Overview

overview

10

Static

static

10

cb4fab4e71...18.exe

windows7-x64

10

cb4fab4e71...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/08/2024, 17:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    cb4fab4e71dd1b69d127da402f1fc6e0_JaffaCakes118.exe
  • Size 1.7MB
  • Sample240830-v2df8swhrm
  • SHA256 3b52e2715d15a2e959d559fe820e7f71ddf1307f1bf4a52da683097a759ef319
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
agentteslananocoreneshtacollectioncredential_accessdefense_evasiondiscoveryevasionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

  • nanocore

Version

  • 1.2.2.0

C2

  • blackhill.ddns.net:54984

  • 185.125.205.75:54984

Mutex

  • c7192853-3ef1-495d-8d9e-aa7345c98e7f

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    185.125.205.75

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2018-07-28T15:08:16.000917836Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    54984

  • default_group

    Lord

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    c7192853-3ef1-495d-8d9e-aa7345c98e7f

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    blackhill.ddns.net

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Detect Neshta payload 64 IoCs
  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • AgentTesla payload 15 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs
    collection
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 17 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 6 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 3 IoCs
  • NTFS ADS 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: SetClipboardViewer 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb4fab4e71dd1b69d127da402f1fc6e0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cb4fab4e71dd1b69d127da402f1fc6e0_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1892
    • C:\Users\Admin\AppData\Local\Temp\3582-490\cb4fab4e71dd1b69d127da402f1fc6e0_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\cb4fab4e71dd1b69d127da402f1fc6e0_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4760
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\3582-490\cb4fab4e71dd1b69d127da402f1fc6e0_JaffaCakes118.exe:Zone.Identifier"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3556
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\System32\cmd.exe /C type nul > C:\Users\Admin\AppData\Local\Temp\3582-490\cb4fab4e71dd1b69d127da402f1fc6e0_JaffaCakes118.exe:Zone.Identifier
          4⤵
          • Subvert Trust Controls: Mark-of-the-Web Bypass
          • System Location Discovery: System Language Discovery
          • NTFS ADS
          PID:4072
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\3582-490\cb4fab4e71dd1b69d127da402f1fc6e0_JaffaCakes118.exe:Zone.Identifier"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4436
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\System32\cmd.exe /C type nul > C:\Users\Admin\AppData\Local\Temp\3582-490\cb4fab4e71dd1b69d127da402f1fc6e0_JaffaCakes118.exe:Zone.Identifier
          4⤵
          • Subvert Trust Controls: Mark-of-the-Web Bypass
          • System Location Discovery: System Language Discovery
          • NTFS ADS
          PID:1984
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\raworigin.exe:Zone.Identifier"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1060
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\System32\cmd.exe /C type nul > C:\Users\Admin\AppData\Roaming\raworigin.exe:Zone.Identifier
          4⤵
          • Subvert Trust Controls: Mark-of-the-Web Bypass
          • System Location Discovery: System Language Discovery
          • NTFS ADS
          PID:1036
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\raworigin.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2268
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\System32\cmd.exe /c, C:\Users\Admin\AppData\Roaming\raworigin.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4524
          • C:\Users\Admin\AppData\Roaming\raworigin.exe
            C:\Users\Admin\AppData\Roaming\raworigin.exe
            5⤵
            • Executes dropped EXE
            • Accesses Microsoft Outlook profiles
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • NTFS ADS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2948
      • C:\Users\Admin\AppData\Local\Temp\3582-490\cb4fab4e71dd1b69d127da402f1fc6e0_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\cb4fab4e71dd1b69d127da402f1fc6e0_JaffaCakes118.exe"
        3⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: SetClipboardViewer
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4700
      • C:\Users\Admin\AppData\Local\Temp\3582-490\cb4fab4e71dd1b69d127da402f1fc6e0_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\cb4fab4e71dd1b69d127da402f1fc6e0_JaffaCakes118.exe"
        3⤵
        • Executes dropped EXE
        PID:380
      • C:\Users\Admin\AppData\Local\Temp\3582-490\cb4fab4e71dd1b69d127da402f1fc6e0_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\cb4fab4e71dd1b69d127da402f1fc6e0_JaffaCakes118.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2188
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\Temp\adobe.exe.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2364
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\System32\cmd.exe /c, C:\Users\Admin\AppData\Local\Temp\adobe.exe.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4424
          • C:\Users\Admin\AppData\Local\Temp\adobe.exe.exe
            C:\Users\Admin\AppData\Local\Temp\adobe.exe.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2128
            • C:\Windows\svchost.com
              "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\adobe.exe.exe:Zone.Identifier"
              6⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1704
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\System32\cmd.exe /C type nul > C:\Users\Admin\AppData\Local\Temp\adobe.exe.exe:Zone.Identifier
                7⤵
                • Subvert Trust Controls: Mark-of-the-Web Bypass
                • System Location Discovery: System Language Discovery
                • NTFS ADS
                PID:3856
            • C:\Windows\svchost.com
              "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\adobe.exe.exe:Zone.Identifier"
              6⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:744
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\System32\cmd.exe /C type nul > C:\Users\Admin\AppData\Local\Temp\adobe.exe.exe:Zone.Identifier
                7⤵
                • Subvert Trust Controls: Mark-of-the-Web Bypass
                • System Location Discovery: System Language Discovery
                • NTFS ADS
                PID:3728
            • C:\Windows\svchost.com
              "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\raworigin.exe:Zone.Identifier"
              6⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1080
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\System32\cmd.exe /C type nul > C:\Users\Admin\AppData\Roaming\raworigin.exe:Zone.Identifier
                7⤵
                • Subvert Trust Controls: Mark-of-the-Web Bypass
                • System Location Discovery: System Language Discovery
                • NTFS ADS
                PID:3172
            • C:\Users\Admin\AppData\Local\Temp\adobe.exe.exe
              "C:\Users\Admin\AppData\Local\Temp\adobe.exe.exe"
              6⤵
              • Executes dropped EXE
              • Accesses Microsoft Outlook profiles
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: SetClipboardViewer
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • outlook_office_path
              • outlook_win_path
              PID:3068
            • C:\Users\Admin\AppData\Local\Temp\adobe.exe.exe
              "C:\Users\Admin\AppData\Local\Temp\adobe.exe.exe"
              6⤵
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:968

Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Defense Evasion

        Modify Registry

        2
        T1112

        Subvert Trust Controls

        1
        T1553

        SIP and Trust Provider Hijacking

        1
        T1553.003

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        5
        T1552

        Credentials In Files

        4
        T1552.001

        Credentials in Registry

        1
        T1552.002

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        3
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        4
        T1005

        Email Collection

        1
        T1114

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ACROBR~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
        • Size 328KB
        • SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ACROTE~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
        • Size 86KB
        • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ADOBEC~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
        • Size 5.7MB
        • SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ADelRCP.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
        • Size 175KB
        • SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RdrCEF.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
        • Size 9.4MB
        • SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AcroRd32.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
        • Size 2.4MB
        • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WCCHRO~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
        • Size 183KB
        • SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Eula.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
        • Size 131KB
        • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        FULLTR~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
        • Size 254KB
        • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        LOGTRA~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
        • Size 386KB
        • SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        READER~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
        • Size 92KB
        • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WOW_HE~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
        • Size 147KB
        • SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        arh.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
        • Size 125KB
        • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        32BITM~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
        • Size 142KB
        • SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        64BITM~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
        • Size 278KB
        • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ADOBEA~1.EXE
        • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
        • Size 454KB
        • SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AdobeARM.exe
        • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
        • Size 1.2MB
        • SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        jaureg.exe
        • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
        • Size 555KB
        • SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VSTOIN~1.EXE
        • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
        • Size 121KB
        • SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        java.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
        • Size 325KB
        • SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        javaw.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
        • Size 325KB
        • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        javaws.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
        • Size 505KB
        • SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GO664E~1.EXE
        • Path C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE
        • Size 146KB
        • SHA256 d7f214dc55857c3576675279261a0ee1881f7ddee4755bb0b9e7566fc0f425a9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GOBD5D~1.EXE
        • Path C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE
        • Size 221KB
        • SHA256 3fc32edf3f9ab889c2cdf225a446da1e12a7168a7a56165efe5e9744d172d604
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GOF5E2~1.EXE
        • Path C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE
        • Size 146KB
        • SHA256 41bed95cb1101181a97460e2395efebb0594849e6f48b80a2b7c376ddf5ce0ea
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GOOGLE~2.EXE
        • Path C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE
        • Size 258KB
        • SHA256 a892284c97c8888a589ea84f88852238b8cd97cc1f4af85b93b5c5264f5c40d4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GOOGLE~3.EXE
        • Path C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE
        • Size 335KB
        • SHA256 4c783822b873188a9ced8bd4888e1736e3d4f51f6b3b7a62675b0dc85277e0eb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GOOGLE~4.EXE
        • Path C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE
        • Size 433KB
        • SHA256 20bbf92426732ff7269b4f2f89d404d5fee0fa6a20944004d2eeb3cc2d1fa457
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        DISABL~1.EXE
        • Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
        • Size 198KB
        • SHA256 d608c05409ac4bd05d8e0702fcf66dfae5f4f38cbae13406842fa5504f4d616f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MI391D~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MI391D~1.EXE
        • Size 138KB
        • SHA256 d9aefca370b6110c6eabbecd6bb9bda411c8e0bfdf15136ccf2dc651b2848daf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MI9C33~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MI9C33~1.EXE
        • Size 138KB
        • SHA256 9066643d575440a62e06d2f24f15b493aaf26449a6016ad2e53f0b4a1919ab9e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MICROS~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MICROS~1.EXE
        • Size 241KB
        • SHA256 1bc53119bb3acc0c7a710ac52a8dce738d9c824a1677bbced212ae2f9bb0317b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MICROS~2.EXE
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MICROS~2.EXE
        • Size 302KB
        • SHA256 f0ba8909bd6b9870d564802a5359bc2ba66387dc71813c3e5e61352d9916b881
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MICROS~3.EXE
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MICROS~3.EXE
        • Size 255KB
        • SHA256 9d23fea5415a3e6ac73f479f88db480f5312927882db83c0fa165a764e6999c7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MICROS~4.EXE
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MICROS~4.EXE
        • Size 222KB
        • SHA256 f770fde3661d554c764eda7615cdd51d5f8cd60c7ffb2350490817f25baf39ac
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MICROS~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13195~1.15\MICROS~1.EXE
        • Size 1.6MB
        • SHA256 4c0833c0cc0d218809efa0a90b36406a041b8df85fe555510ae93583ccf6f628
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeUpdate.exe
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe
        • Size 250KB
        • SHA256 4d87b0eb331443b473c90650d31b893d00373ff88dcbcb3747f494407799af69
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        IE_TO_~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE
        • Size 509KB
        • SHA256 da333c92fdfd2e8092f5b56686b94f713f8fa27ef8f333e7222259ad1eb08f5d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        COOKIE~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE
        • Size 138KB
        • SHA256 5d548c2cc25d542f2061ed9c8e38bd5ca72bddb37dd17654346cae8a19645714
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ELEVAT~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE
        • Size 1.6MB
        • SHA256 08465cc139ee50a7497f8c842f74730d3a8f1a73c0b7caca95e9e6d37d3beed3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        IDENTI~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE
        • Size 1.1MB
        • SHA256 abe398284d90be5e5e78f98654b88664e2e14478f7eb3f55c5fd1c1bcf1bebee
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        setup.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe
        • Size 3.6MB
        • SHA256 06a3bb0bdd2da870bc8dc2c6b760855cea7821273ce59fc0be158149e52915ba
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSEDGE~2.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE
        • Size 1.6MB
        • SHA256 5e1b1daa9968ca19a58714617b7e691b6b6f34bfacaf0dcf4792c48888b1a5d3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSEDGE~3.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE
        • Size 2.8MB
        • SHA256 a9b7b9155af49d651b092bb1665447059f7a1d0061f88fa320d4f956b9723090
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        NOTIFI~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE
        • Size 1.3MB
        • SHA256 75530dc732f35cc796d19edd11ae6d6f6ef6499ddcf2e57307582b1c5299554c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedge.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe
        • Size 3.2MB
        • SHA256 2b3aa9642b291932ba7f9f3d85221402a9d27078f56ef0e9c6bca633616e3873
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSEDGE~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
        • Size 1.1MB
        • SHA256 34b8662d38e7d3d6394fa6c965d943d2c82ea06ba9d7a0af4f8e0571fb5a9c48
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        PWAHEL~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE
        • Size 1.1MB
        • SHA256 9abd7f0aa942ee6b263cdc4b32a4110ddb95e43ad411190f0ea48c0064884564
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MAINTE~1.EXE
        • Path C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE
        • Size 274KB
        • SHA256 06d363997722b0e3c4787f72ca61cb2a8ad59ea7ba8a9d14eafa8a8a550687a2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        UNINST~1.EXE
        • Path C:\PROGRA~2\MOZILL~1\UNINST~1.EXE
        • Size 141KB
        • SHA256 e90c627265bc799db00828179a5d76717a577086755043ba223a9ac78510a2ff
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        setup.exe
        • Path C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe
        • Size 494KB
        • SHA256 7b945c7e6b8bfbb489f003ecd1d0dcd4803042003de4646d4206114361a0fbbb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        INTEGR~1.EXE
        • Path C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE
        • Size 6.7MB
        • SHA256 7d607fb69c69a72a5bf4305599279f46318312ce1082b6a34ac9100b8c7762ce
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VCREDI~1.EXE
        • Path C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE
        • Size 485KB
        • SHA256 8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VC_RED~1.EXE
        • Path C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE
        • Size 674KB
        • SHA256 c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VC_RED~1.EXE
        • Path C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE
        • Size 674KB
        • SHA256 ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cb4fab4e71dd1b69d127da402f1fc6e0_JaffaCakes118.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\cb4fab4e71dd1b69d127da402f1fc6e0_JaffaCakes118.exe
        • Size 1.6MB
        • SHA256 1163beac07d18af88d5065cd42aa4735b0cbd827af002abed4de8c226d73632e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        directx.sys
        • Path C:\Windows\directx.sys
        • Size 29B
        • SHA256 97d597793ec8307b71f3cfb8a6754be45bf4c548914367f4dc9af315c3a93d9b
        • MD5 SHA1 SHA512
        Submit Download

        directx.sys
        • Path C:\Windows\directx.sys
        • Size 75B
        • SHA256 2213d1a1368cc9e8b9d2f1fdcd3303a16ac319267659ba9ae354a1b195d58fdc
        • MD5 SHA1 SHA512
        Submit Download

        directx.sys
        • Path C:\Windows\directx.sys
        • Size 124B
        • SHA256 c9874ae2c8e6c0c992dc1afb0f5f4c0f34686175fcb3b9003d28b3399ae4035f
        • MD5 SHA1 SHA512
        Submit Download

        directx.sys
        • Path C:\Windows\directx.sys
        • Size 75B
        • SHA256 d0781f3d144e4b18686d3208963a8677026bfd146dde2a1ad63b43459f377969
        • MD5 SHA1 SHA512
        Submit Download

        svchost.com
        • Path C:\Windows\svchost.com
        • Size 40KB
        • SHA256 d88d657bdf1ce6ff2d79e16df36abec3b903ea39ed53f45353492bbe218728d6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/744-258-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/968-291-0x0000000005620000-0x000000000563E000-memory.dmp
        Download

        memory/968-292-0x0000000005F80000-0x0000000005F8A000-memory.dmp
        Download

        memory/968-290-0x0000000005340000-0x000000000534A000-memory.dmp
        Download

        memory/1060-193-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/1080-264-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/1704-252-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/1892-98-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/1892-171-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/1892-176-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2188-229-0x0000000000400000-0x0000000000438000-memory.dmp
        Download

        memory/2268-203-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2364-238-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/3556-173-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/3556-175-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4436-184-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4700-214-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/4700-213-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/4700-246-0x0000000007760000-0x000000000776A000-memory.dmp
        Download

        memory/4700-245-0x00000000076F0000-0x0000000007740000-memory.dmp
        Download

        memory/4700-244-0x0000000006D70000-0x0000000006D7A000-memory.dmp
        Download

        memory/4700-206-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/4700-208-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/4700-227-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/4700-225-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/4700-209-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/4700-228-0x0000000005FA0000-0x0000000005FB8000-memory.dmp
        Download

        memory/4700-224-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/4700-222-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/4700-219-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/4700-218-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/4700-216-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/4700-210-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/4700-211-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/4700-212-0x0000000000400000-0x000000000044C000-memory.dmp
        Download

        memory/4760-177-0x00000000053D0000-0x00000000053D8000-memory.dmp
        Download

        memory/4760-204-0x0000000006230000-0x000000000623C000-memory.dmp
        Download

        memory/4760-185-0x00000000055B0000-0x00000000055BC000-memory.dmp
        Download

        memory/4760-172-0x0000000073A10000-0x00000000741C0000-memory.dmp
        Download

        memory/4760-12-0x0000000073A1E000-0x0000000073A1F000-memory.dmp
        Download

        memory/4760-239-0x0000000073A10000-0x00000000741C0000-memory.dmp
        Download

        memory/4760-178-0x00000000062A0000-0x0000000006844000-memory.dmp
        Download

        memory/4760-205-0x00000000078F0000-0x000000000798C000-memory.dmp
        Download

        memory/4760-13-0x00000000005F0000-0x0000000000794000-memory.dmp
        Download

        memory/4760-186-0x0000000005DD0000-0x0000000005E62000-memory.dmp
        Download

        memory/4760-99-0x0000000073A1E000-0x0000000073A1F000-memory.dmp
        Download

        memory/4760-100-0x0000000002CF0000-0x0000000002D1A000-memory.dmp
        Download

        memory/4760-101-0x00000000055E0000-0x00000000057A2000-memory.dmp
        Download

        memory/4760-102-0x0000000073A10000-0x00000000741C0000-memory.dmp
        Download

        memory/4760-103-0x0000000005120000-0x0000000005142000-memory.dmp
        Download

        memory/4760-104-0x00000000051C0000-0x0000000005226000-memory.dmp
        Download