35fccf7111c29d2468a082c6e9457d574843a74bf463fbe433ec5bcd0f17f838

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Agent.isud.exe
Size 219KB
Sample261006-te9eqaav81
SHA256 35fccf7111c29d2468a082c6e9457d574843a74bf463fbe433ec5bcd0f17f838
MD5 17e1c68780e40776c96487cc357b64f9
SHA1 cec927cad2e5c17b54a9ff91ff78e57879e20e95
SHA512 f2333631370666bf6f75f6eff57eb11878c9271665074ad84234b1372e6849dfae47b563c2c6d21cf7e30a16eb99bd2acb56193740711da1917e97371eb0caf8
SSDEEP 3072:WzW+DiC9iLo+GnHT5GWp1icKAArDZz4N9GhbkrNEk11L/YZfOq+Vyvwm0Wj:RKwLo7xp0yN90QEYL/M2qTox
TLSH
T13D24D012A2D08136D4F527B054FE13931B39BCB15F78C3AB5381799E5C32AC4A93A76B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1964	DISABL~1.EXE
5692	ADOBE-~1.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	jaffacakes118_Trojan-Dropper.Win32.Agent.isud.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c656-5.dat	upx
behavioral2/memory/1964-7-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/1964-42-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
396	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Agent.isud.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DISABL~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADOBE-~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1964	1832	jaffacakes118_Trojan-Dropper.Win32.Agent.isud.exe	89
PID 1964 wrote to memory of 396	1964	DISABL~1.EXE	92
PID 396 wrote to memory of 2516	396	cmd.exe	93
PID 396 wrote to memory of 5972	396	cmd.exe	94
PID 396 wrote to memory of 2928	396	cmd.exe	95
PID 396 wrote to memory of 5768	396	cmd.exe	96
PID 396 wrote to memory of 5916	396	cmd.exe	97
PID 396 wrote to memory of 5012	396	cmd.exe	98
PID 396 wrote to memory of 548	396	cmd.exe	99
PID 396 wrote to memory of 4300	396	cmd.exe	100
PID 396 wrote to memory of 2620	396	cmd.exe	101
PID 396 wrote to memory of 5440	396	cmd.exe	102
PID 396 wrote to memory of 5744	396	cmd.exe	103
PID 396 wrote to memory of 1960	396	cmd.exe	104
PID 396 wrote to memory of 3744	396	cmd.exe	105
PID 396 wrote to memory of 4720	396	cmd.exe	106
PID 396 wrote to memory of 3292	396	cmd.exe	107
PID 396 wrote to memory of 708	396	cmd.exe	108
PID 1832 wrote to memory of 5692	1832	jaffacakes118_Trojan-Dropper.Win32.Agent.isud.exe	109

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.isud.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.isud.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DISABL~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DISABL~1.EXE
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\85B1.tmp\disable_activation.cmd""
    3⤵
    - Drops file in Drivers directory
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:396
  - - C:\Windows\SysWOW64\find.exe
      FIND /C /I "fuckup" C:\Windows\system32\drivers\etc\hosts
      4⤵
      System Location Discovery: System Language Discovery
      PID:2516
  - - C:\Windows\SysWOW64\find.exe
      FIND /C /I "ereg.adobe.com" C:\Windows\system32\drivers\etc\hosts
      4⤵
      System Location Discovery: System Language Discovery
      PID:5972
  - - C:\Windows\SysWOW64\find.exe
      FIND /C /I "activate.wip3.adobe.com" C:\Windows\system32\drivers\etc\hosts
      4⤵
      System Location Discovery: System Language Discovery
      PID:2928
  - - C:\Windows\SysWOW64\find.exe
      FIND /C /I "wip3.adobe.com" C:\Windows\system32\drivers\etc\hosts
      4⤵
      System Location Discovery: System Language Discovery
      PID:5768
  - - C:\Windows\SysWOW64\find.exe
      FIND /C /I "3dns-3.adobe.com" C:\Windows\system32\drivers\etc\hosts
      4⤵
      System Location Discovery: System Language Discovery
      PID:5916
  - - C:\Windows\SysWOW64\find.exe
      FIND /C /I "3dns-2.adobe.com" C:\Windows\system32\drivers\etc\hosts
      4⤵
      System Location Discovery: System Language Discovery
      PID:5012
  - - C:\Windows\SysWOW64\find.exe
      FIND /C /I "adobe-dns.adobe.com" C:\Windows\system32\drivers\etc\hosts
      4⤵
      System Location Discovery: System Language Discovery
      PID:548
  - - C:\Windows\SysWOW64\find.exe
      FIND /C /I "adobe-dns-2.adobe.com" C:\Windows\system32\drivers\etc\hosts
      4⤵
      System Location Discovery: System Language Discovery
      PID:4300
  - - C:\Windows\SysWOW64\find.exe
      FIND /C /I "adobe-dns-3.adobe.com" C:\Windows\system32\drivers\etc\hosts
      4⤵
      System Location Discovery: System Language Discovery
      PID:2620
  - - C:\Windows\SysWOW64\find.exe
      FIND /C /I "ereg.wip3.adobe.com" C:\Windows\system32\drivers\etc\hosts
      4⤵
      System Location Discovery: System Language Discovery
      PID:5440
  - - C:\Windows\SysWOW64\find.exe
      FIND /C /I "activate-sea.adobe.com" C:\Windows\system32\drivers\etc\hosts
      4⤵
      System Location Discovery: System Language Discovery
      PID:5744
  - - C:\Windows\SysWOW64\find.exe
      FIND /C /I "wwis-dubc1-vip60.adobe.com" C:\Windows\system32\drivers\etc\hosts
      4⤵
      System Location Discovery: System Language Discovery
      PID:1960
  - - C:\Windows\SysWOW64\find.exe
      FIND /C /I "activate-sjc0.adobe.com" C:\Windows\system32\drivers\etc\hosts
      4⤵
      System Location Discovery: System Language Discovery
      PID:3744
  - - C:\Windows\SysWOW64\find.exe
      FIND /C /I "adobeereg.com" C:\Windows\system32\drivers\etc\hosts
      4⤵
      System Location Discovery: System Language Discovery
      PID:4720
  - - C:\Windows\SysWOW64\find.exe
      FIND /C /I "activate.adobe.com" C:\Windows\system32\drivers\etc\hosts
      4⤵
      System Location Discovery: System Language Discovery
      PID:3292
  - - C:\Windows\SysWOW64\find.exe
      FIND /C /I "practivate.adobe.com" C:\Windows\system32\drivers\etc\hosts
      4⤵
      System Location Discovery: System Language Discovery
      PID:708
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADOBE-~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADOBE-~1.EXE
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

disable_activation.cmd

Path C:\Users\Admin\AppData\Local\Temp\85B1.tmp\disable_activation.cmd
Size 2KB
SHA256 1e5b0ede894f3ea1a1a1892122e7d9f1825df4d50e285afdcdf33f6eabd47e2d
MD5 dbf927a0779f6d6c18e5d616f2efb5d6
SHA1 e38d75f1f69c0c5dc094521717aeeb313b142b07
SHA512 c15f5d3a2eed93530a386277357201ef4541a603652f34a2a8107f548e047ecd6bfb50ccf1b872a954d5e8cc2f632e15fef39b279cceb1346d6c65247a8fd0bc
TLSH
T15951721D0F4EAF7995572000F15AF6FA6538B32542BAF690325F398BE1A114E8D32EF0
MD5 SHA1 SHA512 TLSH

Submit Download

ADOBE-~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADOBE-~1.EXE
Size 82KB
SHA256 d9da1f76a8fcf34be6b01ef18c6861b19bc18c88e67142367756771e5b316026
MD5 f84069273df09af21db948cc57f20ae6
SHA1 c6f56d33ff4e4c355ac9ab75ad04f0f47874e6bc
SHA512 c2c1de3593de95dab8015411a5407142a02c052771e233dedf8bc1bf435fe4f00e0844e8484ffc703bfdcd2b95ee30d441123d850fa218644cae62592aa9cff9
SSDEEP 1536://R/HOxmBLFZk96cARPXSnL5tAl353xG/xc:B/HOb9pLI353A/xc
TLSH
T1D3836D10F791D573C41A10784613DBA01E36F9312BD9CD93B7A99AFE4F712E07E2A24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DISABL~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DISABL~1.EXE
Size 22KB
SHA256 d5d4a5271054fabb6e888d97e8b08a13fb1b6312e9bed97301e06b8549f0ddf5
MD5 bc557f810828f344e6b31aa4656dc2ea
SHA1 42bcda258afcecfac2fc353cb2929b82ea5c54f4
SHA512 6c59ad772097b45c342c69e54c38a120d5ca8459926f6af2995743464327d554ec6bba3ea68b24cd6589f6774f6623f7a425a25fe18b904ba3fb00538a046f7e
SSDEEP 384:nbCEXMMADQIrUeNFwx9E5xtT6fkCMst8AdxIiv4dK8y8KG8szTO4Am7UnwtzwGkD:b1NAUsbxtT6sFst/3IrdlLUwDnbcuyDY
TLSH
T1FDA2C156C5EB8D26C34F017FA59FFA294D50230EE6698B5157EC312F0C15B98AC3E136
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 3f19aa55184e78b9dbb6337c3d39ba5357526254bb460bcbb43b45ae4b74eb93
MD5 63e96f979f791a45d049d6e5d294382c
SHA1 290a887f1c4aad17984488d59bf58e7b0637e07e
SHA512 3d5a30759a08ab6ec21b2eea22db99220c75e251a34be17cb48f3cc06bda42e73adbd2958ef14a0d5ed2f1112b0b41b4733126678236cf432c5737e1c6aba5c8
TLSH
T13B210D2A0649915D26B341E5086CB42FA31FC0EF0E3B8DCD3F8E440F7BA2A0C5322746
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 3ea17381729e7a7313d925594d303764b87f1112de53bf6bb01c1e86a5a06d1c
MD5 c4a9ab7fefb5e45f4f74b313713ddbe5
SHA1 cc90ff104601291313b546f021e91b1ac4f22c0b
SHA512 3a5fa66bebcec2f733a0727c1cb3f5b558edb2159f77bf81433f5cafe18a807209fa416b58dbb307467d69cb9732b1dbdf8474ccb6a3e8b83d925831c8d639e2
TLSH
T13521EE2A0649956D26B345E50868B42EA31FD0EF0A3BCDCD3F9E444F7BA2A0C5332746
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 ac0368ac664ab104ea25a42b2840dfa463f404ade9d9e040856e2fa8ea3f0d92
MD5 14a05ea4a3dafb2268ddac05ec8385ad
SHA1 19c58c2320eb1e7b1fd9254f3461cd96b9e444b3
SHA512 f96116d4da2fb3c8680565819de710ecb4cfac9c19244bc59666318267ab8f88ea3aace44142913a0abbd2786e580648b8b5e81f7ab11ac1ca25fa87d6848e85
TLSH
T11221F1260649956C25B345A50868B43EA31FD0EF0A2BC9CD3F9D440F7BA260C1332645
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 93a386d131279412b8c5f6a827892d1d9c79c65720c76b3bd492b087ea5f5944
MD5 e7d7016dae5968c7ef864d101f44f129
SHA1 81f0b1a63ef72b8fde14d969ac5d0035965863b0
SHA512 db4a65962f14aeae8e31ee8506f98d45a5b8f319d8307508cc2806f1c36074d135b0336f4d4ae995701a9fa9f5b72c928cac6ddb9ce54d23fae38d692bc1090b
TLSH
T13421DF2A0649956C25B345A50868B43EE31FD0EB0A6BC9CD3E9E844F7BA260C1362645
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 060d66ee746cae9f061143588592224970d877d2e62d25a84485ce0e7ac5c685
MD5 7b1dab164701adc2e78781f408f91ed3
SHA1 631490577ce351ab1b6689f6041ca2ec06ec3a20
SHA512 15b05d5f1a34e5a1776c1a3909937cd17208e07a0e20e9d0a90ebe5a59d5367aa4112747869e7b4c3fe29d6ea1f1dbbca1282f3feaf6e4dbec6c1dd3e89bb284
TLSH
T12821D22A0649556C25B345E508A8B43EF31FE0EB0E6BD9CD3E9E844F7BB260C1763685
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 b5e097ae55a8a892fdae9e90bcbc1a2af93479b2773a76411db0edb261de41a8
MD5 d3a55617558d39d14ec7c1c7b43187e9
SHA1 be58d6fbdb04d70359bed3c2a6a90bbcb7bc733e
SHA512 f72a5acc53decb01f49de404f14ea6745f08a3f8e7b787199eee21af3e549308be9fdd782bbb0e8cab9e636f5f78108d8b41c7082947c209ee5559fa71959d76
TLSH
T13A21E22A0649556D21B349A408A8B43EF31FE0EB0E6BD9C93A6E844F77B260C1762685
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 31c3c16bdd1ebb4d75c2d573338fbb6e433b96b591e3e5c2ed39f4ca20dc7a37
MD5 c18a2f86af0ffa736ca65d8cf964f729
SHA1 73f473c0a3f61c49a59f0d9ff8f8c126e0b9890f
SHA512 dc5115576db42d18199a78987c89ae6ee66f1b7e2f927ceb3af7374a8508d4cd7320b1f2b116363f08b06831bb9e8fae7e6b95f4ee575907ca133b342b2c3d35
TLSH
T1DC21153A0549556D217348A008B8B43EF31FF0EB0E6BD9C93A6E840F37B250C0762681
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 ae497dff522d19bbd2cd579f3099a0f0ca947e7ef61a69e60e99f033c76f680d
MD5 4469cb39075cd2a71d89db48b1f04eb5
SHA1 1c4206cdfad6904ae04b4c778da6bf7217415e20
SHA512 c346bb09e668a248095cb2d45350472bed4f9b0057e1a326192335449ecc7111208eaa73ce690a3141ddd717d5e1f5c64670b7ab9f06e912b91428b53a080956
TLSH
T12A21E32A0549556D217348A008F8B43EF31FF0EB0E6BD9C93A6E940F377251C07A2681
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 591f23bc807d833ba78dedc18f61ca18a8337fd8362333f7f379b4bb1a23296d
MD5 972d70d770518c92badc8dc3890517a8
SHA1 e93e839273fbd69f665a158b0976c09d5f5375d1
SHA512 d3ec4d2a905bafdc83a053e5c5042f6be4a8f3319607d9514e548a932e31a19148918a93327270eca65c967840bd21bf3fb1ed5d948acd72909305284bb1b536
TLSH
T14321C12A054D56AD217358A408F8B43EF31FF0EB0A6BE9C93A6ED54F777251C07A2681
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 824ca94a06b86d0ee50146a531294a12a710bff8545add354e01da79857489cc
MD5 43795eeaf6c7fcb86d352291e93656c4
SHA1 f021eee1e14259d4b20eb51a8aa4c9bcd4d7a64d
SHA512 45531520b75fc6534b96676222ff38a4a02fb752785c4997fee14ca8e2b05dce66cca687115a2bceefea83b5c2f326202a85fa21b8ac10168f8a69f3eba0fdf2
TLSH
T19731D42A054D556D117358A408F8743EF31FF0EB0A67E5C93A7FD40F377251807A2581
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 89726385341c564f64b6ea58c9de0ace92f771de3d5a09b26a203f171bd6ad17
MD5 c442faa4d751ed7aa8cde4a7d131e612
SHA1 c615e689770d0d59088d6910dce2d7921805dc8d
SHA512 eb2a1003d4cb8cbacc0d07a2893457d685bc4d1082b0d3deb4756e06428c86025f3d9a59cb1290cc7229dd6e5742637a8dd8500fad4bcb3abd741c3f00e0c396
TLSH
T13431A02A094D5AAD117358A408F8743EF21FF0EB0AA7E5D93A7ED44F777251806A25C1
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 9e260fb0896934f350e18ec93d463e8d6e74632e8da1eb54f218dec972cd4774
MD5 da4492549d8c1596ed6cbbfb78bf36ed
SHA1 e3c06a4eba76a4e9f9d81dd82d6acdc7fa682dd8
SHA512 664e654ba7e5ee84b5f4b35df54ff69f959f8df5e2fcbb9d54db56eceb7fa2db81c08af63c072b6d034b512efa66c6c676490e7e9dede3a0f94d67d945d3f54e
TLSH
T1F631902A094D5AAD117358A408F8743EF21FF0EB0AA7E5D93A7FD84F777251806A25C1
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 32cf01d0843f8273a57c3fdae3b0d8282a3e10df5f736689c788f00f32326bee
MD5 84da8dc608b2d68f31bd46c5bfce3267
SHA1 5a1b9c7316baf3849a41dd493ffedfe3fac764d7
SHA512 742e9dbc2da76a2e96f6a815d189b9cdf7e88fbf3bb87a4c2ee0d0b02fdfbe150a6854240bdd097527142006f102b65a5124de9fc670f4eabe89710440ae88f4
TLSH
T1D9317F2A094D5AAD11739CA408F8743EF21FF0EB0AA7E5D93A7FD84F777251806A25C1
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 efd103b089fbdc7e9e332dd70b090f7fad609ba0fe477df6972c2bc8b1359c91
MD5 be43831fe4e30b9a2699649c2ae0d846
SHA1 cfafe04f4147019529b7f4aa01f631366302c7db
SHA512 7df153238128f0226c3e1b04e13affd2be4b8e7130acef7b475c6a8d5cbad3b7e2a836166b52b531c56664e6654e6e41577447fd90a93285084760f520372b5e
TLSH
T1CD316D2A094D5ABD11739CA408F8743EF21FF0EB0AA7E5D93A7FD84B777251806A25C1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1964-42-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/1964-7-0x0000000000400000-0x0000000000410000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads