Malware Analysis Report

2025-04-13 12:14

Sample ID 240330-rc3s2sga5w
Target 3d7d4ced171a608319381205863c8789_JaffaCakes118
SHA256 3a0b3da99b6c5f838bd0efec535f635e2d19d16834981f727f12a4539b61766d
Tags
quasar zgrat broc rat spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3a0b3da99b6c5f838bd0efec535f635e2d19d16834981f727f12a4539b61766d

Threat Level: Known bad

The file 3d7d4ced171a608319381205863c8789_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

quasar zgrat broc rat spyware trojan

Quasar RAT

Quasar payload

Detect ZGRat V1

ZGRat

Checks computer location settings

Deletes itself

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-30 14:03

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-30 14:03

Reported

2024-03-30 14:06

Platform

win7-20240221-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe"

Signatures

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

ZGRat

rat zgrat

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2008 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe
PID 2008 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe
PID 2008 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe
PID 2008 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe
PID 2008 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe
PID 2008 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe
PID 2008 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe
PID 2008 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe
PID 2008 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe
PID 2504 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2504 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2504 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2504 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2044 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2044 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2044 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2044 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2044 wrote to memory of 404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2044 wrote to memory of 404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2044 wrote to memory of 404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2044 wrote to memory of 404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe" -Force

C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\qyekNG8bBvli.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 sommerishere.sytes.net udp

Files

memory/2008-0-0x00000000010C0000-0x0000000001226000-memory.dmp

memory/2008-1-0x0000000074840000-0x0000000074F2E000-memory.dmp

memory/2008-2-0x0000000004A70000-0x0000000004BD0000-memory.dmp

memory/2008-3-0x0000000074840000-0x0000000074F2E000-memory.dmp

memory/2008-6-0x0000000000B00000-0x0000000000B3E000-memory.dmp

memory/2008-5-0x00000000049D0000-0x0000000004A10000-memory.dmp

memory/2504-7-0x0000000000400000-0x000000000045E000-memory.dmp

memory/2504-9-0x0000000000400000-0x000000000045E000-memory.dmp

memory/2504-11-0x0000000000400000-0x000000000045E000-memory.dmp

memory/2504-12-0x0000000000400000-0x000000000045E000-memory.dmp

memory/2504-15-0x0000000000400000-0x000000000045E000-memory.dmp

memory/2504-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2008-17-0x0000000074840000-0x0000000074F2E000-memory.dmp

memory/2504-18-0x0000000000400000-0x000000000045E000-memory.dmp

memory/2504-22-0x0000000000400000-0x000000000045E000-memory.dmp

memory/2572-23-0x0000000073680000-0x0000000073C2B000-memory.dmp

memory/2572-24-0x0000000002970000-0x00000000029B0000-memory.dmp

memory/2572-25-0x0000000073680000-0x0000000073C2B000-memory.dmp

memory/2504-26-0x00000000747A0000-0x0000000074E8E000-memory.dmp

memory/2572-27-0x0000000002970000-0x00000000029B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\qyekNG8bBvli.bat

MD5 d675c910331bfd1bb1f0fb9edb9cd34b
SHA1 4fdc2356a353bac01713bf0336cc1fb561c715e3
SHA256 f7a818e7ac274d8e644d9cf8209d3e9acd0de74577ba2452bd3686ae82cd7191
SHA512 03fe917347d6b08e70da6210fac4709869258b1e90f3be964e9b538cc9b802a313f8a7a26ef0038e01afe014b3975b2d64963981656b4f67137f206fb56d1113

memory/2504-36-0x00000000747A0000-0x0000000074E8E000-memory.dmp

memory/2572-38-0x0000000073680000-0x0000000073C2B000-memory.dmp

memory/2044-49-0x0000000000320000-0x0000000000321000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-30 14:03

Reported

2024-03-30 14:06

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe"

Signatures

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

ZGRat

rat zgrat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2080 wrote to memory of 3216 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2080 wrote to memory of 3216 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2080 wrote to memory of 3216 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2080 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe
PID 2080 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe
PID 2080 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe
PID 2080 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe
PID 2080 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe
PID 2080 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe
PID 2080 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe
PID 2080 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe
PID 2624 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2624 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2624 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4368 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4368 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4368 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4368 wrote to memory of 3044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4368 wrote to memory of 3044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4368 wrote to memory of 3044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe" -Force

C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8w5blQKiAtog.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 98.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 sommerishere.sytes.net udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.65.42.20.in-addr.arpa udp

Files

memory/2080-0-0x0000000000FA0000-0x0000000001106000-memory.dmp

memory/2080-1-0x0000000074AA0000-0x0000000075250000-memory.dmp

memory/2080-2-0x0000000005AD0000-0x0000000005C30000-memory.dmp

memory/2080-3-0x0000000074AA0000-0x0000000075250000-memory.dmp

memory/2080-4-0x0000000006060000-0x00000000060F2000-memory.dmp

memory/2080-5-0x0000000005FC0000-0x0000000006026000-memory.dmp

memory/2080-6-0x00000000066B0000-0x0000000006C54000-memory.dmp

memory/2080-7-0x0000000005CB0000-0x0000000005CC0000-memory.dmp

memory/2080-9-0x00000000071F0000-0x000000000722E000-memory.dmp

memory/2624-10-0x0000000000400000-0x000000000045E000-memory.dmp

memory/3216-11-0x0000000004FD0000-0x0000000005006000-memory.dmp

memory/3216-12-0x0000000074AA0000-0x0000000075250000-memory.dmp

memory/2624-13-0x0000000074AA0000-0x0000000075250000-memory.dmp

memory/3216-14-0x0000000005640000-0x0000000005C68000-memory.dmp

memory/2624-16-0x00000000050C0000-0x00000000050D0000-memory.dmp

memory/3216-17-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

memory/2080-19-0x0000000074AA0000-0x0000000075250000-memory.dmp

memory/3216-18-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_adp2wjqv.eht.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3216-25-0x0000000005DA0000-0x0000000005DC2000-memory.dmp

memory/3216-30-0x0000000005F90000-0x0000000005FF6000-memory.dmp

memory/3216-31-0x00000000060B0000-0x0000000006404000-memory.dmp

memory/3216-32-0x0000000006510000-0x000000000652E000-memory.dmp

memory/3216-33-0x0000000006560000-0x00000000065AC000-memory.dmp

memory/2624-34-0x0000000005E50000-0x0000000005E62000-memory.dmp

memory/2624-35-0x00000000064D0000-0x000000000650C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3d7d4ced171a608319381205863c8789_JaffaCakes118.exe.log

MD5 52b221120edd185f21764edb9b5c291e
SHA1 634ab8e2ca51714463bdd999f6802378239bd5e0
SHA256 7e57d59bcd69cfc7263f036079453914adfbc6b44dad75f1206f1c60805f4ef1
SHA512 f83ae9368ce2fce7b6df41fb96d8e6233591497c2522859a4caab8e079ae6d47d8195ffaf5d9d71c317d187be65300d55a0749eb2570058b7b04f63a8459fbd2

memory/2624-40-0x0000000074AA0000-0x0000000075250000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8w5blQKiAtog.bat

MD5 6c6b3dda4f61f33417711da8c10e134a
SHA1 542c3ccfeb5f0e4f5de6f07447a3291b6e5d6bfa
SHA256 8ed25e69db4464448cbba2e0c8f6e63db204e1280029560bed5e06001084aee7
SHA512 c73dbca8f0c993dac1ac169ab9e68c622b6de9b03a3a06c6ad46e1f518626c350764f436b929be9cd3a44c2bdc167361e5f3c84d87ccc9a060ef34df252b70cf

memory/3216-42-0x0000000007B50000-0x00000000081CA000-memory.dmp

memory/3216-43-0x0000000006A20000-0x0000000006A3A000-memory.dmp

memory/3216-44-0x0000000007770000-0x0000000007806000-memory.dmp

memory/3216-45-0x0000000006AF0000-0x0000000006B12000-memory.dmp

memory/3216-48-0x0000000074AA0000-0x0000000075250000-memory.dmp