572d0574f80f381c457cbead06e03302d76348cfb7f00a7a14be97c9468cd681

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
Size 3.7MB
Sample261006-tk7s3sds8p
SHA256 572d0574f80f381c457cbead06e03302d76348cfb7f00a7a14be97c9468cd681
MD5 b44bb6351017097aad7a6eb0b7b291d2
SHA1 8e97c0f8152ce61f1d56abba5a1d1d63cfe52465
SHA512 fa96f876166055b52fcaaffc8d4e8c6029c4052fdab460b599369fa583f74872789c1bc5c97f9dd64e43657f28432c44bae0e2dc3216008ace3655308cca315d
SSDEEP 49152:NrNUvL6RQRYYKQaf5DOs3Hl8MD/NmRyu38TQpmYP+fpNJXt8vQL:NrNymx3Hl8MTNmNpmYP+fpNJXt7
TLSH
T15E06E102E79080BEE24E01F351B3233E6B75A21103119ACB5BB8DDD56F225E57E3A75B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

aspackv2 discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 5 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001600000001c54f-5.dat	aspack_v212_v242
behavioral2/files/0x000c00000001c5f0-87.dat	aspack_v212_v242
behavioral2/files/0x000c00000001c5f6-90.dat	aspack_v212_v242
behavioral2/files/0x000c00000001c5e5-94.dat	aspack_v212_v242
behavioral2/files/0x000c00000001c5f1-93.dat	aspack_v212_v242

Executes dropped EXE 12 IoCs

pid	Process
2612	msupdate.exe
1564	msconf.exe
3632	FireDaemon.exe
264	weblog32.exe
4660	FireDaemon.exe
4176	FireDaemon.exe
5948	FireDaemon.exe
5036	FireDaemon.exe
4480	FireDaemon.exe
4928	winsecure.exe
4868	netclient.exe
4168	msagent.exe

Loads dropped DLL 23 IoCs

pid	Process
3632	FireDaemon.exe
3632	FireDaemon.exe
3632	FireDaemon.exe
3632	FireDaemon.exe
3632	FireDaemon.exe
4660	FireDaemon.exe
4660	FireDaemon.exe
4660	FireDaemon.exe
4660	FireDaemon.exe
4660	FireDaemon.exe
4176	FireDaemon.exe
4176	FireDaemon.exe
4176	FireDaemon.exe
4176	FireDaemon.exe
4176	FireDaemon.exe
5948	FireDaemon.exe
5036	FireDaemon.exe
4480	FireDaemon.exe
4168	msagent.exe
4928	winsecure.exe
4168	msagent.exe
4168	msagent.exe
4168	msagent.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update = "C:\\Windows\\"	msupdate.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msupdate.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File created	C:\Windows\security\msagent.xml	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File created	C:\Windows\security\weblog32.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File created	C:\Windows\security\cygwin1.dll	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File created	C:\Windows\security\logs\tar.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File created	C:\Windows\security\logs\nc.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File created	C:\Windows\security\sectemp	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File opened for modification	C:\Windows\security\libssl32.dll	msagent.exe
File opened for modification	C:\Windows\security	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File created	C:\Windows\security\sysproc.dll	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File created	C:\Windows\security\logs\schk.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File created	C:\Windows\security\libeay32.dll	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File created	C:\Windows\security\ssleay32.dll	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File created	C:\Windows\security\netconfig.dll	msconf.exe
File created	C:\Windows\security\winsecure.xml	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File created	C:\Windows\security\netclient.xml	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File created	C:\Windows\security\logs\wget.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File created	C:\Windows\security\msagent.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File opened for modification	C:\Windows\security\netconfig.dll	msagent.exe
File created	C:\Windows\security\libxml2.dll	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File created	C:\Windows\security\msconf.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File created	C:\Windows\security\winsecure.dll	weblog32.exe
File opened for modification	\??\c:\Windows\security\cache.004	winsecure.exe
File opened for modification	\??\c:\Windows\security\cache.005	winsecure.exe
File created	C:\Windows\security\SvcAdmin.dll	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File created	C:\Windows\security\FireDaemon.dtd	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File created	C:\Windows\security\BugSlayerUtil.dll	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File created	C:\Windows\security\winsecure.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File created	C:\Windows\security\netclient.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File created	C:\Windows\security\FireDaemon.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File created	C:\Windows\security\FireDaemonRT.dll	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
File opened for modification	\??\c:\Windows\security\cache.003	winsecure.exe
File created	\??\c:\Windows\security\cache.002	winsecure.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	winsecure.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	winsecure.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	msagent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	msagent.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FireDaemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FireDaemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FireDaemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msagent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	weblog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FireDaemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FireDaemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FireDaemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	secedit.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	winsecure.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Cygnus Solutions	winsecure.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Cygnus Solutions\Cygwin	winsecure.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Cygnus Solutions\Cygwin\mounts v2	winsecure.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Cygnus Solutions\Cygwin\Program Options	winsecure.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2612	msupdate.exe
2612	msupdate.exe
4168	msagent.exe
4168	msagent.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4804	ShellHost.exe
1768	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 2612	988	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe	88
PID 988 wrote to memory of 1564	988	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe	90
PID 988 wrote to memory of 3632	988	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe	92
PID 988 wrote to memory of 264	988	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe	95
PID 988 wrote to memory of 4660	988	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe	97
PID 988 wrote to memory of 4176	988	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe	99
PID 5036 wrote to memory of 4928	5036	FireDaemon.exe	104
PID 988 wrote to memory of 3700	988	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe	105
PID 4480 wrote to memory of 4868	4480	FireDaemon.exe	107
PID 5948 wrote to memory of 4168	5948	FireDaemon.exe	109
PID 988 wrote to memory of 3948	988	jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe	113

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\SysWOW64\msupdate.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2612
- C:\Windows\security\msconf.exe
  --basedir=C:\Windows\security netconfig.dll
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1564
- C:\Windows\security\FireDaemon.exe
  -i C:\Windows\security\msagent
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3632
- C:\Windows\security\weblog32.exe
  --fileprefix=cache winsecure.dll
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:264
- C:\Windows\security\FireDaemon.exe
  -i C:\Windows\security\winsecure.xml
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4660
- C:\Windows\security\FireDaemon.exe
  -i C:\Windows\security\netclient
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4176
- C:\Windows\SysWOW64\secedit.exe
  /configure /db C:\Users\Admin\AppData\Local\Temp\temp.mdb /cfg sectemp /areas USER_RIGHTS
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3700
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.pt.exe"
  2⤵
  PID:3948

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4804

C:\Windows\security\FireDaemon.exe
C:\Windows\security\FireDaemon.exe -s
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5948
- C:\Windows\security\msagent.exe
  C:\Windows\security\msagent.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4168

C:\Windows\security\FireDaemon.exe
C:\Windows\security\FireDaemon.exe -s
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\security\winsecure.exe
  C:\Windows\security\winsecure.exe winsecure.dll
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Modifies data under HKEY_USERS
  PID:4928

C:\Windows\security\FireDaemon.exe
C:\Windows\security\FireDaemon.exe -s
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\security\netclient.exe
  C:\Windows\security\netclient.exe
  2⤵
  - Executes dropped EXE
  PID:4868

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

msupdate.exe

Path C:\Windows\SysWOW64\msupdate.exe
Size 22KB
SHA256 6d332a094871fe48bea7f8ce972a9c631db6398c3e216049d338f1f06a7a734d
MD5 c4b47285d91a0ec55a1013513bc1bffa
SHA1 5997d1b3e89eff402e88504e697307d22ff4f89a
SHA512 052fe765ae11e5e761b32aff3d8ac3e00c8eb2f95cb042e714c11bdd3ea28b0a2d8168ecfbf9430f8e280b1c3fe033f918a3caec56afd3227bee1317ec14177a
SSDEEP 384:Z8RySdwdm25TDaJfrV7E43llYhFE94oNy0QIN9GHAxWr6+e9Pfqbn1:h3meYfrhhlwW6og0QIN9dxZha5
TLSH
T13EA2D13E6D8090FDC4CF247415F83E498B3FCA3461651D872792C06A382753DE4B6792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BugSlayerUtil.dll

Path C:\Windows\security\BugSlayerUtil.dll
Size 32KB
SHA256 e41736b0e5d328c3d828069edfd8cd90a359b0ae549a9195bff8e426b4bbb1b7
MD5 7fa6a4eb44c09ccd324ce804d3323010
SHA1 16194e340984c32f903f2d321eda9e4a0db67bd0
SHA512 c727c11445c1f109a9eef0d5bf8850ba8a5645074b1382bc6d2061cde5596e37fee53d5f07b8f6e79b76429d1f3cc649f1c133f6c3af6ad3be78dfcebcba7705
SSDEEP 384:uyEHHZEPhLoEFin4qpmx4+xKdWjlU+0/6AAdlkxkbLGJciuB6ZD252jvTNuz:uyEn6PhLo+Uc46U++wGw2DTU
TLSH
T101E23AB2E36616DFC29142B4A9A43F165AFE6C750C664AD741C40EAC152E8E5CD31E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FireDaemon.dtd

Path C:\Windows\security\FireDaemon.dtd
Size 2KB
SHA256 45ce51b01a94bd1d4432f3761035052078b3b434dc94af02ed0f2d93d00ec612
MD5 e63f6f3334db605ccedc0d2d99e9c9e0
SHA1 1e45853df50c079621c75847c66baba98408eb48
SHA512 514d6a9b60dbcdfb8f14a902497c6c64d9d94e990bf02b7b170afa33816045787c5c3e6b38bcdd572fa6131392f4083f78a417a2ffbd7019f4efcc3d35fa6a33
TLSH
T1F751828EA3CB6551A03085A46EB5A518CF35C3E36A030A1079DC11A7BFFE4793416EF5
MD5 SHA1 SHA512 TLSH

Submit Download

FireDaemon.exe

Path C:\Windows\security\FireDaemon.exe
Size 24KB
SHA256 a6910968305756bf13f90cdce3f1830ec2275585d677ea36183f69d88309e912
MD5 3ace6bb21bc80662abe4ad5374a840b2
SHA1 5ae539c6f9582cd7c569d1863be2c61ff9609b38
SHA512 437be72d44dc537a04d3de8412308d05d3e0d2b85c8e6f46747bf32dfe61af4d314b88b5ad54bc25038dcf1005f33009fbdbebc21ab26333b2d9872bc4569722
SSDEEP 192:vS2LS4KTyqXUi4aPie9t73jvjoXsYi7KYvP4oynd9I+h5lHY4OJCZ:a6KTGaq+7j934L9I+zxu
TLSH
T1A9B2080B0BD121B2F3C257311E62633EE73B65A56B70791B77ECE92C1782648C4636B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FireDaemonRT.dll

Path C:\Windows\security\FireDaemonRT.dll
Size 72KB
SHA256 2a13b285f31fda79a10e2c5e8d4a397494c825cf6a6a955dfa7df3cfc3a1596d
MD5 91d56d2a2538088d6469e703fc3ab2b9
SHA1 3dea697db785cb9c7498fcd8af1255233319e954
SHA512 75e64f641b6f127bfef5808a913379d225f93e6dd0c38486768f9309468f2c4d582cb27b6d1b4998e6745ad6e2b0c00a27ad120ecd6bd1aeca9de72e6be33440
SSDEEP 768:HoM6gAdZRapOD24JUh51huhQtOrXS2LUSpE8d6yyiT72ic80gA32PcN8dnISUs:IuAYIPrXS2QWE8dGm/cEAJCISU
TLSH
T16373B74223E542F2F2F9367079BA27360E3A7C94A97DC24F53A1E65D0C72994E870727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SvcAdmin.DLL

Path C:\Windows\security\SvcAdmin.DLL
Size 92KB
SHA256 ad43d5cbf81c06d51fc169d9589da7ca84e00e6eb01628389fb4a98e81b7cf23
MD5 03dd912f6814a93649bc2d4f50952baf
SHA1 e62a71c82bb63fe46add4b5a2de7f7e89713559d
SHA512 1b3287eb31e784b3af4f55cfc73e0d3ce0eeaa0b080c4a0faa0352452f06d9e6de81ab14f032989e8967fc8a705cabe6a466c25e783e44149f91d6c9ff01e6c7
SSDEEP 1536:9CzDUJroG1jPewDl0tf+o+y/5i4SgMiSO6xfoAIp:wzQJrP1eql0Vi4SgMO6loAi
TLSH
T11C935C137BC140FDCB8D0574209B7732C73AA68066806FA387FBED709EE7495A432646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cygwin1.dll

Path C:\Windows\security\cygwin1.dll
Size 451KB
SHA256 aa2b24b7f5bd53ddd82218e6999a366831bbf1718c77a2ef1d4375d43c102359
MD5 046a607165870af7bde80b4700a35064
SHA1 86c27a27361430cfa929a7d5f9fc0e2fac390d18
SHA512 efe03acfed7105c01432ebbb227e9dd689dd74cec4f9093851571ef159674d0d7ec905c79490d264792f2b39bf002ef6cb7d8485ed68fcc358bcbb41cef83b2b
SSDEEP 12288:k5O9urQXWmF2HAavdqLscFAEO3PCmYPVvUu:gO98QBFMvd6346mYPVsu
TLSH
T191A4234B692B84BAD3924F39C4B1720BC12AC0245B7ADFCDDE224FCC648766973B3595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libeay32.DLL

Path C:\Windows\security\libeay32.DLL
Size 648KB
SHA256 4f5968111152f21221551437b03a6a54a207f1ad6442049034aa5b2334da979f
MD5 13d6f93fe86f60d8f5894473ac05f07f
SHA1 642dcb3bde9076c4a188c0c572e22a3bc6e2f498
SHA512 466f398acf3577f30eb941fc88c7547d977e5404b8fc09c5f6a9bce9fef35bb1696c3934d0bb0b86ac63ab52a99b21ff679936f6c2cb7bf91601bc4b54c2019f
SSDEEP 12288:+5QjPmVVbf1xoA+6+U7MD4+DZblEYRmHxy:+mjPso5J4MDzDZpEMmHxy
TLSH
T126E49F47EAC294FAF94D157510B2533B5F3E4346421AD792E7B4CE828C22516BB3E3CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libxml2.dll

Path C:\Windows\security\libxml2.dll
Size 916KB
SHA256 6ee493159ac99930059f545244959e94794a18688194b72c8ae69b83e991ce62
MD5 adaf2e9fbdc397e810ab2e753e0e141e
SHA1 f72eaa726c98a9101a3f7ca028e7a57578e01a25
SHA512 21e9e6ff55c5ec3afc3d9009ee486a96721d613f81ce8b5bf5852384229af28f751cd6ce3143fc32811a68a9663d3d4fffce20eae1883cad2310d3a563278cf5
SSDEEP 12288:hxvYggYjqUn78VB3U2CXCUmUE2SVqbcxpdGSNjf0YPu/:Xv3n76hCXCPXAbcRGYsn
TLSH
T1B4153914E7A0902EE14A40F351B364BD7791B66143016ACB0EED2DD57B2A9F53E32E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msagent.exe

Path C:\Windows\security\msagent.exe
Size 516KB
SHA256 92bc5f26442498fe51a7d011b82b33fc923bedaae5e548eb740d284b98f97073
MD5 c64f40a2d8a6d7bec5dec9c40d0287bb
SHA1 94de991a7a8ab41ca196e8e58759ae3ae6394ca5
SHA512 05970fe2668e68384a5635510a20b47fb3f3045db73bc3bf14210f085562818bfa4ff6a926c2845ece3c36d168db5bed852dc62fae384c278b51ff298928aa4a
SSDEEP 12288:e7+hRM1BemRaf5VmQUOB6D/DTP3XPB+9s/9zCCFyaPBq3qrOh:E+hVQaf56Dn085s3qih
TLSH
T182B423A7CED43574DDABD0F2F4850EC2AE0861BB0BA13A49225125FF92CD363758F54A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msagent.xml

Path C:\Windows\security\msagent.xml
Size 768B
SHA256 bb5670d2db6157845db5bcf45e5186a8a7ed5db651d5e29b91af8a2541a0d325
MD5 073ad8df5d01dfbecdae0ac821cc8244
SHA1 30727193a484d646afc53b201f5f6a17681fe89d
SHA512 39abb56718c8384d8d5995e27e8133d35faa731af60c7f3fc32729de3d4693d37620bf21ec5d29ff9643338e45905b58486146a458ae69da61f29fb80ecfaaf0
TLSH
T1C9019C0819DE75F5107697241A6BCA08FF31AA87300BA192B0D2E1CBBFFD44E4C27891
MD5 SHA1 SHA512 TLSH

Submit Download

msconf.exe

Path C:\Windows\security\msconf.exe
Size 40KB
SHA256 ae830afb040158acf6fe68c522318836684632350c53bba2c1829dbf8f3ec549
MD5 5cfc8dbb1f30157260edd9f3f081cdf5
SHA1 1ceffcd9f02993fd0d23569142eba75785bc159c
SHA512 17b71730224e6d223c6854637b9bd80a9b5b0cbf3f1d2313a55720f4c5895e624920d1233b8febf8d1c7f4c9b59556848f6841ed3bf1f265c597851ae73dfd82
SSDEEP 384:+VdBhqwmlQmE7TBFSpBLlwbh9BR7RUSyBiZVov8kZw+vKGClxcb8cB:pdMBFmL2bh7US4iZS3kGClDc
TLSH
T124036D667CF0C137E0924A7220724B3BEF7B626642E141C7CB249EB67C61991AE3B355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netclient.exe

Path C:\Windows\security\netclient.exe
Size 22KB
SHA256 e611167d2e662d4e14dc83fe242cecea60f3493b6557e1c87a41b992df3b898d
MD5 e5c854620aedfa59b784b5231e5a448f
SHA1 22e03443b1e6e01b4787ef8f2c2b8e419498c170
SHA512 16af2005802d355f68fe22c5b172cf86d6d4168a4e0cacc2fd69c0c223759bfeced4c20e9e80757ce0a054bca9745ba1a65511c785b8692bbfc0708a0de9d3c9
SSDEEP 384:Y45Ea/dkYZb4Y6Ly3YyCxGvgnKXaorpv09o2pwnosmXKAxQr6+e9Pfqbn1l:ldkYvgxGonzoEHpwnosmXNxXha5l
TLSH
T178A2C038FF4588F9C2C61CB3009FA88B4A9B716304B6701353FD05B9E52592DDDBAD29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netclient.xml

Path C:\Windows\security\netclient.xml
Size 776B
SHA256 1a9505c723aaba5586196ef1fa9a1910e0bd91f8a91bfa69fe3845e5834ccc14
MD5 ddb1d5026459a1260ed3714cb72efba7
SHA1 7bfdbeab56aac92b85d0ab21e872e56166bbef07
SHA512 eb669de7661845308c975e80ad303498563008131640d145a3b73dc6a178b85753c2bb4fd60685ba6a9a6b1228dcaccd437a203c1b866495a86622ab68e0d188
TLSH
T184016D0419DE65F9207697194A7EC609FF31BA83340B52D170D091CF7FF844D4C2B4A5
MD5 SHA1 SHA512 TLSH

Submit Download

netconfig.dll

Path C:\Windows\security\netconfig.dll
Size 1KB
SHA256 9512b24c6b9e57c38baa97af26bee203d6242c06d4909e9c4410ced35842bc70
MD5 819c5b89a502f621a5153cf1e71dbd1f
SHA1 4b15766250e8e0976dc202fd63df375df99873a2
SHA512 d9047dda1dea4cccb91ab280e670a6e2aa587c5967b690cdff3f9d579219f01ff64cd37af0cca0967cc1ece19716fcc6a7dd6b64bde4b48498070054003abef3
TLSH
T16011EB15D41C49A660A2C6BC247CC73A16D4D9A33D2353A4D76A3C6CBCC2F2A0DBA0F6
MD5 SHA1 SHA512 TLSH

Submit Download

ssleay32.DLL

Path C:\Windows\security\ssleay32.DLL
Size 152KB
SHA256 a4c3ff8f36291dcd78aee4870e33559672c432a7b23381b80c1593a14a4ff1f2
MD5 d7103a683acf83407b608fa040ea136d
SHA1 7414a6e5b229c1f0b1921c8efe7578c68ee3f8ac
SHA512 3533efd78e584b73aa8b4caed2935e001e6ad73684b0b66399fce3efa8e78dbeff848cf2a7d42b5bbdf7e249bd9f9ca67a58d0868cfeb0e3a88d38c915c1fbfc
SSDEEP 3072:hOjQxYCEt9bZX/xABGCTPmFWa0C3l7ud7aslz:hOWet9bZZyGtWa0C3Vslz
TLSH
T105E34A03748318B6E7C993B1517653B7AF3AB70DE31985B2A772CDE91C21145EA0C2EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

weblog32.exe

Path C:\Windows\security\weblog32.exe
Size 52KB
SHA256 c5129ffce4c2f41848338116ce2021628be15651249a937fca17eb5d2f9c847e
MD5 f619c26d66d37494c1e4e3010482c6aa
SHA1 40ad3ad918bd3a60a15d46f58416835733af1d16
SHA512 16b2931de8f477506efaa326ba1b2106b92d4dfbe9ff7847418a82b4a50d278a43303791930fd82feeaf51af024eb6a7ec1ce73497891aab2731041fe32cd62f
SSDEEP 768:yUj5emthMFp2sST+Ne7FZfGiB9gTD+ss2zS5GGlrhScon:ym5I8sSweRF6K92zqlJo
TLSH
T10A338E5B7CE58273DC8114B224B14E2B6F7BD21603128457CF2CD8AAAD91A94DE2F337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winsecure.exe

Path C:\Windows\security\winsecure.exe
Size 78KB
SHA256 e4fe6a3b0beb12cabdecac05bd220baecef948e77d28cca84ab92cb9d9339959
MD5 1f4a5a69fc3119bfd1f12ff8ae68290b
SHA1 b32ebd3ca86b75ec3260dad14bdf079f5e0f8e53
SHA512 889c3bc9fe786b72847bad21c18a527934b2bb28530f497ea928c3cd63663b2a8359038348677866df4e1c91987275c45e6d15fb62d4ee9b8d220080bbb32a56
SSDEEP 1536:jrzSPYPNJn23Yc5N5ScCqnNR65K+TthkfBGtL1pcLu4c4pjnGR:jxJ2oc5N51nNRBmPLkLu41jG
TLSH
T1237302E82AAC54EBCC5F9D78FF1F3023DBEAB615F62B881BCEF504404ED5884151A621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winsecure.xml

Path C:\Windows\security\winsecure.xml
Size 820B
SHA256 eef1e69a5fb5630e1701ce415f2aa144f8cd42a862f5a7b11e9c98740a45ddc6
MD5 bc70fbe90d30c4db52465eff487ee748
SHA1 5a29c65a840e75c9f61fdbd2f030275077698dd2
SHA512 e9d4fdcddbbf410722b8d988446ca9e1f7802515eea541061621dc8b3c291fa5480c9c0289a96cac84016dfcd9d19dc7f035c181ca0389b2d4f221ed502b6d9b
TLSH
T14201890415DE29E61036A6160A6AC65CEF71AEC3300B029370D1A1CB7FFE54D8C2B9D5
MD5 SHA1 SHA512 TLSH

Submit Download

winsecure.dll

Path \??\c:\Windows\security\winsecure.dll
Size 1KB
SHA256 2a5881e640972e9e201aef608af5c26ea4726c798a58ad195ebddf54bf06cd61
MD5 d65e36ed2f31442a45fd7fd2b59bdbc5
SHA1 f8fb50979275f144839d3e91f5155cc934dc5024
SHA512 5e1e798be27107deab58ad8f22f3ee50a2ca81e8b09eb28f430744aa7eeb62a95c6691d1d57680b9b91b17c8ca2f6625a17b5849d2b65ccb917b67ec0ff44db7
TLSH
T16F3159859EA7CF8D1CFD378680E3111857DEE210FF1A595B733AC169D012802D5FE695
MD5 SHA1 SHA512 TLSH

Submit Download

memory/988-1-0x000000000040D000-0x000000000040E000-memory.dmp

Download

memory/988-0-0x0000000000400000-0x00000000007BE000-memory.dmp

Download

memory/988-201-0x0000000000400000-0x00000000007BE000-memory.dmp

Download

memory/2612-9-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/2612-6-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3632-36-0x00000000005F0000-0x0000000000607000-memory.dmp

Download

memory/3632-41-0x0000000002250000-0x0000000002337000-memory.dmp

Download

memory/3948-200-0x0000000000400000-0x00000000007BE000-memory.dmp

Download

memory/4168-304-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/4168-289-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/4168-290-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/4168-198-0x0000000001130000-0x0000000001156000-memory.dmp

Download

memory/4168-95-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/4168-298-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/4168-245-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/4168-325-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/4168-331-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/4168-282-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/4168-275-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/4168-238-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/4168-259-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/4168-252-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/4176-73-0x00000000020C0000-0x00000000021A7000-memory.dmp

Download

memory/4176-69-0x0000000000650000-0x0000000000667000-memory.dmp

Download

memory/4660-57-0x0000000000890000-0x00000000008A7000-memory.dmp

Download

memory/4660-60-0x0000000002200000-0x00000000022E7000-memory.dmp

Download

memory/4868-237-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4868-92-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4928-272-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4928-295-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4928-243-0x0000000061000000-0x0000000061166000-memory.dmp

Download

memory/4928-236-0x0000000061000000-0x0000000061166000-memory.dmp

Download

memory/4928-278-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4928-279-0x0000000061000000-0x0000000061166000-memory.dmp

Download

memory/4928-235-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4928-285-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4928-286-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4928-257-0x0000000061000000-0x0000000061166000-memory.dmp

Download

memory/4928-191-0x0000000061000000-0x0000000061166000-memory.dmp

Download

memory/4928-263-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4928-256-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4928-301-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4928-89-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4928-308-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4928-309-0x0000000061000000-0x0000000061166000-memory.dmp

Download

memory/4928-314-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4928-322-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4928-242-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4928-328-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4928-329-0x0000000061000000-0x0000000061166000-memory.dmp

Download

memory/4928-249-0x0000000000400000-0x000000000043D000-memory.dmp

Download