Overview

overview

9

Static

static

1

eb73632f10...18.exe

windows7-x64

9

eb73632f10...18.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 16:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    eb73632f1094fa2e8d065670897eb1d0_JaffaCakes118.exe
  • Size 2.5MB
  • Sample240410-tkd6rsdd94
  • SHA256 1143cfdd92d3fe657b04973cc3952ab5721ef82e8783ce593a7512adc001c855
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
adwarediscoveryevasionpersistencespywarestealerupx

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 23 IoCs
  • Loads dropped DLL 56 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers COM server for autorun 1 TTPs 6 IoCs
    persistence
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Maps connected drives based on registry 3 TTPs 8 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb73632f1094fa2e8d065670897eb1d0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eb73632f1094fa2e8d065670897eb1d0_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4760
    • C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\system32\cscript.exe" //Nologo "migrate.js" /iversion=20141023 /programfiles="C:\Program Files (x86)" /localapps="C:\Users\Admin\AppData\Local" /chrome-dir="" /firefox-dir="C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\firefox" /ie-dir="C:\Program Files (x86)\Broadway Partners Browse Safe Split Test" /product-name="Broadway Partners Browse Safe Split Test" /installation-time="1712765206" /pid="99998" /zone="12199" /czoneid="" /nmhost-dir="C:\Program Files (x86)\Bench\NmHost" /app-id="38985" /updateip="54.235.90.58" /version="1.0" /straoi="" /enable-extensions /chrome-id="bnbaolfhobbbokdcmfiplbokkokobjgc" /chrome-update-url="http://bnbaolfhobbbokdcmfiplbokkokobjgc/check/.eJwNicsNgCAMQHfpmRi9soyhUBQp1EA1Jsbd5fY-L6jrGSz4vUkhMHBT60nqSMs0D0-1q2OmBlbbRQbo0TWF8bGiE467IKLk4EtMJw_KkgWPzcP3A9xAISI.e4txJoPbDKTEASbcxHMzEZLsYhY" /close-chrome /close-firefox /close-ie
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2056
      • C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\SoftwareDetector.exe
        SoftwareDetector.exe
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Maps connected drives based on registry
        PID:1796
      • C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\sqlite3.exe
        "C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\sqlite3.exe" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bnbaolfhobbbokdcmfiplbokkokobjgc_0.localstorage" "SELECT value FROM ItemTable WHERE key='_GPL_zoneid';"
        3⤵
        • Executes dropped EXE
        PID:4684
      • C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\sqlite3.exe
        "C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\sqlite3.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.Admin\framework-1d10eb57-e111-ea32-c58f-b1eaaeae1962.sqlite" "SELECT value FROM user_storage WHERE key='_GPL_zoneid';"
        3⤵
        • Executes dropped EXE
        PID:3692
      • C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\storageedit.exe
        storageedit.exe ie {8E56A02B-46FE-4490-B169-F16E5231533B} get _GPL_zoneid
        3⤵
        • Executes dropped EXE
        PID:836
    • C:\Windows\SysWOW64\net.exe
      net.exe start schedule
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2716
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 start schedule
        3⤵
          PID:1052
      • C:\Program Files (x86)\Bench\Updater\1.7.0.0\Updater.exe
        "C:\Program Files (x86)\Bench\Updater\1.7.0.0\Updater.exe" -runmode=addsystask
        2⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:5076
      • C:\Program Files (x86)\Bench\Updater\updater.exe
        "C:\Program Files (x86)\Bench\Updater\updater.exe" -runmode=addtask
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1492
        • C:\Program Files (x86)\Bench\Updater\1.7.0.0\updater.exe
          "C:\Program Files (x86)\Bench\Updater\1.7.0.0\updater.exe" -runmode=addtask
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:2832
      • C:\Program Files (x86)\Bench\Updater\updater.exe
        "C:\Program Files (x86)\Bench\Updater\updater.exe" -runmode=addproduct -info="C:\Users\Admin\AppData\Local\Temp\nsx73AC.tmp"
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3952
        • C:\Program Files (x86)\Bench\Updater\1.7.0.0\updater.exe
          "C:\Program Files (x86)\Bench\Updater\1.7.0.0\updater.exe" -runmode=addproduct -info="C:\Users\Admin\AppData\Local\Temp\nsx73AC.tmp"
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:2192
      • C:\Windows\SysWOW64\cscript.exe
        "C:\Windows\system32\cscript.exe" //Nologo "main_installer.js" install /product-name="Broadway Partners Browse Safe Split Test" /installation-time="1712765206" /pid="99998" /zone="12199" /czoneid="12199" /nmhost-dir="C:\Program Files (x86)\Bench\NmHost" /app-id="38985" /updateip="54.235.90.58" /version="1.0" /straoi="" /enable-extensions /chrome-id="bnbaolfhobbbokdcmfiplbokkokobjgc" /chrome-update-url="http://bnbaolfhobbbokdcmfiplbokkokobjgc/check/.eJwNicsNgCAMQHfpmRi9soyhUBQp1EA1Jsbd5fY-L6jrGSz4vUkhMHBT60nqSMs0D0-1q2OmBlbbRQbo0TWF8bGiE467IKLk4EtMJw_KkgWPzcP3A9xAISI.e4txJoPbDKTEASbcxHMzEZLsYhY" /close-chrome /close-firefox /close-ie
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4516
        • C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\SoftwareDetector.exe
          SoftwareDetector.exe
          3⤵
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Maps connected drives based on registry
          PID:4300
      • C:\Windows\SysWOW64\cscript.exe
        "C:\Windows\system32\cscript.exe" //Nologo "installer.js" install chrome "" /product-name="Broadway Partners Browse Safe Split Test" /installation-time="1712765206" /pid="99998" /zone="12199" /czoneid="12199" /nmhost-dir="C:\Program Files (x86)\Bench\NmHost" /app-id="38985" /updateip="54.235.90.58" /version="1.0" /straoi="" /enable-extensions /chrome-id="bnbaolfhobbbokdcmfiplbokkokobjgc" /chrome-update-url="http://bnbaolfhobbbokdcmfiplbokkokobjgc/check/.eJwNicsNgCAMQHfpmRi9soyhUBQp1EA1Jsbd5fY-L6jrGSz4vUkhMHBT60nqSMs0D0-1q2OmBlbbRQbo0TWF8bGiE467IKLk4EtMJw_KkgWPzcP3A9xAISI.e4txJoPbDKTEASbcxHMzEZLsYhY" /close-chrome /close-firefox /close-ie
        2⤵
        • Blocklisted process makes network request
        • Drops file in Drivers directory
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2600
        • C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\SoftwareDetector.exe
          SoftwareDetector.exe
          3⤵
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Maps connected drives based on registry
          PID:4868
        • C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\gpedit.exe
          gpedit.exe chrome add-extension bnbaolfhobbbokdcmfiplbokkokobjgc http://bnbaolfhobbbokdcmfiplbokkokobjgc/check/.eJwNicsNgCAMQHfpmRi9soyhUBQp1EA1Jsbd5fY-L6jrGSz4vUkhMHBT60nqSMs0D0-1q2OmBlbbRQbo0TWF8bGiE467IKLk4EtMJw_KkgWPzcP3A9xAISI.e4txJoPbDKTEASbcxHMzEZLsYhY
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:3608
      • C:\Windows\SysWOW64\cscript.exe
        "C:\Windows\system32\cscript.exe" //Nologo "chrome_gp_update.js" /product-name="Broadway Partners Browse Safe Split Test" /installation-time="1712765206" /pid="99998" /zone="12199" /czoneid="12199" /nmhost-dir="C:\Program Files (x86)\Bench\NmHost" /app-id="38985" /updateip="54.235.90.58" /version="1.0" /straoi="" /enable-extensions /chrome-id="bnbaolfhobbbokdcmfiplbokkokobjgc" /chrome-update-url="http://bnbaolfhobbbokdcmfiplbokkokobjgc/check/.eJwNicsNgCAMQHfpmRi9soyhUBQp1EA1Jsbd5fY-L6jrGSz4vUkhMHBT60nqSMs0D0-1q2OmBlbbRQbo0TWF8bGiE467IKLk4EtMJw_KkgWPzcP3A9xAISI.e4txJoPbDKTEASbcxHMzEZLsYhY" /close-chrome /close-firefox /close-ie
        2⤵
          PID:1076
        • C:\Program Files (x86)\Bench\BService\1.1\bservice.exe
          "C:\Program Files (x86)\Bench\BService\1.1\bservice.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:5088
        • C:\Program Files (x86)\Bench\BService\1.1\bservice64.exe
          "C:\Program Files (x86)\Bench\BService\1.1\bservice64.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:4644
        • C:\Program Files (x86)\Bench\Wd\wd.exe
          "C:\Program Files (x86)\Bench\Wd\wd.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:3020
        • C:\Windows\SysWOW64\cscript.exe
          "C:\Windows\system32\cscript.exe" //Nologo "installer.js" install firefox "C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\firefox\" /product-name="Broadway Partners Browse Safe Split Test" /installation-time="1712765206" /pid="99998" /zone="12199" /czoneid="12199" /nmhost-dir="C:\Program Files (x86)\Bench\NmHost" /app-id="38985" /updateip="54.235.90.58" /version="1.0" /straoi="" /enable-extensions /chrome-id="bnbaolfhobbbokdcmfiplbokkokobjgc" /chrome-update-url="http://bnbaolfhobbbokdcmfiplbokkokobjgc/check/.eJwNicsNgCAMQHfpmRi9soyhUBQp1EA1Jsbd5fY-L6jrGSz4vUkhMHBT60nqSMs0D0-1q2OmBlbbRQbo0TWF8bGiE467IKLk4EtMJw_KkgWPzcP3A9xAISI.e4txJoPbDKTEASbcxHMzEZLsYhY" /close-chrome /close-firefox /close-ie
          2⤵
          • Loads dropped DLL
          PID:688
        • C:\Windows\SysWOW64\cscript.exe
          "C:\Windows\system32\cscript.exe" //Nologo "installer.js" install ie "C:\Program Files (x86)\Broadway Partners Browse Safe Split Test\" /product-name="Broadway Partners Browse Safe Split Test" /installation-time="1712765206" /pid="99998" /zone="12199" /czoneid="12199" /nmhost-dir="C:\Program Files (x86)\Bench\NmHost" /app-id="38985" /updateip="54.235.90.58" /version="1.0" /straoi="" /enable-extensions /chrome-id="bnbaolfhobbbokdcmfiplbokkokobjgc" /chrome-update-url="http://bnbaolfhobbbokdcmfiplbokkokobjgc/check/.eJwNicsNgCAMQHfpmRi9soyhUBQp1EA1Jsbd5fY-L6jrGSz4vUkhMHBT60nqSMs0D0-1q2OmBlbbRQbo0TWF8bGiE467IKLk4EtMJw_KkgWPzcP3A9xAISI.e4txJoPbDKTEASbcxHMzEZLsYhY" /close-chrome /close-firefox /close-ie
          2⤵
          • Loads dropped DLL
          • System policy modification
          PID:836
          • C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\SoftwareDetector.exe
            SoftwareDetector.exe
            3⤵
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Maps connected drives based on registry
            PID:1920
          • C:\Program Files (x86)\Broadway Partners Browse Safe Split Test\FrameworkEngine.exe
            "C:\Program Files (x86)\Broadway Partners Browse Safe Split Test\FrameworkEngine.exe" /RegServer
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies Internet Explorer settings
            • Modifies registry class
            PID:2908
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32.exe /s "C:\Program Files (x86)\Broadway Partners Browse Safe Split Test\FrameworkBHO.dll"
            3⤵
            • Loads dropped DLL
            • Installs/modifies Browser Helper Object
            • Modifies Internet Explorer settings
            • Modifies registry class
            PID:2528
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32.exe /s "C:\Program Files (x86)\Broadway Partners Browse Safe Split Test\FrameworkBHO64.dll"
            3⤵
            • Loads dropped DLL
            PID:4576
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Broadway Partners Browse Safe Split Test\FrameworkBHO64.dll"
              4⤵
              • Loads dropped DLL
              • Registers COM server for autorun
              • Installs/modifies Browser Helper Object
              • Modifies Internet Explorer settings
              • Modifies registry class
              PID:3092
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32.exe /s "C:\Program Files (x86)\Broadway Partners Browse Safe Split Test\RequestHelper.dll"
            3⤵
            • Loads dropped DLL
            PID:3292
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall add rule name="proc.exe" protocol=TCP dir=in localip=127.0.0.1 remoteip=127.0.0.1 localport=3128 action=allow program="C:\Program Files (x86)\Bench\Proxy\proc.exe"
          2⤵
          • Modifies Windows Firewall
          • Loads dropped DLL
          PID:1120
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall add rule name="pwdg.exe" protocol=TCP dir=in localip=127.0.0.1 remoteip=127.0.0.1 localport=3128 action=allow program="C:\Program Files (x86)\Bench\Proxy\pwdg.exe"
          2⤵
          • Modifies Windows Firewall
          • Loads dropped DLL
          PID:2076
        • C:\Program Files (x86)\Bench\Proxy\pwdg.exe
          "C:\Program Files (x86)\Bench\Proxy\pwdg.exe"
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1616
          • C:\Program Files (x86)\Bench\Proxy\proc.exe
            "C:\Program Files (x86)\Bench\Proxy\proc.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3508
        • C:\Program Files (x86)\Bench\Updater\updater.exe
          "C:\Program Files (x86)\Bench\Updater\updater.exe" -runmode=addtask
          2⤵
          • Executes dropped EXE
          PID:3716
          • C:\Program Files (x86)\Bench\Updater\1.7.0.0\updater.exe
            "C:\Program Files (x86)\Bench\Updater\1.7.0.0\updater.exe" -runmode=addtask
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:3972
        • C:\Program Files (x86)\Bench\Updater\updater.exe
          "C:\Program Files (x86)\Bench\Updater\updater.exe" -runmode=addproduct -info="C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\info.xml"
          2⤵
          • Executes dropped EXE
          PID:64
          • C:\Program Files (x86)\Bench\Updater\1.7.0.0\updater.exe
            "C:\Program Files (x86)\Bench\Updater\1.7.0.0\updater.exe" -runmode=addproduct -info="C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\info.xml"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:364
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
        1⤵
          PID:2532
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
          1⤵
            PID:1260

          Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Persistence

                Boot or Logon Autostart Execution

                2
                T1547

                Registry Run Keys / Startup Folder

                2
                T1547.001

                Browser Extensions

                1
                T1176

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Privilege Escalation

                Boot or Logon Autostart Execution

                2
                T1547

                Registry Run Keys / Startup Folder

                2
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Defense Evasion

                Impair Defenses

                1
                T1562

                Disable or Modify System Firewall

                1
                T1562.004

                Modify Registry

                4
                T1112

                Credential Access

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Peripheral Device Discovery

                1
                T1120

                Query Registry

                4
                T1012

                Software Discovery

                1
                T1518

                System Information Discovery

                4
                T1082

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                bhelper.dll
                • Path C:\Program Files (x86)\Bench\BService\1.1\bhelper.dll
                • Size 87KB
                • SHA256 bb6a9e41d54bb81219170d47c03f9b42667cb15ea7887d23bbd27ed0d78fb7dc
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                bhelper64.dll
                • Path C:\Program Files (x86)\Bench\BService\1.1\bhelper64.dll
                • Size 108KB
                • SHA256 2a22b9569c3c060dd6c0503d1d6874fcaafeea863247e1d9e9883ef83f13af71
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                bservice.exe
                • Path C:\Program Files (x86)\Bench\BService\1.1\bservice.exe
                • Size 50KB
                • SHA256 d617adf5f09e6797459d397209b29d5d266e7ef42c25f50e86fe23a086cd4059
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                bservice64.exe
                • Path C:\Program Files (x86)\Bench\BService\1.1\bservice64.exe
                • Size 108KB
                • SHA256 4b71983d2b09ab00548982ac65f9d248a966da0d9433a73cab8802404a55fea5
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                manifest.json
                • Path C:\Program Files (x86)\Bench\NmHost\manifest.json
                • Size 221B
                • SHA256 34653e0474b69ff3d694250769e35dd261c5646c9dc4241ce6849f34c90ab493
                • MD5 SHA1 SHA512
                Submit Download

                updater.exe
                • Path C:\Program Files (x86)\Bench\Updater\1.7.0.0\updater.exe
                • Size 382KB
                • SHA256 df0722816ac196ca7b93bcfd66f2d6d1c42157735ca8c451cb09bebc27cf1c5e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                updater.exe
                • Path C:\Program Files (x86)\Bench\Updater\updater.exe
                • Size 65KB
                • SHA256 8444ccf83e977eebb3a8372f5d4795a965feb5ff2b4b5dfc26f4c527539b139f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                wd.exe
                • Path C:\Program Files (x86)\Bench\Wd\wd.exe
                • Size 90KB
                • SHA256 4ef762eec1aed45d8d32aa7b156429075c593f26cafc2d8536a685ab61c7d82d
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                extension_info.json
                • Path C:\Program Files (x86)\Broadway Partners Browse Safe Split Test\extension_info.json
                • Size 2KB
                • SHA256 227fe6982837294e3016218f0704e06e6b8b75d74f242a4820fd15df58a0e811
                • MD5 SHA1 SHA512
                Submit Download

                SoftwareDetector.exe
                • Path C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\SoftwareDetector.exe
                • Size 120KB
                • SHA256 0186d765b4dc4132c243b20214c6fb1de49e645fc1b5acddbe954d6e5682f84f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                chrome_gp_update.js
                • Path C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\chrome_gp_update.js
                • Size 2KB
                • SHA256 41fe7e7445819a935215fd0928f5bb1bb3a2e3df36f0c27111c99cb716064f18
                • MD5 SHA1 SHA512
                Submit Download

                chrome_installer.js
                • Path C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\chrome_installer.js
                • Size 6KB
                • SHA256 054cd068794483350e10415f243a1b218153800f0d5e0cfbd9c20ce648f4dbce
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                chrome_workaround.js
                • Path C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\chrome_workaround.js
                • Size 1KB
                • SHA256 3cdf74f41636466913d9be7afbc81438546881b467a574e2c74a496d9251df11
                • MD5 SHA1 SHA512
                Submit Download

                common.js
                • Path C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\common.js
                • Size 14KB
                • SHA256 9b1da8c2dd4dd1cc9b08d92f598e12cd5a1a62898908293840f6a48d03a8eadb
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                extension_info.json
                • Path C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\firefox\extension_info.json
                • Size 1KB
                • SHA256 a7282326d2f1c5e6f3843179c2f3e854d180bb8f3796f6bc9db72a689134580c
                • MD5 SHA1 SHA512
                Submit Download

                firefox_installer.js
                • Path C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\firefox_installer.js
                • Size 6KB
                • SHA256 b866ec4a886d8b8448cb648a397518a1b428119cd5ee4ad88ac6c3dc5f1e17f5
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                gpedit.exe
                • Path C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\gpedit.exe
                • Size 93KB
                • SHA256 299df4b8e7a5957f165b706cee2741d934dfb53a8dac21761645b875b9dd45ef
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                ie_installer.js
                • Path C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\ie_installer.js
                • Size 4KB
                • SHA256 d987ed4d0b55903993a59165b96557e79ca27054e80b0160f21c4d714ebf11b8
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                installer.js
                • Path C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\installer.js
                • Size 799B
                • SHA256 e6bc0ed8424b80085a08df410ad0d43ba37b052ccadfb6450a2337f37ca1288f
                • MD5 SHA1 SHA512
                Submit Download

                main_installer.js
                • Path C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\main_installer.js
                • Size 1KB
                • SHA256 7acaec9a466eb71fc663f6c6c3bc41ec080f544b4e864cd1e5d6d3cd06230232
                • MD5 SHA1 SHA512
                Submit Download

                migrate.js
                • Path C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\migrate.js
                • Size 4KB
                • SHA256 9770fd38208bf2b6e1676f833a90f0f5129bae080fd890614d719b43c290c167
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                projectInstaller.js
                • Path C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\projectInstaller.js
                • Size 2KB
                • SHA256 02ca4af05e5620f2bc7bd253cf002259dbf3908a8dabb941496c35b790444967
                • MD5 SHA1 SHA512
                Submit Download

                sqlite3.exe
                • Path C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\sqlite3.exe
                • Size 481KB
                • SHA256 3441036aa8be132d8476bbee2648e966db130e3fdba1eb97c9972d55248bf9bc
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                storageedit.exe
                • Path C:\Users\Admin\AppData\Local\Broadway Partners Browse Safe Split Test\storageedit.exe
                • Size 75KB
                • SHA256 578de2953c01d158c93d02a8f59933af8678be0b727b8228566c4d494b00f7a2
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                System.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsj5D92.tmp\System.dll
                • Size 11KB
                • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                md5dll.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsj5D92.tmp\md5dll.dll
                • Size 6KB
                • SHA256 fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                nsDownloadCv.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsj5D92.tmp\nsDownloadCv.dll
                • Size 91KB
                • SHA256 d5075a3547cc098065253dced11b018d732644e071eff174787ca27942b73139
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                nsExec.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsj5D92.tmp\nsExec.dll
                • Size 6KB
                • SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                nsProcess.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsj5D92.tmp\nsProcess.dll
                • Size 4KB
                • SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
                • MD5 SHA1 SHA512
                Submit Download

                nsProcess2.dll
                • Path C:\Users\Admin\AppData\Local\Temp\nsj5D92.tmp\nsProcess2.dll
                • Size 35KB
                • SHA256 b8762c09c2b45fc836c65a9052951de05177651d278e4cf154c754d9f5573e7a
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                nsx73AC.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\nsx73AC.tmp
                • Size 323B
                • SHA256 c9861cc55693ab957350696bb6293f5bfafe34f763911a50ceb1add410298485
                • MD5 SHA1 SHA512
                Submit Download

                memory/1616-329-0x0000000001340000-0x0000000001341000-memory.dmp
                Download

                memory/3692-198-0x0000000000400000-0x000000000047D000-memory.dmp
                Download

                memory/4684-196-0x0000000000400000-0x000000000047D000-memory.dmp
                Download

                memory/4760-250-0x0000000002400000-0x0000000002409000-memory.dmp
                Download

                memory/4760-251-0x0000000002400000-0x0000000002409000-memory.dmp
                Download

                memory/4760-249-0x0000000002400000-0x0000000002409000-memory.dmp
                Download

                memory/4760-248-0x0000000002400000-0x0000000002409000-memory.dmp
                Download

                memory/4760-21-0x0000000002400000-0x0000000002409000-memory.dmp
                Download

                memory/4760-18-0x0000000002400000-0x0000000002409000-memory.dmp
                Download