6484ae6bc36529a87c2da7d483b141ae88d4d289d8c53f6dfb0e5eddbdecd995

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
Size 3.8MB
Sample261006-tkd6rs1ydt
SHA256 6484ae6bc36529a87c2da7d483b141ae88d4d289d8c53f6dfb0e5eddbdecd995
MD5 ec7d0c681591e75a86a5f2bc954d006a
SHA1 600d5d49c64d0051f9804a12300f26c44c0b9d1d
SHA512 6db921c3b3b86b6091a63a84f948b179acdcd1f03464b27570ee3944b1853ec6124bf1635a6b3cc0e3ed9e1456a8da284d9fbedbd46b437f051da2c39ca8209f
SSDEEP 49152:vqrNUvL6RQRYYKQaf5DOs3Hl8MD/NmRyui8TQpmYP+t+NJXt8vQVEL:vqrNymx3Hl8MTNmKpmYP+t+NJXtFEL
TLSH
T14F06E102E690807AE18901F251B3133A6B35AE1103119ACB5BB8FED57F365E17F3A75B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

aspackv2 discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 5 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001b00000000696b-3.dat	aspack_v212_v242
behavioral2/files/0x001000000001c4d8-80.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c4e3-84.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c4e8-89.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c4e4-187.dat	aspack_v212_v242

Executes dropped EXE 12 IoCs

pid	Process
3244	msupdate.exe
2452	msconf.exe
52	FireDaemon.exe
1308	weblog32.exe
3256	FireDaemon.exe
704	FireDaemon.exe
2800	FireDaemon.exe
2496	FireDaemon.exe
2548	FireDaemon.exe
5344	msagent.exe
5888	winsecure.exe
4876	netclient.exe

Loads dropped DLL 23 IoCs

pid	Process
52	FireDaemon.exe
52	FireDaemon.exe
52	FireDaemon.exe
52	FireDaemon.exe
52	FireDaemon.exe
3256	FireDaemon.exe
3256	FireDaemon.exe
3256	FireDaemon.exe
3256	FireDaemon.exe
3256	FireDaemon.exe
704	FireDaemon.exe
704	FireDaemon.exe
704	FireDaemon.exe
704	FireDaemon.exe
704	FireDaemon.exe
2800	FireDaemon.exe
2496	FireDaemon.exe
2548	FireDaemon.exe
5344	msagent.exe
5888	winsecure.exe
5344	msagent.exe
5344	msagent.exe
5344	msagent.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update = "C:\\Windows\\"	msupdate.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msupdate.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File created	C:\Windows\security\libxml2.dll	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File created	C:\Windows\security\FireDaemon.dtd	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File created	C:\Windows\security\winsecure.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File created	C:\Windows\security\netclient.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File opened for modification	\??\c:\Windows\security\cache.003	winsecure.exe
File created	C:\Windows\security\ssleay32.dll	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File created	C:\Windows\security\winsecure.xml	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File created	C:\Windows\security\sectemp	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File created	C:\Windows\security\libeay32.dll	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File created	C:\Windows\security\msconf.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File created	C:\Windows\security\FireDaemon.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File opened for modification	C:\Windows\security\libssl32.dll	msagent.exe
File created	C:\Windows\security\msagent.xml	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File opened for modification	C:\Windows\security	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File created	C:\Windows\security\msagent.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File created	C:\Windows\security\cygwin1.dll	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File created	C:\Windows\security\weblog32.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File created	C:\Windows\security\netclient.xml	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File opened for modification	\??\c:\Windows\security\cache.004	winsecure.exe
File created	C:\Windows\security\BugSlayerUtil.dll	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File created	C:\Windows\security\sysproc.dll	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File created	C:\Windows\security\winsecure.dll	weblog32.exe
File created	C:\Windows\security\logs\schk.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File created	C:\Windows\security\logs\tar.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File opened for modification	\??\c:\Windows\security\cache.005	winsecure.exe
File created	C:\Windows\security\netconfig.dll	msconf.exe
File created	C:\Windows\security\SvcAdmin.dll	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File created	C:\Windows\security\FireDaemonRT.dll	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File created	C:\Windows\security\logs\nc.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File created	C:\Windows\security\logs\wget.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
File created	\??\c:\Windows\security\cache.002	winsecure.exe
File opened for modification	C:\Windows\security\netconfig.dll	msagent.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	msagent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	winsecure.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	winsecure.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	msagent.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FireDaemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FireDaemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FireDaemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FireDaemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FireDaemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	weblog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FireDaemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msagent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	secedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	winsecure.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Cygnus Solutions	winsecure.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Cygnus Solutions\Cygwin	winsecure.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Cygnus Solutions\Cygwin\mounts v2	winsecure.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Cygnus Solutions\Cygwin\Program Options	winsecure.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3244	msupdate.exe
3244	msupdate.exe
5344	msagent.exe
5344	msagent.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1420	ShellHost.exe
716	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 3244	2528	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe	88
PID 2528 wrote to memory of 2452	2528	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe	90
PID 2528 wrote to memory of 52	2528	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe	92
PID 2528 wrote to memory of 1308	2528	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe	95
PID 2528 wrote to memory of 3256	2528	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe	97
PID 2528 wrote to memory of 704	2528	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe	99
PID 2800 wrote to memory of 5344	2800	FireDaemon.exe	105
PID 2528 wrote to memory of 1924	2528	jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe	107
PID 2496 wrote to memory of 5888	2496	FireDaemon.exe	106
PID 2548 wrote to memory of 4876	2548	FireDaemon.exe	108

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.oa.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\msupdate.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3244
- C:\Windows\security\msconf.exe
  --basedir=C:\Windows\security netconfig.dll
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2452
- C:\Windows\security\FireDaemon.exe
  -i C:\Windows\security\msagent
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:52
- C:\Windows\security\weblog32.exe
  --fileprefix=cache winsecure.dll
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1308
- C:\Windows\security\FireDaemon.exe
  -i C:\Windows\security\winsecure.xml
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3256
- C:\Windows\security\FireDaemon.exe
  -i C:\Windows\security\netclient
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:704
- C:\Windows\SysWOW64\secedit.exe
  /configure /db C:\Users\Admin\AppData\Local\Temp\temp.mdb /cfg sectemp /areas USER_RIGHTS
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1924

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1420

C:\Windows\security\FireDaemon.exe
C:\Windows\security\FireDaemon.exe -s
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\security\msagent.exe
  C:\Windows\security\msagent.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5344

C:\Windows\security\FireDaemon.exe
C:\Windows\security\FireDaemon.exe -s
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\security\winsecure.exe
  C:\Windows\security\winsecure.exe winsecure.dll
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Modifies data under HKEY_USERS
  PID:5888

C:\Windows\security\FireDaemon.exe
C:\Windows\security\FireDaemon.exe -s
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\security\netclient.exe
  C:\Windows\security\netclient.exe
  2⤵
  - Executes dropped EXE
  PID:4876

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

msupdate.exe

Path C:\Windows\SysWOW64\msupdate.exe
Size 22KB
SHA256 6d332a094871fe48bea7f8ce972a9c631db6398c3e216049d338f1f06a7a734d
MD5 c4b47285d91a0ec55a1013513bc1bffa
SHA1 5997d1b3e89eff402e88504e697307d22ff4f89a
SHA512 052fe765ae11e5e761b32aff3d8ac3e00c8eb2f95cb042e714c11bdd3ea28b0a2d8168ecfbf9430f8e280b1c3fe033f918a3caec56afd3227bee1317ec14177a
SSDEEP 384:Z8RySdwdm25TDaJfrV7E43llYhFE94oNy0QIN9GHAxWr6+e9Pfqbn1:h3meYfrhhlwW6og0QIN9dxZha5
TLSH
T13EA2D13E6D8090FDC4CF247415F83E498B3FCA3461651D872792C06A382753DE4B6792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BugSlayerUtil.dll

Path C:\Windows\security\BugSlayerUtil.dll
Size 32KB
SHA256 e41736b0e5d328c3d828069edfd8cd90a359b0ae549a9195bff8e426b4bbb1b7
MD5 7fa6a4eb44c09ccd324ce804d3323010
SHA1 16194e340984c32f903f2d321eda9e4a0db67bd0
SHA512 c727c11445c1f109a9eef0d5bf8850ba8a5645074b1382bc6d2061cde5596e37fee53d5f07b8f6e79b76429d1f3cc649f1c133f6c3af6ad3be78dfcebcba7705
SSDEEP 384:uyEHHZEPhLoEFin4qpmx4+xKdWjlU+0/6AAdlkxkbLGJciuB6ZD252jvTNuz:uyEn6PhLo+Uc46U++wGw2DTU
TLSH
T101E23AB2E36616DFC29142B4A9A43F165AFE6C750C664AD741C40EAC152E8E5CD31E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FireDaemon.dtd

Path C:\Windows\security\FireDaemon.dtd
Size 2KB
SHA256 45ce51b01a94bd1d4432f3761035052078b3b434dc94af02ed0f2d93d00ec612
MD5 e63f6f3334db605ccedc0d2d99e9c9e0
SHA1 1e45853df50c079621c75847c66baba98408eb48
SHA512 514d6a9b60dbcdfb8f14a902497c6c64d9d94e990bf02b7b170afa33816045787c5c3e6b38bcdd572fa6131392f4083f78a417a2ffbd7019f4efcc3d35fa6a33
TLSH
T1F751828EA3CB6551A03085A46EB5A518CF35C3E36A030A1079DC11A7BFFE4793416EF5
MD5 SHA1 SHA512 TLSH

Submit Download

FireDaemon.exe

Path C:\Windows\security\FireDaemon.exe
Size 24KB
SHA256 a6910968305756bf13f90cdce3f1830ec2275585d677ea36183f69d88309e912
MD5 3ace6bb21bc80662abe4ad5374a840b2
SHA1 5ae539c6f9582cd7c569d1863be2c61ff9609b38
SHA512 437be72d44dc537a04d3de8412308d05d3e0d2b85c8e6f46747bf32dfe61af4d314b88b5ad54bc25038dcf1005f33009fbdbebc21ab26333b2d9872bc4569722
SSDEEP 192:vS2LS4KTyqXUi4aPie9t73jvjoXsYi7KYvP4oynd9I+h5lHY4OJCZ:a6KTGaq+7j934L9I+zxu
TLSH
T1A9B2080B0BD121B2F3C257311E62633EE73B65A56B70791B77ECE92C1782648C4636B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FireDaemonRT.dll

Path C:\Windows\security\FireDaemonRT.dll
Size 72KB
SHA256 2a13b285f31fda79a10e2c5e8d4a397494c825cf6a6a955dfa7df3cfc3a1596d
MD5 91d56d2a2538088d6469e703fc3ab2b9
SHA1 3dea697db785cb9c7498fcd8af1255233319e954
SHA512 75e64f641b6f127bfef5808a913379d225f93e6dd0c38486768f9309468f2c4d582cb27b6d1b4998e6745ad6e2b0c00a27ad120ecd6bd1aeca9de72e6be33440
SSDEEP 768:HoM6gAdZRapOD24JUh51huhQtOrXS2LUSpE8d6yyiT72ic80gA32PcN8dnISUs:IuAYIPrXS2QWE8dGm/cEAJCISU
TLSH
T16373B74223E542F2F2F9367079BA27360E3A7C94A97DC24F53A1E65D0C72994E870727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SvcAdmin.DLL

Path C:\Windows\security\SvcAdmin.DLL
Size 92KB
SHA256 ad43d5cbf81c06d51fc169d9589da7ca84e00e6eb01628389fb4a98e81b7cf23
MD5 03dd912f6814a93649bc2d4f50952baf
SHA1 e62a71c82bb63fe46add4b5a2de7f7e89713559d
SHA512 1b3287eb31e784b3af4f55cfc73e0d3ce0eeaa0b080c4a0faa0352452f06d9e6de81ab14f032989e8967fc8a705cabe6a466c25e783e44149f91d6c9ff01e6c7
SSDEEP 1536:9CzDUJroG1jPewDl0tf+o+y/5i4SgMiSO6xfoAIp:wzQJrP1eql0Vi4SgMO6loAi
TLSH
T11C935C137BC140FDCB8D0574209B7732C73AA68066806FA387FBED709EE7495A432646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cygwin1.dll

Path C:\Windows\security\cygwin1.dll
Size 451KB
SHA256 aa2b24b7f5bd53ddd82218e6999a366831bbf1718c77a2ef1d4375d43c102359
MD5 046a607165870af7bde80b4700a35064
SHA1 86c27a27361430cfa929a7d5f9fc0e2fac390d18
SHA512 efe03acfed7105c01432ebbb227e9dd689dd74cec4f9093851571ef159674d0d7ec905c79490d264792f2b39bf002ef6cb7d8485ed68fcc358bcbb41cef83b2b
SSDEEP 12288:k5O9urQXWmF2HAavdqLscFAEO3PCmYPVvUu:gO98QBFMvd6346mYPVsu
TLSH
T191A4234B692B84BAD3924F39C4B1720BC12AC0245B7ADFCDDE224FCC648766973B3595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libeay32.DLL

Path C:\Windows\security\libeay32.DLL
Size 648KB
SHA256 4f5968111152f21221551437b03a6a54a207f1ad6442049034aa5b2334da979f
MD5 13d6f93fe86f60d8f5894473ac05f07f
SHA1 642dcb3bde9076c4a188c0c572e22a3bc6e2f498
SHA512 466f398acf3577f30eb941fc88c7547d977e5404b8fc09c5f6a9bce9fef35bb1696c3934d0bb0b86ac63ab52a99b21ff679936f6c2cb7bf91601bc4b54c2019f
SSDEEP 12288:+5QjPmVVbf1xoA+6+U7MD4+DZblEYRmHxy:+mjPso5J4MDzDZpEMmHxy
TLSH
T126E49F47EAC294FAF94D157510B2533B5F3E4346421AD792E7B4CE828C22516BB3E3CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libxml2.dll

Path C:\Windows\security\libxml2.dll
Size 916KB
SHA256 6ee493159ac99930059f545244959e94794a18688194b72c8ae69b83e991ce62
MD5 adaf2e9fbdc397e810ab2e753e0e141e
SHA1 f72eaa726c98a9101a3f7ca028e7a57578e01a25
SHA512 21e9e6ff55c5ec3afc3d9009ee486a96721d613f81ce8b5bf5852384229af28f751cd6ce3143fc32811a68a9663d3d4fffce20eae1883cad2310d3a563278cf5
SSDEEP 12288:hxvYggYjqUn78VB3U2CXCUmUE2SVqbcxpdGSNjf0YPu/:Xv3n76hCXCPXAbcRGYsn
TLSH
T1B4153914E7A0902EE14A40F351B364BD7791B66143016ACB0EED2DD57B2A9F53E32E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msagent.exe

Path C:\Windows\security\msagent.exe
Size 516KB
SHA256 92bc5f26442498fe51a7d011b82b33fc923bedaae5e548eb740d284b98f97073
MD5 c64f40a2d8a6d7bec5dec9c40d0287bb
SHA1 94de991a7a8ab41ca196e8e58759ae3ae6394ca5
SHA512 05970fe2668e68384a5635510a20b47fb3f3045db73bc3bf14210f085562818bfa4ff6a926c2845ece3c36d168db5bed852dc62fae384c278b51ff298928aa4a
SSDEEP 12288:e7+hRM1BemRaf5VmQUOB6D/DTP3XPB+9s/9zCCFyaPBq3qrOh:E+hVQaf56Dn085s3qih
TLSH
T182B423A7CED43574DDABD0F2F4850EC2AE0861BB0BA13A49225125FF92CD363758F54A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msagent.xml

Path C:\Windows\security\msagent.xml
Size 768B
SHA256 bb5670d2db6157845db5bcf45e5186a8a7ed5db651d5e29b91af8a2541a0d325
MD5 073ad8df5d01dfbecdae0ac821cc8244
SHA1 30727193a484d646afc53b201f5f6a17681fe89d
SHA512 39abb56718c8384d8d5995e27e8133d35faa731af60c7f3fc32729de3d4693d37620bf21ec5d29ff9643338e45905b58486146a458ae69da61f29fb80ecfaaf0
TLSH
T1C9019C0819DE75F5107697241A6BCA08FF31AA87300BA192B0D2E1CBBFFD44E4C27891
MD5 SHA1 SHA512 TLSH

Submit Download

msconf.exe

Path C:\Windows\security\msconf.exe
Size 48KB
SHA256 906d187cababb03ae3251062f356c2e569fe1df05e51ffd290e555f760d09a28
MD5 48a504c8a63b5bee76acd500cf6d6fe0
SHA1 dd4dba15baa1cc3addde5bb2f73bf806b6b9c89e
SHA512 8456829e9044e3305e8c6e593b450e7ab976d6356771311064712e26945d95a900fb6806cf15412dd192371cee972be91b0c0e183958e4832a2d8deffe1ea812
SSDEEP 384:5UvD6H+wO0eobw7rIjpNUBETI6SVihT7ckSQ/k/CPtMd1yvq7hiogZbw1KhczPEk:2S9bwSQeI6pBcWPG1Piog2oGTwxAoYb
TLSH
T144237D2B7CD58273D4C246B26A724B3AAF3B563605914093CF149E2A7D719B0EE3B246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netclient.exe

Path C:\Windows\security\netclient.exe
Size 22KB
SHA256 e611167d2e662d4e14dc83fe242cecea60f3493b6557e1c87a41b992df3b898d
MD5 e5c854620aedfa59b784b5231e5a448f
SHA1 22e03443b1e6e01b4787ef8f2c2b8e419498c170
SHA512 16af2005802d355f68fe22c5b172cf86d6d4168a4e0cacc2fd69c0c223759bfeced4c20e9e80757ce0a054bca9745ba1a65511c785b8692bbfc0708a0de9d3c9
SSDEEP 384:Y45Ea/dkYZb4Y6Ly3YyCxGvgnKXaorpv09o2pwnosmXKAxQr6+e9Pfqbn1l:ldkYvgxGonzoEHpwnosmXNxXha5l
TLSH
T178A2C038FF4588F9C2C61CB3009FA88B4A9B716304B6701353FD05B9E52592DDDBAD29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netclient.xml

Path C:\Windows\security\netclient.xml
Size 776B
SHA256 1a9505c723aaba5586196ef1fa9a1910e0bd91f8a91bfa69fe3845e5834ccc14
MD5 ddb1d5026459a1260ed3714cb72efba7
SHA1 7bfdbeab56aac92b85d0ab21e872e56166bbef07
SHA512 eb669de7661845308c975e80ad303498563008131640d145a3b73dc6a178b85753c2bb4fd60685ba6a9a6b1228dcaccd437a203c1b866495a86622ab68e0d188
TLSH
T184016D0419DE65F9207697194A7EC609FF31BA83340B52D170D091CF7FF844D4C2B4A5
MD5 SHA1 SHA512 TLSH

Submit Download

netconfig.dll

Path C:\Windows\security\netconfig.dll
Size 1KB
SHA256 d8fb4ef830b84f7904680d0ee61b62e694ab777db0e860ea6c6fb10b60faf0a2
MD5 9e547502b79ff2a8bef0f0d224e5ecc8
SHA1 87e39b5c3936d04633427e024fec4487ac85dbd9
SHA512 776dd2673fe3468e83bed33755d809f8fd77e52e5bcf55434491c74df2dd707b84fd31b8bb2d5b4b42d1725672167722242a16ae06f441565bb1bad6f2c2011b
TLSH
T12D111F09D81D09A86092D6FC247C833A16D8C9923D235764DB5E384CFCC2F161CF60F1
MD5 SHA1 SHA512 TLSH

Submit Download

ssleay32.DLL

Path C:\Windows\security\ssleay32.DLL
Size 152KB
SHA256 a4c3ff8f36291dcd78aee4870e33559672c432a7b23381b80c1593a14a4ff1f2
MD5 d7103a683acf83407b608fa040ea136d
SHA1 7414a6e5b229c1f0b1921c8efe7578c68ee3f8ac
SHA512 3533efd78e584b73aa8b4caed2935e001e6ad73684b0b66399fce3efa8e78dbeff848cf2a7d42b5bbdf7e249bd9f9ca67a58d0868cfeb0e3a88d38c915c1fbfc
SSDEEP 3072:hOjQxYCEt9bZX/xABGCTPmFWa0C3l7ud7aslz:hOWet9bZZyGtWa0C3Vslz
TLSH
T105E34A03748318B6E7C993B1517653B7AF3AB70DE31985B2A772CDE91C21145EA0C2EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

weblog32.exe

Path C:\Windows\security\weblog32.exe
Size 60KB
SHA256 58dd2e4e1b6e039252880c55be4b666e99b3fe86c5c38246cd21314f2d5a3e18
MD5 16b85f68b466dc43303b8051bada1c66
SHA1 0b4a905e5594e87dbf557ce3d2d356edadeaa435
SHA512 111d73be60bbeb304cb033403c1ee05ca868e75b4384e75a58bcf1fcd2add50d32c30c3af6b8fed8ae33a9a8d594bc2e5653189e111eac78501d7e9092c3d1a7
SSDEEP 768:UDn72XrlixdWTI0VU+NlFMIyskIeaoZQdd6iB90nvn9ysy0E8AofhJG:U2X4SU+NlWIyZIeD+dU/k7oT
TLSH
T1CF538E9B7CEA8173CC9115B215B04A376B7FD222035184A78F5CD95E9DA0E94CA3F23B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winsecure.exe

Path C:\Windows\security\winsecure.exe
Size 78KB
SHA256 e4fe6a3b0beb12cabdecac05bd220baecef948e77d28cca84ab92cb9d9339959
MD5 1f4a5a69fc3119bfd1f12ff8ae68290b
SHA1 b32ebd3ca86b75ec3260dad14bdf079f5e0f8e53
SHA512 889c3bc9fe786b72847bad21c18a527934b2bb28530f497ea928c3cd63663b2a8359038348677866df4e1c91987275c45e6d15fb62d4ee9b8d220080bbb32a56
SSDEEP 1536:jrzSPYPNJn23Yc5N5ScCqnNR65K+TthkfBGtL1pcLu4c4pjnGR:jxJ2oc5N51nNRBmPLkLu41jG
TLSH
T1237302E82AAC54EBCC5F9D78FF1F3023DBEAB615F62B881BCEF504404ED5884151A621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winsecure.xml

Path C:\Windows\security\winsecure.xml
Size 820B
SHA256 eef1e69a5fb5630e1701ce415f2aa144f8cd42a862f5a7b11e9c98740a45ddc6
MD5 bc70fbe90d30c4db52465eff487ee748
SHA1 5a29c65a840e75c9f61fdbd2f030275077698dd2
SHA512 e9d4fdcddbbf410722b8d988446ca9e1f7802515eea541061621dc8b3c291fa5480c9c0289a96cac84016dfcd9d19dc7f035c181ca0389b2d4f221ed502b6d9b
TLSH
T14201890415DE29E61036A6160A6AC65CEF71AEC3300B029370D1A1CB7FFE54D8C2B9D5
MD5 SHA1 SHA512 TLSH

Submit Download

winsecure.dll

Path \??\c:\Windows\security\winsecure.dll
Size 1KB
SHA256 2c82b0159c2f5ff2383d9597344209992e132da8324a7f6135818c12f0ba3dde
MD5 0a9ffd0ccf4db133752958ea044bac15
SHA1 4afea11fd81979e357cd855d776f3050528b2a7b
SHA512 73ba91468bc85d0cca64de4171824975f129a5313d6e2d02b62fdec2bfed093fbc9ab6ed8541c01b2fbd6c071833417f064be28af2a18298c8b9b13b473f99ac
TLSH
T1C33134D2AE57CE852CF9378D80E3115853CEE210FB16955BB339C15D9422402DABE5E8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/52-34-0x00000000005F0000-0x0000000000607000-memory.dmp

Download

memory/52-38-0x0000000002210000-0x00000000022F7000-memory.dmp

Download

memory/704-70-0x00000000008B0000-0x0000000000997000-memory.dmp

Download

memory/3244-4-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3244-7-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3256-59-0x0000000002190000-0x0000000002277000-memory.dmp

Download

memory/3256-55-0x0000000000890000-0x00000000008A7000-memory.dmp

Download

memory/4876-186-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5344-322-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/5344-243-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/5344-199-0x0000000001610000-0x0000000001636000-memory.dmp

Download

memory/5344-328-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/5344-263-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/5344-314-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/5344-236-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/5344-86-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/5344-301-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/5344-295-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/5344-249-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/5344-288-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/5344-285-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/5344-279-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/5344-256-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/5344-272-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/5888-237-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5888-265-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5888-258-0x0000000061000000-0x0000000061166000-memory.dmp

Download

memory/5888-273-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5888-257-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5888-280-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5888-281-0x0000000061000000-0x0000000061166000-memory.dmp

Download

memory/5888-252-0x0000000061000000-0x0000000061166000-memory.dmp

Download

memory/5888-286-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5888-289-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5888-251-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5888-245-0x0000000061000000-0x0000000061166000-memory.dmp

Download

memory/5888-296-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5888-244-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5888-302-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5888-309-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5888-310-0x0000000061000000-0x0000000061166000-memory.dmp

Download

memory/5888-238-0x0000000061000000-0x0000000061166000-memory.dmp

Download

memory/5888-315-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5888-189-0x0000000061000000-0x0000000061166000-memory.dmp

Download

memory/5888-323-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5888-184-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5888-329-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5888-330-0x0000000061000000-0x0000000061166000-memory.dmp

Download