59c995dd4d2e86e4fb4f34f353fd0b8a23f44a2774599a1e864514d0f74e6ae7

Analysis

max time kernel
140s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Size 1.5MB
Sample240620-pczehs1bpr
SHA256 59c995dd4d2e86e4fb4f34f353fd0b8a23f44a2774599a1e864514d0f74e6ae7
MD5 05df8d890eb18614a7d206b41453d306
SHA1 cc82be272582f757e9322035310921a9cb92a71e
SHA512 5718ece11b633617a3ea351c56e8519340802ced96501e16b1eff6e57a64f94d657f3ab1e493fe9384818619f4a86997db64f20dc3840ab72f07dd44aed365b2
SSDEEP 24576:3Tf2xjlqWR966T2xttTo2RigiBMyWGLETufJLckEY/fudN9GQcCeIRLhlAB2lf:jurqC6u3+yW8EChcC/fkGQwIRLhlKQ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
1608	urld.exe
1568	nnlogon.exe
4820	nnlogon.exe
1164	UrlUpdate.exe
4836	urlupdate1.exe
5064	ntmurl.exe
836	iewindow.exe

Loads dropped DLL 20 IoCs

pid	Process
620	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
620	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
620	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
620	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
620	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
620	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
620	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
620	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
620	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
620	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
620	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
4836	urlupdate1.exe
5000	regsvr32.exe
4568	regsvr32.exe
5064	ntmurl.exe
836	iewindow.exe
836	iewindow.exe
836	iewindow.exe
836	iewindow.exe
836	iewindow.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 5 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72CEEE43-C350-4932-B3DC-B6201F01EFCB}	ntmurl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72CEEE43-C350-4932-B3DC-B6201F01EFCB}\NoExplorer	ntmurl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D815AB8A-E840-4054-B37D-943893116452}	ntmurl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D815AB8A-E840-4054-B37D-943893116452}\NoExplorer	ntmurl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D815AB8A-E840-4054-B37D-943893116452}	REG.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\VB6KO.DLL	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dwsbc80.OCX	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DWSHK80.OCX	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	urlupdate1.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	urlupdate1.exe
File created	C:\Windows\SysWOW64\MSVBVM60.DLL	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dwshengine80.dll	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	urlupdate1.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	urlupdate1.exe
File created	C:\Windows\SysWOW64\NSearcher.exe	ntmurl.exe
File opened for modification	C:\Windows\SysWOW64\NSearcher.exe	ntmurl.exe

Drops file in Program Files directory 40 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\autoup.ini	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\bhocode.ini	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.log	nnlogon.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\bbuninstall.reg	ntmurl.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\efsbar.dll	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\ntmurl.dll	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\sslaunch.log	ntmurl.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\tags.mdb	iewindow.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.exe	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\navigator.ico	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files\Netimo\NSearcher\NSearcher.exe	ntmurl.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\bhocfg.ini	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\autoup.ini	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.ini	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.log	nnlogon.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\nautoup.log	UrlUpdate.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\UrlUpdate.exe	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\efbbar.dll	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\urld.exe	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\system.mdb	ntmurl.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\appext.reg	ntmurl.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\tags.ldb	iewindow.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\tags.ldb	ntmurl.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.ini	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\sslaunch.dll	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\uninst.exe	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\autoup.ini	urlupdate1.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\tags.mdb	ntmurl.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\tags.mdb	ntmurl.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\system.mdb	iewindow.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\ntmEnd.exe	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\tagstemp.mdb	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\nautoup.log	urlupdate1.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\bhoexe.log	ntmurl.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\tmp.mdb	ntmurl.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\urlupdate1.exe	UrlUpdate.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\sbinstall.reg	ntmurl.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\ntmurl.exe	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\iewindow.exe	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\urlupdate1.exe	UrlUpdate.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4208	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\ÀÌ ´Ü¾î °Ë»ö(&S)\ = "res://C:\\Program Files (x86)\\netimo\\Common Shared\\URLHelper\\ntmurl.dll/SEARCH.HTM"	ntmurl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{72CEEE43-C350-4932-B3DC-B6201F01EFCB}"	ntmurl.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Approved Extensions	REG.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Explorer Bars\{6A294C45-07CC-426C-9512-6742053E462C}	REG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{72CEEE43-C350-4932-B3DC-B6201F01EFCB}\Codepage = "949"	ntmurl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{72CEEE43-C350-4932-B3DC-B6201F01EFCB}\DisplayName = "¾ßÈÄ"	ntmurl.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{6A294C45-07CC-426C-9512-6742053E462C} = 51667a6c4c1d3b1b55503a76f3510b0a8d1c2c02017c0739	REG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{D815AB8A-E840-4054-B37D-943893116452} = 51667a6c4c1d3b1b9ab706c47fbe3308ab73df7897532547	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main	ntmurl.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\MenuExt\ÀÌ ´Ü¾î °Ë»ö(&S)	ntmurl.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\ÀÌ ´Ü¾î °Ë»ö(&S)\contexts = "48"	ntmurl.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{6A294C45-07CC-426C-9512-6742053E462C}	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{72CEEE43-C350-4932-B3DC-B6201F01EFCB}\URL = "http://search.netimo.net/ntmsearch.html?where=all&cp=ezsearch&adv=yahoo&type=forward&ssupply=1&q={searchTerms}"	ntmurl.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\MAO Settings\AddonLoadTimeThreshold = "1000"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\SearchScopes	ntmurl.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\SearchScopes\{72CEEE43-C350-4932-B3DC-B6201F01EFCB}	ntmurl.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{67C41E9E-2EBF-4F2B-AF74-314F0D793172} = 51667a6c4c1d3b1b8e02d77b80784c07b77a7a0f093b7067	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	ntmurl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Explorer Bars	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Explorer Bars\{6A294C45-07CC-426C-9512-6742053E462C}	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars	REG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{6A294C45-07CC-426C-9512-6742053E462C}\BarSize = dc00000000000000	REG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{72CEEE43-C350-4932-B3DC-B6201F01EFCB} = 51667a6c4c1d3b1b53f2dd6e6f955501abd2fd601b43aede	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\MAO Settings	REG.exe

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	urlupdate1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ntmurl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	ntmurl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	ntmurl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	urlupdate1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ntmurl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ntmurl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ntmurl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	urlupdate1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	urlupdate1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	urlupdate1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	urlupdate1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	urlupdate1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	urlupdate1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ntmurl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	ntmurl.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{446F2D1F-88B2-4928-ADCD-7B23714C00AD}\InprocServer32	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A2B988C-5F30-47F7-97DA-0888B9FA0D15}\TypeLib\ = "{C6E6B197-9348-449E-A149-384B208874B1}"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7BFE371-AB4F-48A9-8E4B-746CDC3377F0}\ = "ntmURL.CTimer"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C48E43A2-A7B7-4293-A13A-F4B29158A0BB}\ = "ntmURL.IURLHelper"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FA496C82-EF15-498A-9281-71C17D2E83B1}\ProxyStubClsid	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}\ProxyStubClsid32	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8A3508D-B8F0-4619-94D1-A85A54B9ABAE}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D00D2AA-A077-4914-A046-62E2A7BA9C11}\Forward	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C36516DD-9577-4347-B0DC-D3641BDBEB36}\TypeLib	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E9ECAA7A-3EAC-4F41-8375-84AC9D2AC3AF}\VERSION	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E43FD401-8715-11D1-98E7-00A0C9702442}\ProxyStubClsid32	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{37273445-885F-4C35-A953-73AC3A9F93F1}\TypeLib\ = "{C8FEC666-6DE0-4B67-977C-50CBC0E61E56}"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E72183BD-2FD6-4FEC-A806-BB3DE07A5E35}	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A2B988C-5F30-47F7-97DA-0888B9FA0D15}\InprocServer32\ = "C:\\Program Files (x86)\\netimo\\Common Shared\\URLHelper\\ntmurl.dll"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ntmURL.CTimer	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7FB96837-674C-407F-BBA0-CDC0D501512C}	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ntmURL.IInputObjectCallback	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A294C45-07CC-426C-9512-6742053E462C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E9BF828-7362-4850-9FE7-59E26521AC34}\TypeLib\ = "{C6E6B197-9348-449E-A149-384B208874B1}"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83C49FF0-B294-11D0-9488-00A0C91110ED}\ = "DataMembers"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.WinHook.8\CLSID\ = "{F6968E7F-3422-4CB7-8F37-3951F4880511}"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C36516DD-9577-4347-B0DC-D3641BDBEB36}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\efindersidebar.CSideBar\Clsid\ = "{6A294C45-07CC-426C-9512-6742053E462C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FBA8A473-BB88-4DDC-AB67-0EE6BF4788A9}\ProgID	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\Version	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C36516DD-9577-4347-B0DC-D3641BDBEB36}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D815AB8A-E840-4054-B37D-943893116452}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.WinHook\CurVer	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.WinHook\ = "WinHook"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3F16DB30-C562-41AD-A3B3-4D405BBBEFEE}\ = "ISubclass"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{446F2D1F-88B2-4928-ADCD-7B23714C00AD}\MiscStatus\1\ = "132497"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{26893EEF-3781-4234-8D71-EF9C394156A3}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E81505D-47A7-471B-B348-07BDA6159756}\ProxyStubClsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A625F501-206F-4713-9DE1-DD3AF4AC4BF9}\ = "GSubclass"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\efindersidebar.CHandler\Clsid\ = "{D815AB8A-E840-4054-B37D-943893116452}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FBA8A473-BB88-4DDC-AB67-0EE6BF4788A9}\TypeLib	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dwsbc80.Subclass\CurVer\ = "Dwsbc80.Subclass.8"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\Control	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{884DA533-61D6-43BD-AF00-BB3E961BFD29}\Implemented Categories	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD708967-6D59-4C25-90CE-22C6C7B1B9CE}	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{446F2D1F-88B2-4928-ADCD-7B23714C00AD}	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{37273445-885F-4C35-A953-73AC3A9F93F1}\TypeLib\ = "{C8FEC666-6DE0-4B67-977C-50CBC0E61E56}"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6968E7F-3422-4CB7-8F37-3951F4880511}\TypeLib\ = "{70CA7ADF-1545-4085-A81F-260C365C5EF2}"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E9BF828-7362-4850-9FE7-59E26521AC34}\TypeLib	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C48E43A2-A7B7-4293-A13A-F4B29158A0BB}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{044D0F63-C274-40B2-8F50-F09A06DCFBE1}\TypeLib\ = "{C6E6B197-9348-449E-A149-384B208874B1}"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ntmURL.CSBCriteria\Clsid\ = "{738A3C47-189C-4B96-8ACE-985DD34AFF17}"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{884DA533-61D6-43BD-AF00-BB3E961BFD29}\ = "ntmURL.CSideBar"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7BFE371-AB4F-48A9-8E4B-746CDC3377F0}\VERSION\ = "1045.4"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dwsbc80.Subclass.8	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4D4528C-B8F0-4D22-BA32-0C411E45B53C}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E72183BD-2FD6-4FEC-A806-BB3DE07A5E35}\TypeLib\ = "{C6E6B197-9348-449E-A149-384B208874B1}"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7BFE371-AB4F-48A9-8E4B-746CDC3377F0}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5FC14064-8342-4D18-947E-3BD813100F99}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7BFE371-AB4F-48A9-8E4B-746CDC3377F0}\TypeLib	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwsbc80.RegMsg.1	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C8FEC666-6DE0-4B67-977C-50CBC0E61E56}\8.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4D4528C-B8F0-4D22-BA32-0C411E45B53C}	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E9ECAA7A-3EAC-4F41-8375-84AC9D2AC3AF}\VERSION\ = "1045.4"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{26893EEF-3781-4234-8D71-EF9C394156A3}\TypeLib\Version = "415.4"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4820	nnlogon.exe
4820	nnlogon.exe
4836	urlupdate1.exe
4836	urlupdate1.exe
4836	urlupdate1.exe
4836	urlupdate1.exe
4836	urlupdate1.exe
4836	urlupdate1.exe
4836	urlupdate1.exe
4836	urlupdate1.exe
4836	urlupdate1.exe
4836	urlupdate1.exe
4836	urlupdate1.exe
4836	urlupdate1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4820	nnlogon.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1608	urld.exe
1164	UrlUpdate.exe
4836	urlupdate1.exe
5064	ntmurl.exe
836	iewindow.exe
836	iewindow.exe
836	iewindow.exe
836	iewindow.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1608	620	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	84
PID 620 wrote to memory of 1608	620	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	84
PID 620 wrote to memory of 1608	620	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	84
PID 620 wrote to memory of 1568	620	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	85
PID 620 wrote to memory of 1568	620	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	85
PID 620 wrote to memory of 1568	620	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	85
PID 620 wrote to memory of 4208	620	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	87
PID 620 wrote to memory of 4208	620	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	87
PID 620 wrote to memory of 4208	620	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	87
PID 4820 wrote to memory of 1164	4820	nnlogon.exe	90
PID 4820 wrote to memory of 1164	4820	nnlogon.exe	90
PID 4820 wrote to memory of 1164	4820	nnlogon.exe	90
PID 1164 wrote to memory of 4836	1164	UrlUpdate.exe	91
PID 1164 wrote to memory of 4836	1164	UrlUpdate.exe	91
PID 1164 wrote to memory of 4836	1164	UrlUpdate.exe	91
PID 4836 wrote to memory of 5064	4836	urlupdate1.exe	95
PID 4836 wrote to memory of 5064	4836	urlupdate1.exe	95
PID 4836 wrote to memory of 5064	4836	urlupdate1.exe	95
PID 5064 wrote to memory of 5000	5064	ntmurl.exe	96
PID 5064 wrote to memory of 5000	5064	ntmurl.exe	96
PID 5064 wrote to memory of 5000	5064	ntmurl.exe	96
PID 5064 wrote to memory of 4568	5064	ntmurl.exe	97
PID 5064 wrote to memory of 4568	5064	ntmurl.exe	97
PID 5064 wrote to memory of 4568	5064	ntmurl.exe	97
PID 5064 wrote to memory of 4476	5064	ntmurl.exe	98
PID 5064 wrote to memory of 4476	5064	ntmurl.exe	98
PID 5064 wrote to memory of 4476	5064	ntmurl.exe	98
PID 5064 wrote to memory of 3220	5064	ntmurl.exe	100
PID 5064 wrote to memory of 3220	5064	ntmurl.exe	100
PID 5064 wrote to memory of 3220	5064	ntmurl.exe	100
PID 5064 wrote to memory of 2616	5064	ntmurl.exe	102
PID 5064 wrote to memory of 2616	5064	ntmurl.exe	102
PID 5064 wrote to memory of 2616	5064	ntmurl.exe	102
PID 5064 wrote to memory of 2540	5064	ntmurl.exe	104
PID 5064 wrote to memory of 2540	5064	ntmurl.exe	104
PID 5064 wrote to memory of 2540	5064	ntmurl.exe	104
PID 5064 wrote to memory of 836	5064	ntmurl.exe	106
PID 5064 wrote to memory of 836	5064	ntmurl.exe	106
PID 5064 wrote to memory of 836	5064	ntmurl.exe	106

C:\Users\Admin\AppData\Local\Temp\05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:620
- C:\Program Files (x86)\netimo\Common Shared\URLHelper\urld.exe
  "C:\Program Files (x86)\netimo\Common Shared\URLHelper\urld.exe" http://search.netimo.net/gmtoolbar/log/m_install_counter.php?pcode=bluepds&isinstall=1
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1608
- C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.exe
  "C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.exe" -i
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1568
- C:\Windows\SysWOW64\sc.exe
  "sc" start efinderservice
  2⤵
  - Launches sc.exe
  PID:4208

C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.exe
"C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Program Files (x86)\netimo\Common Shared\URLHelper\UrlUpdate.exe
  "C:\Program Files (x86)\netimo\Common Shared\URLHelper\UrlUpdate.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Program Files (x86)\netimo\Common Shared\URLHelper\urlupdate1.exe
    "C:\Program Files (x86)\netimo\Common Shared\URLHelper\urlupdate1.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\Program Files (x86)\netimo\Common Shared\URLHelper\ntmurl.exe
      "C:\Program Files (x86)\netimo\Common Shared\URLHelper\ntmurl.exe" install scope addressbar
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      Drops file in System32 directory
      Drops file in Program Files directory
      Modifies Internet Explorer settings
      Modifies data under HKEY_USERS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5064
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s "C:\Program Files (x86)\netimo\Common Shared\URLHelper\ntmurl.dll"
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:5000
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s "C:\Program Files (x86)\netimo\Common Shared\URLHelper\efsbar.dll"
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:4568
    - - C:\Windows\SysWOW64\REG.exe
        
        REG IMPORT "C:\Program Files (x86)\netimo\Common Shared\URLHelper\sbinstall.reg"
        5⤵
        Installs/modifies Browser Helper Object
        Modifies Internet Explorer settings
        
        PID:4476
    - - C:\Windows\SysWOW64\REG.exe
        
        REG IMPORT "C:\Program Files (x86)\netimo\Common Shared\URLHelper\sbinstall.reg"
        5⤵
        Modifies Internet Explorer settings
        
        PID:3220
    - - C:\Windows\SysWOW64\REG.exe
        
        REG IMPORT "C:\Program Files (x86)\netimo\Common Shared\URLHelper\bbuninstall.reg"
        5⤵
        
        PID:2616
    - - C:\Windows\SysWOW64\REG.exe
        
        REG IMPORT "C:\Program Files (x86)\netimo\Common Shared\URLHelper\appext.reg"
        5⤵
        Modifies Internet Explorer settings
        
        PID:2540
    - - C:\Program Files (x86)\netimo\Common Shared\URLHelper\iewindow.exe
        
        "C:\Program Files (x86)\netimo\Common Shared\URLHelper\iewindow.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UrlUpdate.exe

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\UrlUpdate.exe
Size 152KB
SHA256 94a6a81ad5c12aec33d7274e43ed8197cd476bb9680724995631fd971e8a3d86
MD5 df4c70adfe3ee8e7d0a7d396754681ea
SHA1 86d6bc8e6961a01aa689909d678512e0e3bc202c
SHA512 94e8fa6c92cbb30320b2067158549e6079be66489c4a2c8008ec7675d9135cddd477137b3c08fe7e7a41d2da6fcc3732d9ae10e8bc47226108938249fa33fa4e
SSDEEP 3072:T6npLFsb893Sn3dkJht04WD2spOL/KGKlhcpguZh5pXK1zZcsbAM:+0nNke4WdUL/KGKlhcpguZHpXK1z0M
MD5 SHA1 SHA512 SSDEEP

Submit Download

appext.reg

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\appext.reg
Size 1KB
SHA256 c23dc16f219dc1c20150075a49484c443913e64b3b0f1dddf93a48e66af8d406
MD5 18f5649858c70154f4f36456ef43b52e
SHA1 77b105491d6e26949fb4f0a9218a5c4b684f342f
SHA512 1eec6f7f165d5daf8e58e8d20999f322889a65e5ef9947fbf61f3f4670c0172740a26d8b8eb7ad87bd3fdac292a75e42fab6c2b19a9ef08b1caffa9131ff7eee
MD5 SHA1 SHA512

Submit Download

autoup.ini

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\autoup.ini
Size 754B
SHA256 4562121b2b2b75b2159333f32b1f82788caa4b2faae7db2aeb7211b3edba0360
MD5 1e370eb66156da0e589371c58f1aa58f
SHA1 50cd78ae9503bbbd456f55884f1c412f2bc5006c
SHA512 9121a1480c33fbe9c37065ced22ed5997631ac97e5a1c8e3f4cbe4581986599b308892f857fd0f0fd68acf1630d286dea1a7e944f8ab9efbf6655942ef7be6d8
MD5 SHA1 SHA512

Submit Download

autoup.ini

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\autoup.ini
Size 754B
SHA256 f4c44095ae4ed1f35751a25e751f22c19f5831ad5e34468328b3fa0f2a133d4f
MD5 06867fb0362eb394d67e445dd025d580
SHA1 b175656bd6b026fd30924699d12f730f1187cfa9
SHA512 0042a0c50c6a51af6bfd7db493777403216b2df63e3cf4abc284c762ba5ff2bd75bf8a47f1c45a8a73df4ef25019cb5ce412ef1bfc2bf0c27a7e0a537601062d
MD5 SHA1 SHA512

Submit Download

bbuninstall.reg

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\bbuninstall.reg
Size 442B
SHA256 3f0c9bf08a9cdcdb96c2401271dc2bf0316adc6d4b01dde12c0d9da32594690d
MD5 d1b9ce8ba9d227e61b8200e837a791da
SHA1 5ae250f8c2191376d9a07d80c356cedf976a7575
SHA512 265d60be34fa0457e7a7073ccfacf7748b8bddf003589cc53e6e9f2d055a0b442fe21521b78d2e2321faeab7f401eeca7d7f32b3ba65c8d64fdaa521b243965c
MD5 SHA1 SHA512

Submit Download

bhocfg.ini

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\bhocfg.ini
Size 10KB
SHA256 d865151fc6bd08ae20c1252b197b658fc293a5183ec1f294a05d305c714070f5
MD5 8eb1f202b12256dc732a17590d7d508e
SHA1 8b032c6f45112d2aa3e72bcdfbcbd00144418e54
SHA512 3ef8dfae492a5dd2887e7ea2e41a879322cdce86f8ee97e3438a47164c39d11349559c18e8bb27017f6ede0c4c5c69dfe05bb870657468f2faa9431de105f7bd
SSDEEP 192:mPzZqnq9B4eLwrAhqVsG3XuJ2RRccxf70CIPtX8X:mPzZqnq98Ahq2OyeDIK
MD5 SHA1 SHA512 SSDEEP

Submit Download

bhocode.ini

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\bhocode.ini
Size 26B
SHA256 7198951fb2445568ecd0d83214a5e7337ff6710b785aeaebf641f24ed409ebd7
MD5 2b4c5c5deee9d19992825eb9843c6ee8
SHA1 2bd5c9a61ada3ccf8f112477b54b789982350855
SHA512 a092d28acb8f3f8e9c23183d8c486407c2051391c8d41237ed8e840a5a301753ff7fe928c5701c0c5501e6d49120cb459ce56f6de01bb7087dd8a548b2de38ac
MD5 SHA1 SHA512

Submit Download

efsbar.dll

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\efsbar.dll
Size 150KB
SHA256 61dc360cc369d3718dba0f9abef8abdef86631f6926758935f29d0b12e6cf8cc
MD5 06ba55c2784d6be5bd400a469e2a602f
SHA1 9c0942b4941430e79bd94735a9c5b9b5ab99424c
SHA512 502c8c2c8b8294454db8bc38d6b5cc11355c33e22533951622284c3e96f3e568d08173780d84a029a090041e67c6bcd9568150ce28acc3c2aaa83a9fe5cc6c1d
SSDEEP 1536:WeBE9b4kRDjvf7fE3ojwG/Ih/3RtR8izcT2QsbIpF4srfQuRRoFvC0U0ZaRKrhC/:WeBXkjvjE3AAxLR86cL71RoF7wu2cY
MD5 SHA1 SHA512 SSDEEP

Submit Download

iewindow.exe

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\iewindow.exe
Size 406KB
SHA256 b697f80f2fd2a0f12e8fa9bcf02cedf1306f618d1328ace2e7954038eab6716a
MD5 a9750f0259293728bd56dc8a6509ab04
SHA1 11f79809356887f995896febf2cde9da0bbc48bb
SHA512 3a3c659183e2ca1c5a03f579fbaa9f76b731030c06571fe73b12bd8e2a4d626764e4cb7aea35803199a8da9db217985215bab48c199c7564a20bd2bd592a9a1b
SSDEEP 6144:QzIHrlVzNOKvt9mI0E3BDh/9nk85ziUpUox/vb5FH7869Hbdgt:KKQKHH0+BN/9HdiBohT5FoyHbI
MD5 SHA1 SHA512 SSDEEP

Submit Download

nautoup.log

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\nautoup.log
Size 447B
SHA256 7a0b3fc57342e54b7eae094df6767965cb6b4b612412037f598cbc27160a937a
MD5 5b1aa3f32a073239dafa2b8e18c5a4d9
SHA1 3a6078a3cc6b81229e8e6078cf598fabc3437757
SHA512 a0c2bdfab7db3f7500f059b195473dc6e42e612bca6c6fac757642b4a0741ee777f71ca1d57bec864e8dfeddab30b2846335806f4f0891e1a6f632fac7d3bfb5
MD5 SHA1 SHA512

Submit Download

nnlogon.exe

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.exe
Size 68KB
SHA256 8a730e05ec59ca9c2bea7b950b7178c5174da28d0843ba1f3f10b47e352b219d
MD5 4f8ec9279ce71a9feafd811a2a0fe8fc
SHA1 8c5e103eeb3dec74297b41739a28eb0c1b4d0478
SHA512 61c0b531b0530afba51138bc8d876a715e059fa716652b9155bead099c1e6dea9a972f219bc593d6e0ef4d7bc849a9108cb6cd99eb72e61d8d0f45e3199908c9
SSDEEP 768:G1UEOcy9lHXBT/J33p47yTeXeJIYwnbVYcWB5vUL6CdLQC2fQEH:G1UMERp47yTLJGnbVYWL7dLAQEH
MD5 SHA1 SHA512 SSDEEP

Submit Download

nnlogon.ini

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.ini
Size 362B
SHA256 b5f551b88b1c76f9b54ccec5f3c19e4f91ea1705320dccbcb1f75d5a9c5cc9b9
MD5 3352808839a5d78e7ba644eee3baee26
SHA1 74e8e0558fac4fa9b4b6edb4cd965c3a48611493
SHA512 c3ac39b6b4feccb4da905cf79c40e00d332fcb420759d089eba13baa13fa6e70569e2ad24656648523557b8c5542cdef57ac71d18a5d233899b34b6c8d9bca93
MD5 SHA1 SHA512

Submit Download

nnlogon.log

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.log
Size 743B
SHA256 6d7efca06ef634173144ed3863b224a3820f72ff7441cbd78be461a74dbe8241
MD5 2128410d244c7f6b71f9401dd418928d
SHA1 707980a79333179894349ecf0c3d535f8ba2823c
SHA512 111094010115d54b963f1e64e7dfe4580f95dbd4b6be8dbc0a3e19348ef3becde5284ebb02113ce055368c9765cc8b08535caf1e72ccfd18a1e2eaf0b0018a3f
MD5 SHA1 SHA512

Submit Download

nnlogon.log

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.log
Size 990B
SHA256 9a7cf84aa19d79e96dc3905299ae939665f8c01b1af4ee6e97adc89f62dfcdf0
MD5 99a7ab8c84e64f02e6b19ad455ebad18
SHA1 19fea62666ae90f34eb9233a111f3e7002760aad
SHA512 56cd9e9a3135cbd21e3bea5ad5d96aa56814f89e63526a0dd3cc7fe77e1debdf0a0808b2f1a070f2446f6436667870e57da470afdfc1924d96947bcf8aecbe64
MD5 SHA1 SHA512

Submit Download

nnlogon.log

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.log
Size 442B
SHA256 ebe35f5dc7b912096b4bd7b8c49f32f6d73a85e60e972efc2607b716cd62524d
MD5 187392d028b82ba674de2cbd0cc22dd5
SHA1 07bd5624d25e90b0f5657250bb580e1a3c3acdd6
SHA512 a8d1db5eac17978a06edf99194e46b281d728c55a336855f525d5c173f19ed180dd680d5f5114f8bdca84a83ed0bfd0589428775b2a658b7fdf1c2aee1e240ab
MD5 SHA1 SHA512

Submit Download

ntmurl.dll

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\ntmurl.dll
Size 174KB
SHA256 1003a84d5e1e35e0873ed0b6ed184e7348480184beeb714ee0e65107edfdbb3e
MD5 3984956c55c48b8822e908df7fe019fd
SHA1 2e68f7b39e9ba71aa673c54ebbad7233218590d9
SHA512 44180b1705b60782a5bb7ff3f371ab55de7c012006e8659a15af03f35dfe15729493083de03047d12898248f5802f2f4f4759eef0dcece4bee92f0153c40172e
SSDEEP 3072:pdNVHMZC51dzABC8e/zTqqfiZIE8+i8nyP2PaxxG9p:phsATqqiZIEHyeizGv
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntmurl.exe

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\ntmurl.exe
Size 226KB
SHA256 9f0e364297feda755f3b134b0db882369c3b6ca1985691c49f4b3bba02c7f316
MD5 8ad6d0d50e3b19f6b4bee7b9bcba2c73
SHA1 d1b1ce5e137f15b2d11261879139b4d078b5f734
SHA512 64ccd7f2aa385d6be9755432a48805519932cc220db7581daa3cb8123678d5433529c7f6b94eed3e319fad3781941356740eded95ee5024a788860d373b3a8fd
SSDEEP 6144:nfWUIstzkIotRfXZpMTjlhbIhPdoxVRXzJlOBOxuewBuo:+tsmi/YFoxVlJkBOxuDB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

sbinstall.reg

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\sbinstall.reg
Size 830B
SHA256 a89c9dcc2775d7b98f177fd55c553e5b00d1800a59322e1e1e854a79620868ae
MD5 99efeac3859992432d0973cbac6e9b30
SHA1 6f987006f2fe72031084bb86e18ed2f7ba4807e6
SHA512 42c441aade296c8acce5d424b919e14476d0da84a552dba118c7487415540020687fe290849214dc8067fdbc35a7a6002cd687faf048d7d2e495fd476b3788e3
MD5 SHA1 SHA512

Submit Download

sbinstall.reg

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\sbinstall.reg
Size 324B
SHA256 2e58e8a351d814537317d27c339272ec69e611daa63c7df80a3dc8666096fc98
MD5 058f2758bb8063271a5c5c6257ea9cd2
SHA1 6928513ee55a2a32871c08f1a3aa890c6147b074
SHA512 0bc4a847b8aaf00f596ef97a9942882a224397b5af52628417695724d4b9dec07547f48003c902493e71832c1622305736d7119e5a278822ab55cfccef1df1a7
MD5 SHA1 SHA512

Submit Download

sslaunch.DLL

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\sslaunch.DLL
Size 60KB
SHA256 572b99582027ac31ea036ddb8066bb4118e7c44ab98125a35f863cc710a4ebcf
MD5 412706c54d6ed78c5cd624dc55ef293f
SHA1 a4edb4fe218916ed2294458e7829ed608d6eb4f0
SHA512 1e8fb64759f17223f93260ce27d6e877ff8f704391703457e52925582d88b1b094f824708157aa336291cefff478041986a223ee5ffc03af1b6c9563512bc6c2
SSDEEP 768:Kb2Dit2ndfPVoTXTrYTxx7kw0wgN8OJ96/P/LQvsbA:Kb2PHKTXKmw0wgazQvsbA
MD5 SHA1 SHA512 SSDEEP

Submit Download

sslaunch.log

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\sslaunch.log
Size 632B
SHA256 d27e3278ece7e3a24bee16026d1f560564f9dc0af48082eb964751f7ad82926b
MD5 945207a82adcd0698f695b3536fc542e
SHA1 6723fb5a239c9b79163f544dff63b9ccf3aa16fc
SHA512 d9209ab7cc79804afb0b1ea6cb9d6c25e131a2f63bce9eaeb1a006b2425c62ab56b3e697ed2be89ba653b4c1b32f7d258e60a91a664cd4059cb6b9dc57eb3607
MD5 SHA1 SHA512

Submit Download

tags.mdb

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\tags.mdb
Size 232KB
SHA256 f4c376b51fbad67a6f6737c450bfd922aa753dd17bdd6611c8e9782cab56a8cd
MD5 da02915fe3ee96b51f64685021dff037
SHA1 e3cc87a41390ce00834f1d1b8f9d0d21ca896bd2
SHA512 f499d52955e0697de4e7637fe0f6ec41471421cf76d786707ee5e6ed6c5548310f6c0024405b4b22c2237583b0543c673b18e16cdb3f44922e923e0a52cc142c
SSDEEP 384:RHFLz6Xyd8VyXQR25/tP0upUuIIAcFFDXFBE6W:RlNQR25WyDXfE6W
MD5 SHA1 SHA512 SSDEEP

Submit Download

tagstemp.mdb

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\tagstemp.mdb
Size 184KB
SHA256 504890d04367979ba23222b15892df6b75f140fde436219bb4d49ac5e949597a
MD5 499943ab2d6a704f9d7dbb8ec1aeed61
SHA1 f98e08c95e7229e3e32d587e061c8548e0e4d411
SHA512 c4c7d8ec105fc77e6e109fb1e6aed317a41b794b2c87d55d84e23e74fb4fca546f8e95b590fdedbfbd3295f0ee08bb6cca2f8979022ced29e62a6851f26b2d3d
SSDEEP 384:d+9M0+Ude3Lud8VyXQR2N0P8428riVHY1cFvBE6W:d+F+jLwQR2NEUE6W
MD5 SHA1 SHA512 SSDEEP

Submit Download

urld.exe

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\urld.exe
Size 24KB
SHA256 e56aa545162c1da6c7ff2b9ae7df78eb7adfa99c9648a6a6c013ff28e5246f82
MD5 2b44719cfe2006f025445f2b62bfdbaa
SHA1 8114afce7e26087e398ae1103c6012139a564242
SHA512 12297a70cab4b2d4530b666f2a6449221c476de5763c0ed56d33da94ebcc568f192332bb2a7b13a1702e84140b5232bb4feea304b7d224a241db26db01a5a97d
SSDEEP 384:2GAqrVdL9+3K9DhDu2fkSfD/DK0Sn1We9:2GAqr/LvjMSrLAb
MD5 SHA1 SHA512 SSDEEP

Submit Download

TypeLib.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy35B7.tmp\TypeLib.dll
Size 3KB
SHA256 75c206fba2ec5d344ca514e6451d8892f939f15e8afc1c132bbc9eca886ed1de
MD5 56abaa41368ddf53d01421760f9d72f4
SHA1 68a4e41d46366e8116bdfeba34d94b628fc6fb45
SHA512 98aaee865ee756f6193fb89f35aaf019953c597f92f0e6d3f4a8ead27d5c09f8ac9d39b547a655f2eb4ce6b8867b4e12a20f43749bce3bc2a5f7e668378649d9
MD5 SHA1 SHA512

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy35B7.tmp\nsExec.dll
Size 6KB
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
MD5 SHA1 SHA512 SSDEEP

Submit Download

DWSHK80.OCX

Path C:\Windows\SysWOW64\DWSHK80.OCX
Size 200KB
SHA256 8413fe7000baca9e7a2fdef33922d17d97ef9d16799444b945b3c73fee953c6b
MD5 956041a95acf9738b712c71c55672094
SHA1 84959e2c0b07d631de4f71da32e1c3c301285e68
SHA512 c93085f6e4159e3a75e9167e036214930a3ec3960d5eb3e0812f164a841f60b1c3454bcc7a2227b7d0e80c303db11d322a1e6862d643a614c32e4d6b1798b298
SSDEEP 6144:BE0Jarr0dWt86FKhOO1ITPKFD7Mq0BTv:+0c3mWi6ElKR
MD5 SHA1 SHA512 SSDEEP

Submit Download

dwsbc80.OCX

Path C:\Windows\SysWOW64\dwsbc80.OCX
Size 167KB
SHA256 242934d4d92948817dd00eec4e8592f7044f5bfc7b2ad2603c826c5cea7b09e5
MD5 456b24a38b8e2d2f3303e0b4d05cc929
SHA1 3c981bbac31706cc9189605959f9eba7acbb17a7
SHA512 4476f50a9ade47c848f882b56758111d39a79e61ac62cebf09c8b8d7baaaa77767c11da6e6732caa383b372d0d8a49be116e111299f637e2ea722fa5fd978385
SSDEEP 3072:K33ebWXothdt1FFfPLyKq1YeoXijMkcI1SjX7iO1ChheO/n3hzOi:DN9LjgiiO1ChheO/n3
MD5 SHA1 SHA512 SSDEEP

Submit Download

dwshengine80.dll

Path C:\Windows\SysWOW64\dwshengine80.dll
Size 137KB
SHA256 a8ab488c1ffeed943a68ce7f72fa2eb1b9b21b62c01fbd405a93906a4b357621
MD5 df901a23e6da0cad1981f0a7c13fbf24
SHA1 78f8f8e857e5ce4dce9fdc6658b5780b07167df7
SHA512 1d530caccd728006b1c169a9684044b45384ff4caca02f95c26e15339c4bcfad00f70a85b9f3b6d6d84aed242536ecea454636688e33fa6c6558f67378fc8228
SSDEEP 3072:jVEYo+V9rYoQ7/pnDeZtVbbOtF4759qDD2:jVEYdHE/CbOto59
MD5 SHA1 SHA512 SSDEEP

Submit Download

vb6ko.dll

Path C:\Windows\SysWOW64\vb6ko.dll
Size 99KB
SHA256 52b64e2bfc9ee0b807f2095726ace9e911bcd907054ac15686a4e7d2fd4dc751
MD5 84742b5754690ed667372be561cf518d
SHA1 ef97aa43f804f447498568fc33704800b91a7381
SHA512 72ac19a3665a01519dac2ad43eb6178a66ad7f4e167f2a882cbca242978f8debe3e15d0e210c3b0391590699999f33a1fd5de4ca6559ff894b4e6cb4ac1415a0
SSDEEP 768:J2rURM7RMwTQvsF51u5tyxwgyBEkLki6Ynb:J2rwWRjM0FCagQi6Yb
MD5 SHA1 SHA512 SSDEEP

Submit Download

nautoup.log

Path C:\nautoup.log
Size 218B
SHA256 136f64e34ef2486b7644e1450193327d70b8dfa2e8dfd126405697bb937cb24d
MD5 63edfb848c4a188cf37bc7fd96c1b8fd
SHA1 522b65711e3fc3b0b9b20c1db0738c034e746394
SHA512 df873d37180c22b11e686797b52166d963b73586275d99d00bc280c617ffd93fd5f09acaf47c121a4d271c523faab92e990618e0702050b511434bf63432aa5d
MD5 SHA1 SHA512

Submit Download