hawkeye_reborn | 19c68f9e178765d9676476754db29a351eb8eebf905bb97b95e0c954520052a5

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
Size

808KB
MD5

2aca79fda2f8a1921295b09bd486de16
SHA1

0e6bf9c82791862d69836bd14aceca46841bf53a
SHA256

19c68f9e178765d9676476754db29a351eb8eebf905bb97b95e0c954520052a5
SHA512

7408354fec602fac9e16b16220d657ced49c39be7a365dd10d6c77c0d955bfce9249520288ded3f454d30e7c38d00b9f615e0b2ffc4cc37ec08498ba793f515e
SSDEEP

12288:D/YzK338/LgnU7wz9yl084/hAQR/8Hcmy6ZzPa8csxEU6LRHb6+js+:kz//Lg5cf4/hVR/88GZO8vOU2Hb6+s+

Score

10^/10

hawkeye_reborn m00nd3v_logger neshta infostealer keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Signatures

Detect Neshta payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000100000001030c-14.dat	family_neshta
behavioral1/memory/2416-129-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

M00nD3v Logger payload 6 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral1/memory/2420-70-0x00000000050A0000-0x0000000005130000-memory.dmp	m00nd3v_logger
behavioral1/memory/2976-80-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/2976-81-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/2976-82-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/2976-78-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/2976-76-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegAsm.url	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2420	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe

Loads dropped DLL 4 IoCs

pid	Process
2416	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
2416	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
2416	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
2416	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2420 set thread context of 2976	2420	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe	32

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2420	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
2420	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2420	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2420	2416	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe	28
PID 2416 wrote to memory of 2420	2416	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe	28
PID 2416 wrote to memory of 2420	2416	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe	28
PID 2416 wrote to memory of 2420	2416	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe	28
PID 2420 wrote to memory of 2676	2420	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe	29
PID 2420 wrote to memory of 2676	2420	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe	29
PID 2420 wrote to memory of 2676	2420	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe	29
PID 2420 wrote to memory of 2676	2420	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe	29
PID 2676 wrote to memory of 2856	2676	csc.exe	31
PID 2676 wrote to memory of 2856	2676	csc.exe	31
PID 2676 wrote to memory of 2856	2676	csc.exe	31
PID 2676 wrote to memory of 2856	2676	csc.exe	31
PID 2420 wrote to memory of 2976	2420	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe	32
PID 2420 wrote to memory of 2976	2420	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe	32
PID 2420 wrote to memory of 2976	2420	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe	32
PID 2420 wrote to memory of 2976	2420	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe	32
PID 2420 wrote to memory of 2976	2420	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe	32
PID 2420 wrote to memory of 2976	2420	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe	32
PID 2420 wrote to memory of 2976	2420	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe	32
PID 2420 wrote to memory of 2976	2420	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe	32
PID 2420 wrote to memory of 2976	2420	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe	32
PID 2420 wrote to memory of 2976	2420	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe	32
PID 2420 wrote to memory of 2976	2420	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe	32
PID 2420 wrote to memory of 2976	2420	2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\3582-490\2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\saodwtes\saodwtes.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF8.tmp" "c:\Users\Admin\AppData\Local\Temp\saodwtes\CSC3FFE88A3D4194253AF221ABCB7C87D8A.TMP"
      4⤵
      PID:2856
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

Filesize
547KB

MD5
cf6c595d3e5e9667667af096762fd9c4

SHA1
9bb44da8d7f6457099cb56e4f7d1026963dce7ce

SHA256
593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

SHA512
ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFF8.tmp

Filesize
1KB

MD5
52a9cf2ec34f4869960cb5c427820ede

SHA1
254acede94031673f44234d1de0c91e750589919

SHA256
720a474b5d7308148a3069f2f0dbded40a7457ee39c9ab07e67c4e252850ee92

SHA512
b2a58b1e0b4ec8fa5cd1d0af2186b619c72fb9c5bff6ddd8acc981009f522c8151f5c7ff520bba04f580b62c1d92c5f34ad220ff275427465b73bce40a32eb26

Download Submit
C:\Users\Admin\AppData\Local\Temp\saodwtes\saodwtes.dll

Filesize
6KB

MD5
cc11152f09b628294715bd6a6371c899

SHA1
8301372c38dae8c6036624a94f2642e940859699

SHA256
4bd534f90e22389b4d3ecc4a6aa15b5b9aef83577798e6ba10d1a86509e066e1

SHA512
579c75b16e172c4c0eb7105141682d0470ea167535b124493e9da4a59d5fd50d2d47f6a01c9b6e6764be39ebcc9a1fdfa9aa04e790d4d4a791a4e837229d9a46

Download Submit
C:\Users\Admin\AppData\Local\Temp\saodwtes\saodwtes.pdb

Filesize
19KB

MD5
0ed309b6863f1ec508f3943529c23931

SHA1
946c834c477fbc1b8e7db0026253c3081f28ab44

SHA256
9001b02a2c51f970992cf87912efac3adac9b86dd46c8c2e5a711d9a161e43f4

SHA512
7dadb761b9deb86bf9b4b1a7019e03a051cbbe07e1a9f7a74348b5fd6956af2aa84b2fc40a31ad852bcf14ccaeb2214f6fea0090ef22a5ba712dc56fec89860d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\saodwtes\CSC3FFE88A3D4194253AF221ABCB7C87D8A.TMP

Filesize
1KB

MD5
2fdddf6cc0851453820bba33974c0aec

SHA1
890c1dcdcf117004a4adc785a32594038dc3db1a

SHA256
a322037a9e142240300f72b80eece38bfb0331bf45d60cab0ea21b8abf21acc7

SHA512
799d4c349850c986cd697187e4adb95d560a1aedc3a61eb03fea71ebcebc44881933b27f164bebbca90086dd4f2a8035aedf39cb83fc5aed1ceeaa6b6ccec148

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\saodwtes\saodwtes.0.cs

Filesize
4KB

MD5
a2cd0c2dee5b5dc32f99795171b1fe81

SHA1
857a90f04cbe1fc42e993247bfced69d7ee9865f

SHA256
89f6035db1458a244a10812277a63ceb1049df7a84a7aa9645e7eb92c53b0eff

SHA512
2680c8cbaa71cef9b739df95ec2242009d512017b17a10f244174bae82583f0263a25821a232b8cb5ae621219172d768ea6dbbd0025b968d61288c9cee78e61c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\saodwtes\saodwtes.cmdline

Filesize
312B

MD5
d241a73b854141307bb55b1f850ef98c

SHA1
edd58d80ab1bed5dd56524f889b1acfa48d997cc

SHA256
9db3c5ebf185a15a99e87d90ff8f851629d03a56180b5b3a7468b81183bbfb24

SHA512
db6e1bac94795e80e49456099b09b996cf0f5bab87c0254cd52f77c871672bc35e82913c1feac228da5ac38b84f3aa7df8ff68a96989fb3c90b9e2459919a401

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\2aca79fda2f8a1921295b09bd486de16_JaffaCakes118.exe

Filesize
768KB

MD5
c837f1b546fa78b71ea2a65e639d198a

SHA1
7d75295a0cdb8511b21b3e5b0bd5c9bf9492f51f

SHA256
adce65abb9d9828f364dd7ec4f2e349be85291064edc3596545d67f9933d2e64

SHA512
48037d6c3df2fd8875bfda5dce78b40f5bacde36a12539f75758c6388acfe476e5bf339fe7254a1c3a0b509576fcafa4b9e4ac603031e3e124f169e75e208654

Download Submit
memory/2416-129-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2420-83-0x0000000074570000-0x0000000074C5E000-memory.dmp

Filesize
6.9MB

Download
memory/2420-18-0x0000000074570000-0x0000000074C5E000-memory.dmp

Filesize
6.9MB

Download
memory/2420-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2420-53-0x0000000000660000-0x0000000000668000-memory.dmp

Filesize
32KB

Download
memory/2420-16-0x0000000000240000-0x00000000002D2000-memory.dmp

Filesize
584KB

Download
memory/2420-15-0x000000007457E000-0x000000007457F000-memory.dmp

Filesize
4KB

Download
memory/2420-62-0x0000000005000000-0x000000000509A000-memory.dmp

Filesize
616KB

Download
memory/2420-64-0x00000000006B0000-0x00000000006BC000-memory.dmp

Filesize
48KB

Download
memory/2420-70-0x00000000050A0000-0x0000000005130000-memory.dmp

Filesize
576KB

Download
memory/2976-73-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2976-81-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2976-79-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2976-82-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2976-78-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2976-76-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2976-71-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2976-80-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download