adwind | 7024b29d2de166cce76d465e3b7cb072a1d64e62a940af3741335121904a5f5b

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 04:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Backdoor.Win32.Androm.nmwt.exe
Size 698KB
Sample261012-eszecaas6k
SHA256 7024b29d2de166cce76d465e3b7cb072a1d64e62a940af3741335121904a5f5b
MD5 421cc7821ad2b4573005c9fd45bbb15b
SHA1 89ff0d2027616cad7fece79eff25fdaddb80bed0
SHA512 77c1533d75745eb08651901e9f61c21429828401eb0ccd428ed22bf84e2f2dc3f1b4f619c36c1dd9d41297b1ee22fc8ad0989c547c31e4804093757150cc42b1
SSDEEP 12288:gk7C0sSvBPe148JARDGHK6UJHTtoXLOwuA:riSpPe148JAwUJtoXLOVA
TLSH
T12EE4011873C54F56E3EF0FB1E69022544729681DD99AD30FA44594EEFD8538AC3A2B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution adwind persistence trojan

Malware Config

Signatures

Family: AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 12 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe	regedit.exe

Executes dropped EXE 2 IoCs

pid	Process
2852	tmp.exe
2664	.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\test.txt	javaw.exe
File opened for modification	C:\Windows\System32\test.txt	java.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs

execution

Visual Basic

T1059.005

pid	Process
2420	cscript.exe
5640	cscript.exe
5448	cscript.exe
5740	cscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2864 set thread context of 2664	2864	jaffacakes118_Backdoor.Win32.Androm.nmwt.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5828	cmd.exe
5668	cmd.exe
4672	cmd.exe
5480	cmd.exe
3876	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Backdoor.Win32.Androm.nmwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
1948	taskkill.exe
1180	taskkill.exe
1892	taskkill.exe
4172	taskkill.exe
5332	taskkill.exe
820	taskkill.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3696	regedit.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2864	jaffacakes118_Backdoor.Win32.Androm.nmwt.exe
2864	jaffacakes118_Backdoor.Win32.Androm.nmwt.exe
2864	jaffacakes118_Backdoor.Win32.Androm.nmwt.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2864	jaffacakes118_Backdoor.Win32.Androm.nmwt.exe
Token: 33	2864	jaffacakes118_Backdoor.Win32.Androm.nmwt.exe
Token: SeIncBasePriorityPrivilege	2864	jaffacakes118_Backdoor.Win32.Androm.nmwt.exe
Token: SeDebugPrivilege	5332	taskkill.exe
Token: SeDebugPrivilege	820	taskkill.exe
Token: SeDebugPrivilege	1948	taskkill.exe
Token: SeDebugPrivilege	1180	taskkill.exe
Token: SeDebugPrivilege	1892	taskkill.exe
Token: SeDebugPrivilege	4172	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3560	javaw.exe
5860	java.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 5984	2864	jaffacakes118_Backdoor.Win32.Androm.nmwt.exe	88
PID 5984 wrote to memory of 3168	5984	cmd.exe	91
PID 2864 wrote to memory of 2852	2864	jaffacakes118_Backdoor.Win32.Androm.nmwt.exe	92
PID 2852 wrote to memory of 3560	2852	tmp.exe	93
PID 2864 wrote to memory of 2664	2864	jaffacakes118_Backdoor.Win32.Androm.nmwt.exe	94
PID 2864 wrote to memory of 2664	2864	jaffacakes118_Backdoor.Win32.Androm.nmwt.exe	94
PID 2864 wrote to memory of 2664	2864	jaffacakes118_Backdoor.Win32.Androm.nmwt.exe	94
PID 2864 wrote to memory of 2664	2864	jaffacakes118_Backdoor.Win32.Androm.nmwt.exe	94
PID 2864 wrote to memory of 2664	2864	jaffacakes118_Backdoor.Win32.Androm.nmwt.exe	94
PID 2864 wrote to memory of 2664	2864	jaffacakes118_Backdoor.Win32.Androm.nmwt.exe	94
PID 2864 wrote to memory of 2664	2864	jaffacakes118_Backdoor.Win32.Androm.nmwt.exe	94
PID 3560 wrote to memory of 5860	3560	javaw.exe	95
PID 3560 wrote to memory of 4672	3560	javaw.exe	97
PID 4672 wrote to memory of 5640	4672	cmd.exe	99
PID 3560 wrote to memory of 5480	3560	javaw.exe	100
PID 5480 wrote to memory of 5448	5480	cmd.exe	102
PID 3560 wrote to memory of 4476	3560	javaw.exe	103
PID 5860 wrote to memory of 3876	5860	java.exe	105
PID 3876 wrote to memory of 5740	3876	cmd.exe	107
PID 5860 wrote to memory of 5828	5860	java.exe	108
PID 5828 wrote to memory of 2420	5828	cmd.exe	110
PID 3560 wrote to memory of 4352	3560	javaw.exe	111
PID 5860 wrote to memory of 3296	5860	java.exe	112
PID 3560 wrote to memory of 5332	3560	javaw.exe	115
PID 3560 wrote to memory of 5668	3560	javaw.exe	116
PID 5668 wrote to memory of 3696	5668	cmd.exe	119
PID 3560 wrote to memory of 820	3560	javaw.exe	121
PID 3560 wrote to memory of 1948	3560	javaw.exe	123
PID 3560 wrote to memory of 1180	3560	javaw.exe	125
PID 3560 wrote to memory of 1892	3560	javaw.exe	127
PID 3560 wrote to memory of 4172	3560	javaw.exe	129

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Androm.nmwt.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Androm.nmwt.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5984
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk " /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3168
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    3⤵
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3560
  - - C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.64194993593034548004458709432671070.class
      4⤵
      Drops file in System32 directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5860
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8586751336871583379.vbs
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3876
      - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8586751336871583379.vbs
        6⤵
        Executes a VBScript file via the Windows Script Host.
        Reads the TCP/IP host and domain name from the registry
        
        PID:5740
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8464657212601052320.vbs
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5828
      - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8464657212601052320.vbs
        6⤵
        Executes a VBScript file via the Windows Script Host.
        Reads the TCP/IP host and domain name from the registry
        
        PID:2420
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:3296
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6164197466557968900.vbs
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4672
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive6164197466557968900.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        Reads the TCP/IP host and domain name from the registry
        
        PID:5640
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4161561583181690869.vbs
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5480
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive4161561583181690869.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        Reads the TCP/IP host and domain name from the registry
        
        PID:5448
  - - C:\Windows\SYSTEM32\xcopy.exe
      xcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
      4⤵
      PID:4476
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe
      4⤵
      PID:4352
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /IM MSASCui.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5332
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c regedit.exe /s C:\Users\Admin\AppData\Local\Temp\ejFJpYxoLH5444645509725535190.reg
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5668
    - - C:\Windows\regedit.exe
        
        regedit.exe /s C:\Users\Admin\AppData\Local\Temp\ejFJpYxoLH5444645509725535190.reg
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        Runs .reg file with regedit
        
        PID:3696
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /IM MsMpEng.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:820
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /IM MpUXSrv.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1948
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /IM MpCmdRun.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1180
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /IM NisSrv.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1892
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /IM ConfigSecurityPolicy.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4172
- C:\Users\Admin\AppData\Local\Temp\.exe
  "C:\Users\Admin\AppData\Local\Temp\.exe"
  2⤵
  - Executes dropped EXE
  PID:2664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 c27fb54c3f804f4f2686257f715bda1c96c7a6dabf1c9c1887a3d5d0dcef1889
MD5 78bccbd92f89c0c55e647e71f616bf60
SHA1 69fd9906f98e7293ae0568cf527df4b98f2aeb36
SHA512 dd14854807eff894ad1326d3ca7e736447b4a08f6f31791cb1f1c4c488bcb3ee95036ea2b92e9dbbeed840c3c27a047494351f011fb54fc0fb48a96da8a5dfcd
MD5 SHA1 SHA512

Submit Download

.exe

Path C:\Users\Admin\AppData\Local\Temp\.exe
Size 1.6MB
SHA256 23e1952565c181913908da1e85ee67c6a0af1482d4ec3ebaaf71f686392c8e1d
MD5 47db23420be3a7ac30b9bae1cbc8151a
SHA1 e468898780e1daef296b13fbd1c73abc7d93e8d4
SHA512 d6619c89998badbe588ed2b89a16c8120071d7e96ec14178c27c2747be6808f91b981841dca86b2ae3cebe23770f6fc29b79e210293647c4a56577a47ea0f565
SSDEEP 24576:t01YLgrur6AbJjBUXGwMcSvZTuk6Jeo/XRRbeJN6uk5rJCAcbxR/8QfZU:t0mgOdBUXE5v5uk6QoP26uGrcAsxRkkU
TLSH
T1AC855A21A7E54129F2F33B301D7AB365497D7D3AAEB5D74E32A4842C5E30E90A824737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Retrive4161561583181690869.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive4161561583181690869.vbs
Size 281B
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887
TLSH
T1C0D02B00D4E7C39000BED702D1E5926EB9E2010D320157487D8490FB12AA07EE5711B5
MD5 SHA1 SHA512 TLSH

Submit Download

Retrive6164197466557968900.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive6164197466557968900.vbs
Size 276B
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429
TLSH
T12ED02B0094E3C35000BE970290E9662EF9A2020D32015B487D4450F3222E0BEEAB15B5
MD5 SHA1 SHA512 TLSH

Submit Download

_0.64194993593034548004458709432671070.class

Path C:\Users\Admin\AppData\Local\Temp\_0.64194993593034548004458709432671070.class
Size 241KB
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
SSDEEP 6144:WI5pxUZ7Gvi8ulm+yV/rIF0/MO2qnan1J7pXESN6U:J5pxAGqNkrIq/MO2qnA
TLSH
T1E634F10DFBAD84A5DBE6203042D644C6A7752E94E3C184738DB6726343B5E73DA23AF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ejFJpYxoLH5444645509725535190.reg

Path C:\Users\Admin\AppData\Local\Temp\ejFJpYxoLH5444645509725535190.reg
Size 867B
SHA256 aad79ef9966619ab11b9ea52904a7061830638e682ca52cb2dea7d25d5a68c3c
MD5 166e4b9411eee525639d702684e7d130
SHA1 410d4c129453baf09f197dd80cb682a704932609
SHA512 3556c08049567ad55fd4f3325e47d2195267473803a9c3129a35b556e98c1e19b8192e25ba8c9d4ec0884ec3c5855add52cf3b0bde80839d3de4c832b528b60c
TLSH
T1F611C250CA25422492F3649486466C122F7E533E73439B6820C8D05AB3A1ADAC39F3CF
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp.exe
Size 505KB
SHA256 561189f53eb21d2a3c6ab3d041428380e89d0c76891aa439f818bc376a1e10aa
MD5 9e4d2002d302118fcc72c7c7ce089438
SHA1 3a301525774197b415a0da65b6dea3a29d3d8bf3
SHA512 d57a2d06d13c9f04db7cdec5ce2dcc698f0598459229c899b079baebe37f4db622edd0bf081d3ca33031f8b0d1b9f0c3bc8725529633285a5bd8214cba6e0c06
SSDEEP 12288:krBDkeXGdFgUPeCz4THUKPYPA5pxogQNUhIK/0c2qnAW:OgF1eCGpgasS7B2qnH
TLSH
T10CB4010AF79D90B5D7E6057041C684FA97349E58E3C29532CFB02A678633837EA039F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_0149c7d0-edd2-4531-b0ce-31b4f1ebdf17

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-461973139-3212354679-1508698038-1000\83aa4cc77f591dfc2374580bbd95f6ba_0149c7d0-edd2-4531-b0ce-31b4f1ebdf17
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

test.txt

Path C:\Windows\System32\test.txt
Size 864B
SHA256 5143271db655434d174931c67d2676ce5d033e10f7286bc7cba99cf404659854
MD5 eb0643dfcb4c75771e7a43800f26d2ac
SHA1 8008fc80e8965834ee12bd4b74ba3dafe883a3af
SHA512 5d41c30050ce8acf442d4d084fa680954a3c77a5178a601954173e3a8207d2626991c6e2d003eef687ce6abb7f4789b5c34b6ee488353cfa6fc87ed52c20cb24
TLSH
T1D6119656061ABC42B39E97954E894B0CF54907C3906A4096086BC96B5B8F658D194FCD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2664-15-0x0000000000350000-0x0000000000365000-memory.dmp

Download

memory/2852-13-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2864-0-0x0000000001AD0000-0x0000000001AE0000-memory.dmp

Download

memory/2864-1-0x0000000075142000-0x0000000075144000-memory.dmp

Download

memory/3560-102-0x000001C7C4A10000-0x000001C7C4A11000-memory.dmp

Download

memory/3560-146-0x000001C7C4A10000-0x000001C7C4A11000-memory.dmp

Download

memory/3560-403-0x000001C7C4A10000-0x000001C7C4A11000-memory.dmp

Download

memory/3560-385-0x000001C7C4A10000-0x000001C7C4A11000-memory.dmp

Download

memory/3560-36-0x000001C7C4A10000-0x000001C7C4A11000-memory.dmp

Download

memory/3560-116-0x000001C7C4A10000-0x000001C7C4A11000-memory.dmp

Download

memory/3560-19-0x000001C7C6310000-0x000001C7C6580000-memory.dmp

Download

memory/3560-348-0x000001C7C4A10000-0x000001C7C4A11000-memory.dmp

Download

memory/3560-119-0x000001C7C4A10000-0x000001C7C4A11000-memory.dmp

Download

memory/3560-123-0x000001C7C4A10000-0x000001C7C4A11000-memory.dmp

Download

memory/3560-143-0x000001C7C6310000-0x000001C7C6580000-memory.dmp

Download

memory/3560-79-0x000001C7C4A10000-0x000001C7C4A11000-memory.dmp

Download

memory/3560-210-0x000001C7C4A10000-0x000001C7C4A11000-memory.dmp

Download

memory/5860-198-0x0000016525880000-0x0000016525881000-memory.dmp

Download

memory/5860-204-0x0000016525880000-0x0000016525881000-memory.dmp

Download

memory/5860-205-0x0000016525880000-0x0000016525881000-memory.dmp

Download

memory/5860-151-0x0000016525880000-0x0000016525881000-memory.dmp

Download

memory/5860-222-0x0000016525880000-0x0000016525881000-memory.dmp

Download

memory/5860-118-0x0000016525880000-0x0000016525881000-memory.dmp

Download

memory/5860-55-0x0000016525880000-0x0000016525881000-memory.dmp

Download

memory/5860-88-0x0000016525880000-0x0000016525881000-memory.dmp

Download