51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391

Analysis

max time kernel
149s
max time network
20s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe
Size 21KB
Sample260924-ebmn8azz7j
SHA256 51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391
MD5 8ed149b773c5dda219a7b689afe65dec
SHA1 9b9d50740af99c17bef780d763ea3f935be03a71
SHA512 dc48718be6c08d970cc9d4283b59378a9a8c403c9c7e59fb279b2996fde2994869c69465ef19bacd7f0b149b7550e53ad8667781330c26f1ede8f61720b2bc25
SSDEEP 384:JHGcKp+cr2fB9sARG3tfVnJ1HdOYYE1zW/rR:w9wcr2fkARktnD9DYNrR
TLSH
T194A2398A128FC685E21B6B7417F28403FA22BC9034F84D71959E7B5F90DD252C6FEE25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation upx

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
860	netsh.exe
4876	netsh.exe

Executes dropped EXE 3 IoCs

pid	Process
3584	sysvx_.exe
2532	sysvx.exe
2164	sysvx.exe

Loads dropped DLL 38 IoCs

pid	Process
2628	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe
2628	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe
860	netsh.exe
860	netsh.exe
3584	sysvx_.exe
3584	sysvx_.exe
4876	netsh.exe
4876	netsh.exe
3412	WerFault.exe
3924	WerFault.exe
3924	WerFault.exe
304	WerFault.exe
304	WerFault.exe
272	WerFault.exe
1576	svchost.exe
5840	WerFault.exe
1460	WerFault.exe
5384	svchost.exe
2276	WerFault.exe
5220	WerFault.exe
5220	WerFault.exe
624	svchost.exe
5548	WerFault.exe
4656	WerFault.exe
5132	svchost.exe
3520	WerFault.exe
3520	WerFault.exe
5544	WerFault.exe
5544	WerFault.exe
5916	svchost.exe
1232	WerFault.exe
1232	WerFault.exe
2948	WerFault.exe
5564	svchost.exe
5564	svchost.exe
472	WerFault.exe
472	WerFault.exe
4256	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sysvx = "C:\\Windows\\sysvx_.exe"	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sysvx = "C:\\Windows\\sysvx_.exe"	sysvx_.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\comdlg64.dll	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe
File opened for modification	C:\Windows\SysWOW64\sysvx.exe	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe
File opened for modification	C:\Windows\SysWOW64\comdlg64.dll	sysvx_.exe
File opened for modification	C:\Windows\SysWOW64\sysvx.exe	sysvx_.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 2628 set thread context of 1220	2628	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe	104
PID 3584 set thread context of 5948	3584	sysvx_.exe	105
PID 2628 set thread context of 1576	2628	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe	106
PID 3584 set thread context of 5384	3584	sysvx_.exe	107
PID 2628 set thread context of 624	2628	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe	118
PID 3584 set thread context of 5132	3584	sysvx_.exe	123
PID 2628 set thread context of 5916	2628	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe	128
PID 3584 set thread context of 5564	3584	sysvx_.exe	133

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c5b5-13.dat	upx
behavioral2/memory/2532-43-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2532-61-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2164-62-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\sysvx_.exe	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe
File created	C:\Windows\sysvx_.exe	sysvx_.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 16 IoCs

pid	pid_target	Process	procid_target
3412	860	WerFault.exe	89
3924	4876	WerFault.exe	93
272	3412	WerFault.exe	97
304	3924	WerFault.exe	99
5840	1576	WerFault.exe	106
1460	5840	WerFault.exe	111
2276	5384	WerFault.exe	107
5220	2276	WerFault.exe	115
5548	624	WerFault.exe	118
4656	5548	WerFault.exe	120
3520	5132	WerFault.exe	123
5544	3520	WerFault.exe	125
1232	5916	WerFault.exe	128
2948	1232	WerFault.exe	130
472	5564	WerFault.exe	133
4256	472	WerFault.exe	135

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysvx_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysvx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysvx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2628	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe
2628	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe
3584	sysvx_.exe
3584	sysvx_.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2628	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe
3584	sysvx_.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 860	2628	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe	89
PID 3584 wrote to memory of 4876	3584	sysvx_.exe	93
PID 2628 wrote to memory of 1220	2628	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe	104
PID 2628 wrote to memory of 1220	2628	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe	104
PID 3584 wrote to memory of 5948	3584	sysvx_.exe	105
PID 3584 wrote to memory of 5948	3584	sysvx_.exe	105
PID 2628 wrote to memory of 1576	2628	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe	106
PID 2628 wrote to memory of 1576	2628	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe	106
PID 3584 wrote to memory of 5384	3584	sysvx_.exe	107
PID 3584 wrote to memory of 5384	3584	sysvx_.exe	107
PID 1220 wrote to memory of 2532	1220	svchost.exe	108
PID 5948 wrote to memory of 2164	5948	svchost.exe	109
PID 2628 wrote to memory of 624	2628	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe	118
PID 2628 wrote to memory of 624	2628	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe	118
PID 3584 wrote to memory of 5132	3584	sysvx_.exe	123
PID 3584 wrote to memory of 5132	3584	sysvx_.exe	123
PID 2628 wrote to memory of 5916	2628	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe	128
PID 2628 wrote to memory of 5916	2628	jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe	128
PID 3584 wrote to memory of 5564	3584	sysvx_.exe	133
PID 3584 wrote to memory of 5564	3584	sysvx_.exe	133

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall set allowedprogram "C:\Windows\system32\sysvx.exe" enable
  2⤵
  - Modifies Windows Firewall
  - Loads dropped DLL
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 1032
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:3412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 740
      4⤵
      Loads dropped DLL
      Program crash
      PID:272
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\SysWOW64\sysvx.exe
    C:\Windows\system32\sysvx.exe 8106
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2532
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 936
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:5840
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 736
      4⤵
      Loads dropped DLL
      Program crash
      PID:1460
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 936
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:5548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 736
      4⤵
      Loads dropped DLL
      Program crash
      PID:4656
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 936
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 736
      4⤵
      Loads dropped DLL
      Program crash
      PID:2948

C:\Windows\sysvx_.exe
C:\Windows\sysvx_.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall set allowedprogram "C:\Windows\system32\sysvx.exe" enable
  2⤵
  - Modifies Windows Firewall
  - Loads dropped DLL
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 1028
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:3924
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 740
      4⤵
      Loads dropped DLL
      Program crash
      PID:304
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5948
- - C:\Windows\SysWOW64\sysvx.exe
    C:\Windows\system32\sysvx.exe 16554
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2164
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5384 -s 936
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2276
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 740
      4⤵
      Loads dropped DLL
      Program crash
      PID:5220
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 936
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:3520
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 736
      4⤵
      Loads dropped DLL
      Program crash
      PID:5544
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5564 -s 936
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:472
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 472 -s 736
      4⤵
      Loads dropped DLL
      Program crash
      PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 860 -ip 860
1⤵
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4876 -ip 4876
1⤵
PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3412 -ip 3412
1⤵
PID:2936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3924 -ip 3924
1⤵
PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1576 -ip 1576
1⤵
PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5840 -ip 5840
1⤵
PID:1880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5384 -ip 5384
1⤵
PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2276 -ip 2276
1⤵
PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 624 -ip 624
1⤵
PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5548 -ip 5548
1⤵
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5132 -ip 5132
1⤵
PID:2516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3520 -ip 3520
1⤵
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5916 -ip 5916
1⤵
PID:476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1232 -ip 1232
1⤵
PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5564 -ip 5564
1⤵
PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 472 -ip 472
1⤵
PID:1136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

comdlg64.dll

Path C:\Windows\SysWOW64\comdlg64.dll
Size 4KB
SHA256 3a6a246451caa83b235c81d638f2ee18ef33b34ac123a0e78480b33d47ec7134
MD5 863a035c1aff56a069c3a688da858578
SHA1 225a29ab2f5cd5730efadc3f21b10d0a8047e870
SHA512 4e6cdcaddaceb9d9fd779200162054a6ed5b79e99a64a2e4344fe9924b200c660e269be7a9e43dc057b299ae01bdd237c183d70adb141b340c011ac15fab7b96
SSDEEP 48:ZhtizAK0TEUITeLOjeK0JnRkKGDnjtdr5u5fi1be8qBfxY:ZHqd3etFuKEjbrAmelBfxY
TLSH
T169A1A4A21B512FA7C464C6F03FDA56F765EC51250E7F0F405E7A721B6C4F2129C60807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sysvx.exe

Path C:\Windows\SysWOW64\sysvx.exe
Size 6KB
SHA256 8b61b0f5aee2b688d0148496a904e610e8c6268936262582b7fddff9c1bbd0ea
MD5 395ac4de40a8cbe0317931ee4fcaa717
SHA1 9c6d2ad56f5c432d63c0340ed0ab4676f9a7671d
SHA512 66cafca61720fea389ceda23bcab3da07774f7ab236f841bc139b0a46355a6eae856779636723b6a4e02070ec5b7afd0451ad42fc225477e11c451853cb6223c
SSDEEP 96:LZ0ghxdySVUOgOxLxfAlIehRsX6hV1FM0fywR4PnmFhdxXtwZXNIR:t7gNlnEX6l+wCPmFhbqlM
TLSH
T1E7D138A2AD024AC8CC4F44794DF74D4938E8780023A074045BFE63E7F55B2568DBB6C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sysvx_.exe

Path C:\Windows\sysvx_.exe
Size 21KB
SHA256 51e95e30ec92a8a7a0726d1ed19e1968125eae919f511f7e7e6c7f21d25b1391
MD5 8ed149b773c5dda219a7b689afe65dec
SHA1 9b9d50740af99c17bef780d763ea3f935be03a71
SHA512 dc48718be6c08d970cc9d4283b59378a9a8c403c9c7e59fb279b2996fde2994869c69465ef19bacd7f0b149b7550e53ad8667781330c26f1ede8f61720b2bc25
SSDEEP 384:JHGcKp+cr2fB9sARG3tfVnJ1HdOYYE1zW/rR:w9wcr2fkARktnD9DYNrR
TLSH
T194A2398A128FC685E21B6B7417F28403FA22BC9034F84D71959E7B5F90DD252C6FEE25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/624-76-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/860-12-0x0000000000CB0000-0x0000000000CB6000-memory.dmp

Download

memory/860-30-0x0000000000CB0000-0x0000000000CB6000-memory.dmp

Download

memory/1220-39-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/1576-57-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/1576-46-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/2164-62-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/2532-61-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/2532-43-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/2628-151-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2628-121-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2628-139-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2628-133-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2628-33-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2628-145-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2628-51-0x00000000005D0000-0x00000000005D6000-memory.dmp

Download

memory/2628-50-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2628-127-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2628-0-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2628-29-0x00000000005D0000-0x00000000005D6000-memory.dmp

Download

memory/2628-92-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2628-157-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2628-115-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2628-67-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2628-114-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2628-8-0x00000000005D0000-0x00000000005D6000-memory.dmp

Download

memory/2628-81-0x00000000005D0000-0x00000000005D6000-memory.dmp

Download

memory/2628-107-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3584-36-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3584-123-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3584-159-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3584-95-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3584-18-0x00000000004F0000-0x00000000004F6000-memory.dmp

Download

memory/3584-84-0x00000000004F0000-0x00000000004F6000-memory.dmp

Download

memory/3584-109-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3584-69-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3584-153-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3584-117-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3584-56-0x00000000004F0000-0x00000000004F6000-memory.dmp

Download

memory/3584-97-0x00000000004F0000-0x00000000004F6000-memory.dmp

Download

memory/3584-55-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3584-129-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3584-147-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3584-135-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3584-31-0x00000000004F0000-0x00000000004F6000-memory.dmp

Download

memory/3584-141-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/4876-35-0x0000000000EA0000-0x0000000000EA6000-memory.dmp

Download

memory/4876-21-0x0000000000EA0000-0x0000000000EA6000-memory.dmp

Download

memory/5384-63-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/5564-106-0x0000000000730000-0x0000000000736000-memory.dmp

Download

memory/5564-98-0x0000000000730000-0x0000000000736000-memory.dmp

Download

memory/5948-40-0x00000000010A0000-0x00000000010A1000-memory.dmp

Download