.10.0215_wk5cavdp.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Daemon Tools Pro 4.10.0215_wk5cavdp.exe"2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Program Files (x86)\proxy.exe"C:\Program Files (x86)\proxy.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Program Files (x86)\proxy.exe"C:\Program Files (x86)\proxy.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2360
-
-
-
-
C:\Program Files (x86)\proxy.exe"C:\Program Files (x86)\proxy.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Program Files (x86)\proxy.exe"C:\Program Files (x86)\proxy.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3760
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\proxy.exe
- Size 850KB
- SHA256 e4e22dd1cdeb4be9c8499c2182bb7a90cf869f9d634cfe6b3f9d79fd07c8870b
- MD5 62d3775d4d36bd66aee87f5d4fa44a90
- SHA1 00b9a5385703b8209094178c2cd68dfea41c668d
- SHA512 d94352adf25516dca5ee7c5b3f8e1d9a7d61bde083ddfe114966491b0f505dec8f806668b781a805c653f96ee5f11ffd2a70a51a117da77e65438a91a8e5060d
- SSDEEP 6144:inXM5ywIYkIEzb/wq1g/dGXdv40QyBG65m2K:inA/Ezbr1MdG9SyR5pK
- TLSH T1EC057C71B4C23977E2D6FCF32268DA6452F05C468A4EA901C0717FD089B2663DF95E1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\mswinsck.ocx
- Size 124KB
- SHA256 a0bf5f1ed8d34fd0b6cb1432618986f90256ef4f8c86a1460823e6dfa8edd8ca
- MD5 40fce4be52f6015c23fd96a4b3351357
- SHA1 f4a23cee42125f20444a4b005555d631df2aaacf
- SHA512 69f7a8c8a5e82a2c975e410d834aa24ed0b1a32f592fb85eac15b8d3c1bee2dc1c1c88c0dbba0435339cde92e437efebf66c7c15dde1153338b4bd3e536fc922
- SSDEEP 3072:0FC6rqnaHjlH2czX/t9VO5XJicR4Wp/J3HA3+CZYZ1c:0FClQhH9VDcRfDoCc
- TLSH T10DC35A02B3E8C136E5A21B351A367B68AEF9FC316D31C94B5344764D4D31A92EE3931B
- MD5 SHA1 SHA512 SSDEEP TLSH