Analysis
- max time kernel
149s - max time network
116s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/10/2026, 18:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe
- Size 6.2MB
- Sample261009-w6hr7ade83
- SHA256 6b1e70fa52c783bdac085b789657d9ac6e7fd40ab883f8762f764bd25ba32d9a
- MD5 d7769f8cdc24b99ff640de1432a51c02
- SHA1 0d1e96f637450bb26803ee46e73b846fd229fda3
- SHA512 c8edf0fda67780027a68763828030811eef71adabdbd39dde46db8628d13181cc3c9136b5684e79346a40db1c69a3453029f214748a816fd9e94f8f3c56003ce
- SSDEEP 196608:BANYNpY9/rZao3bvkrj8rz5Z3ysNBd6G6x3LqRAg7cuQ+:BANYNparZaojkczRwGRLBP
- TLSH T1595633173791E1F3C10351764F96CB7BD2B6B2604A66861337C8160EFEA1A63A339763
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe Key value queried \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation upjx.exe - Executes dropped EXE 3 IoCs
pid Process 840 upjx.exe 4616 regsvr32.exe 2572 jx.exe - Loads dropped DLL 7 IoCs
pid Process 4616 regsvr32.exe 4616 regsvr32.exe 4616 regsvr32.exe 4616 regsvr32.exe 4616 regsvr32.exe 4616 regsvr32.exe 4616 regsvr32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\jx\lhwav\1.wav jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\way\dlway\a.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\way\dlway\c.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\way\gamezzway\l.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\ocx\play1.exe jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\wav\7.wav jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\way\zzway\c.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\way\zzway\i.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\way\dlway\zh2.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\way\zzway jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\wav\13.wav jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\way\dlway\d.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\way\dxway\e.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\way\zzway\l.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\way\xlway\a.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\wav\1.wav jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\wav\9.wav jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\way\djyway\a.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\lhwav\20.wav jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\way\gamezzway\g.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\way\gamelhzzway\i.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\way\djyway jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\wav\11.wav jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\lhwav\12.wav jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\way\lhzzway\e.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\ocx\TwoPlayOcxProj1.ocx jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\way\dlway jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\wav\12.wav jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\lhwav\17.wav jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\lhwav\32.wav jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\way\gamezzway\f.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\way\dlway\xh6.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\ocx\regsvr32.exe jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\way\djyway\e.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\way\gamezzway\e.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\way\dlway\zh4.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\lhwav\9.wav jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\way\djyway\e.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\way\dlway\j.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\way\dlway\k.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\way\dlway\k.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\wav\17.wav jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\way\gamezzway\d.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\way\dlway\f.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\ocx\HikPlayM4.dll jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\ocx\MSVCP71.DLL jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\way\jylway\e.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\way\dlway\xh4.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\ocx\EdmWinNet.dll jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\ocx\getvideinf.dll jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\wav\19.wav jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\way\gamezzway\c.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\way\dxway\e.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\way\dlway\g.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\way\dlway\h5.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\way\zzway\d.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\way\gamelhzzway\a.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\way\dlway\b.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\way\gamezzway\b.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\way\dlway\xh6.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\lhwav\14.wav jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\way\gamezzway\c.bmp jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File opened for modification C:\Program Files (x86)\jx\way\gamezzway jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe File created C:\Program Files (x86)\jx\lhwav\10.wav jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 460 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language upjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jx.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0621D8B-6F04-442D-92D2-9F693DE716F9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0621D8B-6F04-442D-92D2-9F693DE716F9}\TypeLib\ = "{FCFC9EDB-57FF-4941-AB49-945CCFC3F0E5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19D1D41D-FB00-4DBF-AEA2-90D085770EC6}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19D1D41D-FB00-4DBF-AEA2-90D085770EC6}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0621D8B-6F04-442D-92D2-9F693DE716F9}\ = "ITwoPlayOcx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\ToolboxBitmap32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FCFC9EDB-57FF-4941-AB49-945CCFC3F0E5}\1.0\0\win32\ = "C:\\Program Files (x86)\\jx\\ocx\\TwoPlayOcxProj1.ocx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FCFC9EDB-57FF-4941-AB49-945CCFC3F0E5}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0621D8B-6F04-442D-92D2-9F693DE716F9}\TypeLib\ = "{FCFC9EDB-57FF-4941-AB49-945CCFC3F0E5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\Typelib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TwoPlayOcxProj1.TwoPlayOcx\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FCFC9EDB-57FF-4941-AB49-945CCFC3F0E5}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\Verb\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FCFC9EDB-57FF-4941-AB49-945CCFC3F0E5}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0621D8B-6F04-442D-92D2-9F693DE716F9}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19D1D41D-FB00-4DBF-AEA2-90D085770EC6}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19D1D41D-FB00-4DBF-AEA2-90D085770EC6}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0621D8B-6F04-442D-92D2-9F693DE716F9}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19D1D41D-FB00-4DBF-AEA2-90D085770EC6}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19D1D41D-FB00-4DBF-AEA2-90D085770EC6}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19D1D41D-FB00-4DBF-AEA2-90D085770EC6}\TypeLib\ = "{FCFC9EDB-57FF-4941-AB49-945CCFC3F0E5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\MiscStatus regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0621D8B-6F04-442D-92D2-9F693DE716F9}\ = "ITwoPlayOcx" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19D1D41D-FB00-4DBF-AEA2-90D085770EC6}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19D1D41D-FB00-4DBF-AEA2-90D085770EC6}\ = "ITwoPlayOcxEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19D1D41D-FB00-4DBF-AEA2-90D085770EC6}\TypeLib\ = "{FCFC9EDB-57FF-4941-AB49-945CCFC3F0E5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\ToolboxBitmap32\ = "C:\\PROGRA~2\\jx\\ocx\\TWOPLA~1.OCX,1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\Verb\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\InprocServer32\ = "C:\\PROGRA~2\\jx\\ocx\\TWOPLA~1.OCX" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\ProgID\ = "TwoPlayOcxProj1.TwoPlayOcx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FCFC9EDB-57FF-4941-AB49-945CCFC3F0E5}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0621D8B-6F04-442D-92D2-9F693DE716F9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0621D8B-6F04-442D-92D2-9F693DE716F9}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\ = "TwoPlayOcx Control" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TwoPlayOcxProj1.TwoPlayOcx\ = "TwoPlayOcx Control" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0621D8B-6F04-442D-92D2-9F693DE716F9}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0621D8B-6F04-442D-92D2-9F693DE716F9}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19D1D41D-FB00-4DBF-AEA2-90D085770EC6} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\MiscStatus\1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\Verb regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FCFC9EDB-57FF-4941-AB49-945CCFC3F0E5}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\jx\\ocx\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\Typelib\ = "{FCFC9EDB-57FF-4941-AB49-945CCFC3F0E5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19D1D41D-FB00-4DBF-AEA2-90D085770EC6} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TwoPlayOcxProj1.TwoPlayOcx regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FCFC9EDB-57FF-4941-AB49-945CCFC3F0E5} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FCFC9EDB-57FF-4941-AB49-945CCFC3F0E5}\1.0\ = "TwoPlayOcxProj1 Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0621D8B-6F04-442D-92D2-9F693DE716F9} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19D1D41D-FB00-4DBF-AEA2-90D085770EC6}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\Control\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\Verb\0\ = "Properties,0,2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0621D8B-6F04-442D-92D2-9F693DE716F9}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TwoPlayOcxProj1.TwoPlayOcx\CLSID\ = "{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FCFC9EDB-57FF-4941-AB49-945CCFC3F0E5}\1.0\0\win32\ = "C:\\PROGRA~2\\jx\\ocx\\TWOPLA~1.OCX" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0621D8B-6F04-442D-92D2-9F693DE716F9} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19D1D41D-FB00-4DBF-AEA2-90D085770EC6}\ = "ITwoPlayOcxEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\MiscStatus\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{429F9482-18DD-4EFD-8B36-9AC7B9F57E97}\MiscStatus\1\ = "131473" regsvr32.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2572 jx.exe 2572 jx.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4144 wrote to memory of 460 4144 jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe 88 PID 4144 wrote to memory of 840 4144 jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe 91 PID 460 wrote to memory of 4616 460 cmd.exe 93 PID 840 wrote to memory of 2572 840 upjx.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Dorifel.ahef.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\jx\ocx\reg.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Program Files (x86)\jx\ocx\regsvr32.exeregsvr32.exe /s TwoPlayOcxProj1.ocx3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4616
-
-
-
C:\Program Files (x86)\jx\upjx.exe"C:\Program Files (x86)\jx\upjx.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Program Files (x86)\jx\jx.exe"C:\Program Files (x86)\jx\jx.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2572
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\jx\jx.exe
- Size 5.1MB
- SHA256 bbc26c9d9cd63d90d2c673aad65f3c80a61165d92fe6b45fcf4106a83777feec
- MD5 042ec2f6ce3b33141888d608e69ebccd
- SHA1 7784bc6841460d618d95317fe64b4754b305f0cc
- SHA512 fe242c2b2af248820d5795392e1e4936955a9061320f598127190e171c33f258e5ee69c5fe3a8c44a7fd42e0356abfc7415461a7b71ecf04edfe5f7d4d15108e
- SSDEEP 98304:Rwj4eWJsa1SiE69FXtGdztGdOtGd/tGdEtqdC4NJBAUZLJ:RwasQSJ6zt8zt8Ot8/t8Cs5NJVF
- TLSH T1FC36120BB28245F2D20F353550B11B7A9771AD5C87218793E396FE5ABDF2FE0D86A009
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\jx\lhwav\20.wav
- Size 25KB
- SHA256 8f50a4f7b4e1f709562b22b433d356e1969fdeef14d83aa704f2d69f0889453e
- MD5 924236d9c0c2ff0b4b14a96bb06b72b8
- SHA1 b1fd41032aafb0a0fffade16663f89c8d520931d
- SHA512 81360b6bb2ac2fbee6ca92a28bb1b0a7e84008c0713d26343c92b4f77f6c18e4fe764a4de31164ac2f124fc5385c3bf5cddce68f38f71b2bd1aaac5a96bc4cc7
- SSDEEP 768:vtimPxRy+I5kNjwyIvVUPHQuNnFn2R2GBPDRoWZ:1xm5CjWgHZpF3MPDRtZ
- TLSH T190C2E1367D361928FCE40DB028F64C5A1E4056E222D0759775FE290E91D62E3A6E3BFC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\jx\lhwav\21.wav
- Size 54KB
- SHA256 39d14ed21f9887ed9d3677bcf014c7f95f961c464abedc7ee356dcde484ba9ad
- MD5 f1023d551fa65d54860e14ff83ce4cdd
- SHA1 0241ef3d940ea788a849965cce18779d9d97376e
- SHA512 009c40831965169ad4db1d41f243ab47cf841648f61a39cfae9d3d25a80e58fbb3c9f39ad91ad4f8bb341534b6f04b99c49bc36766d0545ca2d8d529a112d0a3
- SSDEEP 1536:LoNj963z9h6+zPb6EuftZJDGrp528s8LDCJZgYuzt4:LoUVmbbJDsX2r8/CL7uzq
- TLSH T1EF430150B9C347986430168B361BBA6BAC6E785666CD9B1F2D4A8C02F6F3C103FD634D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\jx\ocx\EDMPLAY.DLL
- Size 60KB
- SHA256 89dfc8bfff13d9c8cec1be28392091a95c7631ea6cdef6a9aa23553189739eb1
- MD5 8997d595c6a58576a41ccb2cfd37d00d
- SHA1 13528af7a8863319710cf8f40fadd7a0bd4840a6
- SHA512 d392ca44eed35eb04ea18f31fdbad86e44a9d4daf376483fa718cb9b22e39a87528000cbb205440ae9f05a4b54d5ca0642445208ca56afac6254cbe30995fdfe
- SSDEEP 768:ILUmZ/KgtRurxzk4BdgCrg1YWP+oXq4bfWyRl2bToTxtgQIy:xmZ/KaRCxzkWKYE+eLbfWybooTxrI
- TLSH T13F533922F39981F0CB8E11713A9A6B1B4576BD900FA417E393673EEA2D732D0C577285
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\jx\ocx\EdmWinNet.dll
- Size 84KB
- SHA256 999cb53a9fdd8e7043683f58944e91cae83aaef6ebee3c6f16b6d083765f73d4
- MD5 34540feeef5d67d5ee9bbe1d9bf57889
- SHA1 146efe481e1d964ba92d64f869b7c69fae88f159
- SHA512 e4c93b0079e7bb8aa4346cb5f7277197ea05b4d7c18e9cca569f9cd4fad7e84df5f2e425ab7a1771745884ba1b97132b7bb41b264d6eecfcc30a9a2910eb68d8
- SSDEEP 1536:PeWpq0D7PY2rpPdVKtPYLcprczm0AAdOnt:WW80Lr1dqwchcy0AAdOnt
- TLSH T1A3833B25E78743FADA0E1930769A57CA5EFC0D8337D1EAFFD706298108A62D404B29F5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\jx\ocx\MSVCP71.DLL
- Size 488KB
- SHA256 df96156f6a548fd6fe5672918de5ae4509d3c810a57bffd2a91de45a3ed5b23b
- MD5 561fa2abb31dfa8fab762145f81667c2
- SHA1 c8ccb04eedac821a13fae314a2435192860c72b8
- SHA512 7d960aa8e3cce22d63a6723d7f00c195de7de83b877eca126e339e2d8cc9859e813e05c5c0a5671a75bb717243e9295fd13e5e17d8c6660eb59f5baee63a7c43
- SSDEEP 12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
- TLSH T17BB4D71377434AF2E086B3F576C6032297F6FC654A25B31392DFE4642F9A38951B3A90
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\jx\ocx\TwoPlayOcxProj1.ocx
- Size 1.1MB
- SHA256 94c7fe3f19c0712f4729f8ad1062fc4b93788a82a13e15a371ec099734f49fa8
- MD5 146f2d2d2f33e3e49d22c0bbc15e847b
- SHA1 f96f772345a515d8f12e99feadc3e1b9d6c71fbc
- SHA512 6d17c9430786736de80d1446298080461de22011f1a8b10304d32b7cb7f83484a4375d7a776283a0edd9d3dbad2eb13d4e18339c360de56d4e1fb90f85a1dd01
- SSDEEP 24576:XNdjBykN5PsO1qIJB8WZ/H6sHRe4E8gxuwqayx:XNdtykN5FPBnZ//Re1dux
- TLSH T1F4357C32F5E0C036D01206B00D7BE67A656DBE982F15894B77A86B8C9F757803E1B397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\jx\ocx\msvcr71.dll
- Size 340KB
- SHA256 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
- MD5 86f1895ae8c5e8b17d99ece768a70732
- SHA1 d5502a1d00787d68f548ddeebbde1eca5e2b38ca
- SHA512 3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
- SSDEEP 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
- TLSH T10374C012B1A3CCB3D0B6007449596B599BBFE43046798A73BFE80E4E4F746D1D726A23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\jx\ocx\play2.exe
- Size 24KB
- SHA256 6132868f45cec9f1e029ef83b2f27de832d2bcf34b4d8787972d9636c2f293e5
- MD5 e2ddf8fd02f77a40645fcecacfa85764
- SHA1 eea70260b4a368a7c820298b40f4e77a932d5418
- SHA512 93a0970a82386d230db2bf3d97c0dfa8aa68cfa55e8b1d412811efddc61dd432c30e16d32efbf84b6ee284731795bb5de0c2921fde06799531643f3cd914c7e2
- SSDEEP 192:YbiqyoT7ZrHnnh3yKpuqp98rXGaqpFS1oynQ8PdzWo:3g7ZTnhF39X81a8PBj
- TLSH T15CB2B84FBE114336CEE186300AAF96779172A8264A268F5F1B50FF5C1C31122BD6336E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\jx\ocx\reg.bat
- Size 35B
- SHA256 09bd026706de3903f86882136e4c04bd7a5869a5931b17b0ac7debc285999a2e
- MD5 594d209f439c9cbd5cbda9fea976b5de
- SHA1 c61bb70597467578f30505206ca9b273a036475e
- SHA512 56f50cd4cadb7b5f3e5eb12544c214f47cafbcb9867cc1a8a5df4cac9057288078111a50f7bb3a3d720185e298583c07b51c56e94bb5be0ffaa1e817f7df3d8e
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\jx\ocx\regsvr32.exe
- Size 13KB
- SHA256 fffa7a97fba9dfb235f969ecce0e5c4a71a48a37c1bc79b77cd78f0ab72f993d
- MD5 e62c1488a3158107eb849da98a4eff91
- SHA1 f0c6189606973bedf70b8139d9798617b466f75e
- SHA512 31f476fef32791f6c2d74f65dcad01a2381b633abaad2559a45f3b302f12918e3ec0020c4342b12610eb1f7f90d803636a01577d877dee291e0dee961d423ea0
- SSDEEP 384:YVUfX6N5H8YxKgaFcWrPMLHWIW9pfL1Wo:GUfXAiMO/MLcfLx
- TLSH T15A52A50667E9A02EF0F31EB06AB646925B397C32BD32E31FEB50555E18B0A44D474F36
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\jx\system.ini
- Size 301B
- SHA256 3e15b6d51c54fb9eb9a5694a0a967a0ba0ad86938cbfa6ab3e399bfd23238836
- MD5 a43c38c2c2d99f05157adb8b192bab62
- SHA1 d7ff1d3106f2b86d1387fd8315147dbef80f5b7e
- SHA512 2b5102bb793623ad4ec16f34ca2a80e5e8f87dfc9fad7a642d903b55b155c3267a2ebcfeaebd0baed66a3dc17247cc12653849a0300ce47f1485eb2cf3d897a6
- TLSH T103E02BA18B442239C9CC0DCF462602E071F6E536B84443AA82F322E37C3788D9D38636
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\jx\upjx.exe
- Size 2.9MB
- SHA256 02c04e75da0de9b30c81afc1ebbcace27d5aa43a35c9069c4614672dd41cc9bc
- MD5 a858eb087001d4696a4b3cd55d0b8902
- SHA1 1e60a7d31c71c519981085a8eb64eadc9587dac8
- SHA512 4c64bb4d124a62ae92f1bbce2a04bbffbea79affde29450da002912a90d7a61b12802a5db2cdd6ca8d5d3f17d35fec740db7d9b7c5fbd28878711b8ede9ce708
- SSDEEP 49152:CqYB2QxGBQpklOcLpKf0nwrmeYz168Vwohp+dBT960jxGi7tFWaghE9cK2HZ:CqYB2QxGBQ6OcL8Mte98vEBTfsiRcaJE
- TLSH T108E523277340C2F1C11101304F65DFBAE6BAE2B0AA769A177BD45D897FB2891B639F40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\jx\wav\10.wav
- Size 296KB
- SHA256 822b6583463c40cc91f3d021c1dd6c80e934a3850c7e67e2b710b6f41f7a3c50
- MD5 9c0755cce87df6012a4e69d2f1d17fd5
- SHA1 3010fd8452f870d0961fbe635ebe2adc00d47839
- SHA512 2c7a5aa702928a7b52b9f275164b76f5414afea7dd79729133892bcefe481e65e60990d1f637b8ba76361a9a8adb533a0d8d04d560338c381c7501777b37dcee
- SSDEEP 6144:oW4SSFqrFBmWoA6RRNtXaOTrkt87iNXLEFRU:JI4/oAQtqOUt8eNXwU
- TLSH T182540B2B8FE2568AD27486377A509BBA29C567DDD8F18837D193F139322DF0C4AE0171
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\jx\wav\11.wav
- Size 1KB
- SHA256 406d9d136df3c5ba23a6e83c11057c0958b7c22b736a78a88fd2c3408ab1725a
- MD5 09d6e3d282c4fed0d002667bb9de48ac
- SHA1 9b0a7671add9f7aa829ae4ed3377a3521e028723
- SHA512 a1f07b05d6b444750ee690fdfa6bfc59b50cdc0acea01af7c9a68e049d670eef82f5582d2d18935f73c7eae583f2a821683ddab7bfff65a666d59c0bfa6ac750
- TLSH T1C3315E5AA3A0AB052D7DDB74FE5CDA792989B88930847BEE7245DC331AD400F83C480A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\jx\wav\12.wav
- Size 30KB
- SHA256 388bdcd7629f6bda8e74f4be66b55aa28d712bd321bfc62b22b8c8dac995f5eb
- MD5 8d108ff504f96adb866dd5c2361349f8
- SHA1 9a06116098b084f9ca2b5f1e236796996d077228
- SHA512 a610d7be78c8a87ee9c8a84393c98985306cb04dd062006362e7ab5a8c10d15ebc2ccb4d29dc2f763bd260621d4c05f83035660dc3eaffeae575f763b50a7930
- SSDEEP 768:kXygnUoTU8Giv4otT5+FIxMQ+AaIz8t2J:qvUEGc8A6AaGpJ
- TLSH T133E25AEC8C1ED14957A5CC29DE68523F5871307698FC3B203546B8E7FCA295B942ECC6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\jx\wav\14.wav
- Size 82KB
- SHA256 a1eeee0f13456aff1e85d4f48c6690e3f102c21f36caf109ef076b8a497e73ec
- MD5 201d7aad0a425f4c1d4abbccd66efbf1
- SHA1 86a1c0e1ff27f454bcc8c8f06fc76d64625ad957
- SHA512 36a813e22a6e9c78413472ded88ea639168b1eb338560c2b8969322d0bf83ca88aa8fff0eb1d2e538cb2d47614b013d36e290f2d283ea95f2029ef1b10a03eea
- SSDEEP 1536:XvFS9H/tUw0O7ypzJHGVOE89n1ZzRULN8udqQOIvuRhbpTsDL7N:XvE/awMki7zcdtOImPblsrN
- TLSH T1B8839D36B2E4E3A8F1CEE2C626045CFDC9E0D216D5F23D48E56254D29CEDC4CA846DA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\jx\wav\15.wav
- Size 5KB
- SHA256 8b3655496b5d6a3aa32447ae3c2a690fb9de790397475b672d2e21e56cf0e5c8
- MD5 0eaab9a4852dcbe48cf2d39b1d8736dd
- SHA1 fa10f64f9b8e563eb384fc0efed482b3798281e8
- SHA512 de1e8fc4c75d9813341db521fffd8f9bbe8e315ca4da76deacdae897b21e0194b42f4564546fc1ea8a9ee833fe3b580415a6a0bfae136701d5e3a9bd8179e593
- SSDEEP 96:VFNoDkucCkSHlxQMJqTgF2FLn/2L7TkR5hpvtdzZMYnfXSq8D3AW00:VFNoDkiJgMJXFInq7sbHd6cfaDVd
- TLSH T184C16D76E31F0953B1370B309EC00A088A95767CEEB65A2762E5CF98B1177A2A9C5305
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\jx\wav\16.wav
- Size 2KB
- SHA256 33ce5b3b5f62417f47c0d9ccca254a0dc183fd8ae18146abf4993e0ab4ee3c9d
- MD5 3aab420d2558f03e28468fea233e3ee2
- SHA1 a48a9cae054bd91d48a6a4ff1615fa056e0f593b
- SHA512 dbbf20ec8ba7143b9ae3b80569538f77042b48e5340084f792a5c665414e10bb121fd4ed01c7acca5a05a16ffe63d21642684e5fcbe9e204848eeec632ab26d8
- TLSH T1815140438646BD628104872AAF2F52FCB47EB0C68C5C2B56D5741C22F470972C72F784
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\jx\wav\17.wav
- Size 34KB
- SHA256 f6e9090b5703b8677084ea59cde10976a938ef13ea1616881bfe12262c5e8a3c
- MD5 5a1f2432df4e7c9345506e88f3a150c1
- SHA1 f5598f2b702b8de692ef909feecf77cd1d1612a2
- SHA512 f02a2b7db7e76d8181913b4b8570c16c5af2fe3f0503e99ce8744cadb37683ec40fe2911c64edcbf44a4aa6b7453a6a007b3a318603bd279060abad7ca2a4e8b
- SSDEEP 768:gfWnfORaEJeCi42dyyWuvsaG5ScP0/LfCnddAzzJUnWqq:gfWcaE8xyyWIsajccLCnddo3
- TLSH T14BF27B02B105C6B3C55299358DCAD9F243667A40BEB2010FA0BCEE8DECD751EE7B8755
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\jx\wav\18.wav
- Size 45KB
- SHA256 d6dd37f32fa87a0dc437dda1d16c931e5d7c3204a7956471e4e0e66ddc43bdd2
- MD5 44f55a81d75a29f471b66c3c1f70666b
- SHA1 0d3cd25ae5ca393eb5f0f2b578431114137d3ac2
- SHA512 bf28885d2021953419467605c2173a1ee6b852b1af5e0a1193708cc5ebf9ce0a759dfda4f5dc9cc090df6bb5d9a80ce4f69536cfea59fa951af4d27230cf3efa
- SSDEEP 768:zOxuy4KQx2JuWP/zUUD1kzqHizX/G/Hv7q6el7KM6toPmAbAPw:znKS8Ue1tCz/G/v7elooPn
- TLSH T13523BF22B401982DF8E70F735C71EFCC1A30BD1ABE7A5A1B750A368DB5F3AD46640295
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\jx\wav\9.wav
- Size 215KB
- SHA256 ff19d1a77b3ce955614f7b78e093634e34685050ef0bef491f45d07a799d5902
- MD5 711c322e7009ea1cd7b199ddfe947146
- SHA1 de9a116e5be8d02d9d741b7b4ea5d0965d7d31ac
- SHA512 ec8d7deb4e986e8d830213a7d00e598b512e778a37d558499e465e44ff3e60178a3e587fe3837855b0dffb3306f4c3e5c27bade77f5d34bf98af1368a03a1a7c
- SSDEEP 3072:zVOId2Yfy38U3NOm/EVpDdjeLxbvVGawvEGrhnqW60HD:zVOqUF3Nbc3JmvVypnqWBD
- TLSH T1D824BFE3E527C1A4C25D633C4AC1CBDBFB4CF7D66C241A859205BAB366123D0B55E3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\jx\way\gamezzway\i.bmp
- Size 2KB
- SHA256 21ee46d847ee965ebdf4448984e75c35b0dacdabac3d96d7c31f5b6d156c7679
- MD5 9bc6e3d0606481b04713ae088a06bc98
- SHA1 ae890f65fdab5b95fa821667dcdfc9cd9a60d04b
- SHA512 5df6d91607ed1f7f90da908cb52294455a279e16e3a92c6788f90197be1fae36d3a22aefe039bd3096256baffa9e3e9a6f620c53e3c6ed32bffade88c2b56a2f
- TLSH T1C351FE4390472644D81C0AB3CC5F05FE6A4B7DA85C51166B9EB6760FB1FA72426EBC0E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\jx\way\zzway\i.bmp
- Size 822B
- SHA256 db76f6acedad036dc1888b842c9725cbbeb6490374a6b021b0590be505f48b10
- MD5 717d151e4a46920ed959bf64c26a897f
- SHA1 cd9e53229964a7f65cc773b824abc4b5965c5c23
- SHA512 aa0818d39cb6e0632feda3d50e252e711ac2d95664dc84c19d2858c8d897d1af03d928faee3f9bccb4bf346440fede8b5da9e38bba5e7b5f81c47aae1aa27a58
- TLSH T10E014C3019CC10C4CC1C047B915852EC5C9B6D809A90654796FB7FCC29FAB7D2199F05
- MD5 SHA1 SHA512 TLSH
