42c6682f320d7e2d7dfb88e5ac7a0e60adbbbc38ccde405fb1d06abbd376f6e7

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Delf.dcoy.exe
Size 9.1MB
Sample261009-wry6macw4s
SHA256 42c6682f320d7e2d7dfb88e5ac7a0e60adbbbc38ccde405fb1d06abbd376f6e7
MD5 1ec64470485b6b5bfab048f574917d8f
SHA1 fd5379f9311e52dffd98ce221310ec59278d988c
SHA512 b6a56ae248febb4849131498a61df0911260e817a3eeb950ff766e47672290dc48abf0beac4539d980b4039ab42fea1036bd0bb0211138209712fb255d012e49
SSDEEP 98304:etItqtGt5txtItqtRtxtItqtGt5txtItqt8txtItqtGt5txtItqt:omsADrmsLrmsADrmsCrmsADrms
TLSH
T115A68D07A7D0D472D0B199BC1E399334AE3B7F306E68728B66A49ECE9C342854D1C767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 25 IoCs

pid	Process
4160	tmp240724140.exe
3928	tmp240724453.exe
1528	tmp240724687.exe
2952	tmp240724750.exe
1416	notpad.exe
5024	tmp240725390.exe
4840	tmp240725453.exe
4968	notpad.exe
4604	tmp240725734.exe
1068	tmp240725765.exe
276	notpad.exe
1280	tmp240726171.exe
2440	tmp240726203.exe
4196	notpad.exe
1728	tmp240726406.exe
3972	tmp240726312.exe
1512	tmp240726484.exe
5248	tmp240726437.exe
1508	tmp240726609.exe
4792	tmp240726703.exe
4396	notpad.exe
364	tmp240726843.exe
5404	tmp240726890.exe
4956	tmp240726968.exe
6096	tmp240727000.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\notpad.exe	tmp240726171.exe
File created	C:\Windows\SysWOW64\notpad.exe-	tmp240726406.exe
File created	C:\Windows\SysWOW64\fsb.tmp	tmp240724140.exe
File created	C:\Windows\SysWOW64\notpad.exe	tmp240724140.exe
File created	C:\Windows\SysWOW64\notpad.exe	tmp240725390.exe
File created	C:\Windows\SysWOW64\notpad.exe-	tmp240725734.exe
File opened for modification	C:\Windows\SysWOW64\fsb.tmp	tmp240724140.exe
File created	C:\Windows\SysWOW64\notpad.exe-	tmp240725390.exe
File created	C:\Windows\SysWOW64\notpad.exe	tmp240726406.exe
File created	C:\Windows\SysWOW64\notpad.exe	tmp240725734.exe
File opened for modification	C:\Windows\SysWOW64\fsb.tmp	tmp240726406.exe
File created	C:\Windows\SysWOW64\notpad.exe-	tmp240724140.exe
File opened for modification	C:\Windows\SysWOW64\fsb.tmp	tmp240725390.exe
File opened for modification	C:\Windows\SysWOW64\fsb.tmp	tmp240725734.exe
File opened for modification	C:\Windows\SysWOW64\fsb.tmp	tmp240726171.exe
File created	C:\Windows\SysWOW64\notpad.exe-	tmp240726171.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3356-0-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/files/0x000c00000001c613-9.dat	upx
behavioral2/files/0x000c00000001c612-14.dat	upx
behavioral2/memory/3356-29-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3928-34-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/files/0x000d00000001c615-36.dat	upx
behavioral2/memory/1416-54-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4968-70-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/files/0x000e00000001c615-75.dat	upx
behavioral2/memory/276-94-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/2440-124-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/5404-168-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4396-158-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/5248-140-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4196-128-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp240724750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp240726312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp240726968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Delf.dcoy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp240725453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp240726890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp240727000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp240724687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp240725765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp240726171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp240726406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp240726437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp240726843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp240724140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp240724453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp240725390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp240725734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp240726203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp240726484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp240726609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp240726703.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1"	tmp240724140.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1"	tmp240725390.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1"	tmp240725734.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1"	tmp240726171.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1"	tmp240726406.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 4160	3356	jaffacakes118_Trojan-Dropper.Win32.Delf.dcoy.exe	89
PID 3356 wrote to memory of 3928	3356	jaffacakes118_Trojan-Dropper.Win32.Delf.dcoy.exe	90
PID 3928 wrote to memory of 1528	3928	tmp240724453.exe	91
PID 3928 wrote to memory of 2952	3928	tmp240724453.exe	92
PID 4160 wrote to memory of 1416	4160	tmp240724140.exe	93
PID 1416 wrote to memory of 5024	1416	notpad.exe	94
PID 1416 wrote to memory of 4840	1416	notpad.exe	95
PID 5024 wrote to memory of 4968	5024	tmp240725390.exe	96
PID 4968 wrote to memory of 4604	4968	notpad.exe	97
PID 4968 wrote to memory of 1068	4968	notpad.exe	98
PID 4604 wrote to memory of 276	4604	tmp240725734.exe	99
PID 276 wrote to memory of 1280	276	notpad.exe	100
PID 276 wrote to memory of 2440	276	notpad.exe	101
PID 1280 wrote to memory of 4196	1280	tmp240726171.exe	102
PID 4196 wrote to memory of 1728	4196	notpad.exe	103
PID 2440 wrote to memory of 3972	2440	tmp240726203.exe	104
PID 2440 wrote to memory of 1512	2440	tmp240726203.exe	105
PID 4196 wrote to memory of 5248	4196	notpad.exe	106
PID 5248 wrote to memory of 1508	5248	tmp240726437.exe	107
PID 5248 wrote to memory of 4792	5248	tmp240726437.exe	108
PID 1728 wrote to memory of 4396	1728	tmp240726406.exe	109
PID 4396 wrote to memory of 364	4396	notpad.exe	110
PID 4396 wrote to memory of 5404	4396	notpad.exe	111
PID 5404 wrote to memory of 4956	5404	tmp240726890.exe	112
PID 5404 wrote to memory of 6096	5404	tmp240726890.exe	113

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Delf.dcoy.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Delf.dcoy.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Users\Admin\AppData\Local\Temp\tmp240724140.exe
  C:\Users\Admin\AppData\Local\Temp\tmp240724140.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Windows\SysWOW64\notpad.exe
    "C:\Windows\system32\notpad.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Users\Admin\AppData\Local\Temp\tmp240725390.exe
      C:\Users\Admin\AppData\Local\Temp\tmp240725390.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5024
    - - C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\tmp240725734.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp240725734.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:276
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726171.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726171.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1280
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726406.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726406.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1728
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726843.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726843.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:364
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726890.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726890.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726968.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726968.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\tmp240727000.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp240727000.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726437.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726437.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726609.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726609.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726703.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726703.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726203.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726203.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726312.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726312.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726484.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp240726484.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\tmp240725765.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp240725765.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1068
  - - C:\Users\Admin\AppData\Local\Temp\tmp240725453.exe
      C:\Users\Admin\AppData\Local\Temp\tmp240725453.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4840
- C:\Users\Admin\AppData\Local\Temp\tmp240724453.exe
  C:\Users\Admin\AppData\Local\Temp\tmp240724453.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Users\Admin\AppData\Local\Temp\tmp240724687.exe
    C:\Users\Admin\AppData\Local\Temp\tmp240724687.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\tmp240724750.exe
    C:\Users\Admin\AppData\Local\Temp\tmp240724750.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp240724140.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp240724140.exe
Size 461KB
SHA256 12269c2d6799dbfd99cbc095f41972bfffc10531a63bf459dc66d0b539d821eb
MD5 fd7b308d8ba52f17c0b9672114d665dc
SHA1 c1044081f759c53e55bdbd40058eabe56682400e
SHA512 80f683ff7b20d193a28a3fa7911a5a2cb247b22aae11c415b4d21435ce228e10d9522fff02063824cc68ba31f294fac7bba27848ee569b79243feb0d6b1dcae8
SSDEEP 6144:oftdcNdPCftdcNdPzPeftdcNdPCftdcNdPSPeftdcNdPCftdcNdPYNSDyDIkFthp:bdPZdPzPFdPZdPSPFdPZdPcSDyTFtj
TLSH
T1C5A49D07A7D0C872D0B18DBC1E399324AE3B7F706EA8728A76A41ECE5C742854D5C767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp240724453.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp240724453.exe
Size 539KB
SHA256 1bed679eaf1b491b4fea8da1f51cb5dc4b732b431eeb0897d5dd3165b2d88acb
MD5 c0f340b15dab829de95e006741d7f110
SHA1 82ba1d0ce20dfd6a284e230570508f54b206b062
SHA512 281da2640b8624ab70433cf995d2c9e75a3ae7d02a37c73fabf44ff1399cb725b1d1f3135cbe7219ff91a81986de37a38917252057f387c6abd8ef3b1a3a5d53
SSDEEP 12288:HPydPZdPzPFdPZdPSPFdPZdPcSDyTFtjoSDyTFtj:pDyTFtjBDyTFtj
TLSH
T194C49D07A7D0D476D0B199B81E399320AE3B7F306E6963CB76A41FCE9C342854E18727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp240724640.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp240724640.exe
Size 10KB
SHA256 d8cf7e947759745d9693a3242e582dd80a25c0e78fc5efe9e3228577a0988c7d
MD5 7c7e09d32af402f3859ec20fce172ad1
SHA1 32431363e78620a9af24471a95a9e553ac08a517
SHA512 87e9a98b1c131ae52afb1facb5f385214204bddc725cb600f46ee13c23d93b0484bf79e2d0098a72f701abde0830b706d5290b96a2ae7190733cd3e0a8a55fae
SSDEEP 192:UcmpyMqkhcQUjjgxgS5Wvs/OVXmL1P2XG+V3lyyQmVRp:U9SkiB0x9W0/kXmL1O2QwydVb
TLSH
T137228E4952817DF3C6F2687D38394655E958CF39AFC8880B8C984A46EFD014F4F29579
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp240724750.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp240724750.exe
Size 67KB
SHA256 865f34fe7ba81e9622ddbdfc511547d190367bbf3dad21ceb6da3eec621044f5
MD5 5e28284f9b5f9097640d58a73d38ad4c
SHA1 7a90f8b051bc82cc9cadbcc9ba345ced02891a6c
SHA512 cb7218cfea8813ae8c7acf6f7511aecbeb9d697986e0eb8538065bf9e3e9c6ced9c29270eb677f5acf08d2e94b21018d8c4a376aa646fa73ce831fc87d448934
SSDEEP 1536:bwOnbNQKLjWDyy1o5I0foMJUEbooPRrKKReFX3:RNQKPWDyDI0fFJltZrpReFX3
TLSH
T100633804A3D6F15DE4A2A63016B66BA14E35BD305E3B93CF63203A1F9D3169ADF24317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp240725453.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp240725453.exe
Size 300KB
SHA256 9987e3a723a5fc20b2a456c9d124b931c4e402a84a1646fd4617d83aaeb20cf6
MD5 de3d79e4b2e1e914b0df5005b3937bf0
SHA1 dc877c8fe916ddb2a7c1fd3780984039efa44a10
SHA512 a76ae65c131aaf70f56719f2f3ab8284a65a431f7bbb518b3f3a79e21d0602dae3dca463bb550091348a6d87e35424975c6ebfe4208fd2010189273afc4fb27c
SSDEEP 6144:Dale4j75dWiMmjH/UgaPBjaI5gfzDVlVXgJX:DGjtdcgchlaI5GpX
TLSH
T184649D27EAC064E1FC672970026CFE1F60AEFC30575655D76640AEA9E8712D2043DFAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notpad.exe

Path C:\Windows\SysWOW64\notpad.exe
Size 772KB
SHA256 075b73b3bc5daa79da0ab60e14fa327577d561efaa555d83f2bfcdf6bd89759c
MD5 5cadf8388aeea0ed38ee2272f6f6c38c
SHA1 9e14c8a0ccfd64f103e57ba9d0ab4b1a60d1b9fc
SHA512 3d450148b47ea063fffcb01034f7e31d3c13c6a8611d652886ad19dce20525beabe3ee7f4cb314879086f0f2412e69e7f1f43db197df36efdb32c5fa9f4496ca
SSDEEP 12288:HPydPZdPzPFdPZdPSPFdPZdPcSDyTFtj3GjtdcgchlaI5GpX:pDyTFtjmtdnwD5GJ
TLSH
T1E9F4AF13E6C094B2E8B259780E38EB2AA93BFE305F6561D766541EDE9C342C10D3CB57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notpad.exe

Path C:\Windows\SysWOW64\notpad.exe
Size 1.2MB
SHA256 c88c651f20223f90d9b8d09b15b7852172bbede6be24782752bf27eefbc16c06
MD5 1f8f523c3b6998059398d51bd719ecfd
SHA1 767e7d671f16217f5af2743ccc631a83cec77549
SHA512 ea663863815d9e033ad0daa9386f2e8ab9713a729f52a2fe0774f3b7f23777f4f9317a91816b5a9ffd6b44a472f860e26ebf25ba2fc143c177d92783f2fe3d86
SSDEEP 12288:HPydPZdPzPFdPZdPSPFdPZdPcSDyTFtjDPydPZdPzPFdPZdPSPFdPZdPcSDyTFtU:pDyTFtjFDyTFtjmtdnwD5GJ
TLSH
T18F45AF13E6D094B2D4B15DB81E39E729AA3BBE301F6562CB66641ECE9C342C10D3C767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fsb.stb

Path C:\fsb.stb
Size 10KB
SHA256 f6ab4ba25b6075aa5a76d006c434e64cad37fdb2ff242c848c98fad5167a1bfc
MD5 280b12e4717c3a7cf2c39561b30bc9e6
SHA1 8bf777a28c25793357ce8305bf8b01987bc4d9f2
SHA512 861560b01b9b02fcb80c4e233617d72684c7669e1bce3a234b0fafce733735619e6532fb065ed2d1a4c1249635dca7c75561daaaf92460fad3b8771bb20883b7
SSDEEP 192:nmpyMqkhcQUjjgxgS5Wvs/OVXmL1P2XG+V3lyyQmVRO8zE5:wSkiB0x9W0/kXmL1O2QwydV3+
TLSH
T16B229E8922857DB3C6F3657D39398611BA1CCF38AFDC468B4D588646EFC118B0F2D428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/276-94-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/364-150-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1280-96-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1416-54-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1508-138-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1528-28-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1728-142-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2440-124-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3356-29-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3356-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3928-34-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3972-122-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4160-39-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4196-128-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4396-158-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4604-76-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4956-169-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4968-70-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5024-56-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5248-140-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5404-168-0x0000000000400000-0x000000000041F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads