6605c5f3f99c7063c2e942ca495fd13aaf275657a01cb5130ffe12cd283a7bc3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe
Size

870KB
MD5

07e257a2dc1e299ac898fa5e9016ef7d
SHA1

0a3b6d5edbf71b511a1f58b5abca357b9a5f0ee6
SHA256

6605c5f3f99c7063c2e942ca495fd13aaf275657a01cb5130ffe12cd283a7bc3
SHA512

ebb4570cecf60fd4b59c7349e4aee86d5a42ea40733059f8e1ba9d819a00320d2fc091e19fa2fd38e928c7a1e4aed3860fa73335a9da5acbbe1f67cb3109f36b
SSDEEP

24576:dueyt8398TAS1/JwxRQSRgD6ZdvpuXmR7E2ntxZDO:duPSWTACGR7atmR7Dn7ZDO

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2976	launch.exe
2128	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe

Loads dropped DLL 3 IoCs

pid	Process
1552	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe
1552	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe
1552	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launch.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x000b000000018678-95.dat	nsis_installer_1
behavioral1/files/0x000b000000018678-95.dat	nsis_installer_2

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e309000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	launch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 04000000010000001000000091de0625abdafd32170cbb25172a84670f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee419000000010000001000000063664b080559a094d10f0a3c5f4f629020000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	launch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	launch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	launch.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1552	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2128	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe
2128	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 2976	1552	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe	30
PID 1552 wrote to memory of 2976	1552	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe	30
PID 1552 wrote to memory of 2976	1552	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe	30
PID 1552 wrote to memory of 2976	1552	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe	30
PID 1552 wrote to memory of 2976	1552	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe	30
PID 1552 wrote to memory of 2976	1552	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe	30
PID 1552 wrote to memory of 2976	1552	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe	30
PID 1552 wrote to memory of 2128	1552	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe	31
PID 1552 wrote to memory of 2128	1552	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe	31
PID 1552 wrote to memory of 2128	1552	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe	31
PID 1552 wrote to memory of 2128	1552	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Users\Admin\AppData\Local\Temp\DM\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe\cadc4507a4b34fa48e24a78ed57c3f98\launch.exe
  C:\Users\Admin\AppData\Local\Temp\DM\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe\cadc4507a4b34fa48e24a78ed57c3f98\launch.exe "e07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe" "07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe" "1e130fa68b4d4af5a9b6e0b00b21f4a2" dec
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:2976
- C:\Users\Admin\AppData\Local\Temp\DM\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe\cadc4507a4b34fa48e24a78ed57c3f98\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\DM\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe\cadc4507a4b34fa48e24a78ed57c3f98\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe /path="C:\Users\Admin\AppData\Local\Temp\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\46DE64130271B61D13A0FAFD9465377C_D8840AF2A28227DC3600C6CA04024DE2

Filesize
2KB

MD5
8b478ee2ca52416de88a96957af3cee1

SHA1
d03d5c6e4b9517fd20bdbc5800174be57167c800

SHA256
17b8c78df8d1bc960a0dc245daf839f11c155bde4ebfc8aeecdd6240275ba2e3

SHA512
50c6b4200aec422500517ddfae588247363dd20c29b4852b1d42e7359a410e126a9729f45e6f2fc1cb44bd9cbe857950b2e7b039cbcc51a269c7df42cd7ace6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BBB768C456D9E2DCD3EF595C400D483D_64C05B9EB32FC3D0CE6CB126561EEBFF

Filesize
1KB

MD5
fbbd9dad8659a448d73458d021e4c972

SHA1
f3afb01a304a4b44194b9ede751dc9a042f507e6

SHA256
591b5e93486139706689709faceaa32cdf8000fd0ee74bd03c358cfdfd3bdafa

SHA512
86ae767ee3cd3999a0ccfea8bd92e8a83e9e8f315fb81ec49fd9d4eab750e07cf3305aa8b3852bf5c4fc63fb3b3b3f04671ee1cb71f593960772c5c39b4ffa96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\46DE64130271B61D13A0FAFD9465377C_D8840AF2A28227DC3600C6CA04024DE2

Filesize
466B

MD5
f3616bd037204e5ff9bf69d170ba8f8d

SHA1
728d9f8afa71fb1d54248b5f63cc969f1c43622e

SHA256
7e49c1324abe2f70c2ee7e8c9dbd61d59b6eda109afbbbbfc7a2a7d2a702659e

SHA512
4179a73555ffa6fd1f0774305368b62694cf5a283e3710118b94d975d99657ebf7a06e7c179027f5af0e3588dfb17d399d71217fc4ad97c0adc121aacfada701

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94aff010cdd6ea626da20c5b4ccf8935

SHA1
af4852eeb16c9a2a65514731e2431b6e11df2d4b

SHA256
6d313ff8518f451d249c6e4852fe33ee8fb9c90bbb4f7da4fcc6e1fa8642fbfe

SHA512
cf209db481bca112a15d58ce73563516d9aaf269024591070bdb18c51cd14ad288615c2b211c7659df83de05c2a2594eb3301153951706ab35fba3894e99ac35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BBB768C456D9E2DCD3EF595C400D483D_64C05B9EB32FC3D0CE6CB126561EEBFF

Filesize
444B

MD5
b3b7f773366f873ecf06078ba72bd412

SHA1
52d5d85e2f9a8f03c9ff1ecdcf35d963e797731d

SHA256
19b06e50759cbe6a4c1cd570463fefc5fe7afb0caad480489ab120b4eadc82c1

SHA512
a397569d55e9eca45b1a35f208cb7468ac976529d2a9b83b283a3d8dc6bbbc846de9833f078fcf623278068d0b1a2936781d079a460eacb8851d9af11f7bbdcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF21E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe\cadc4507a4b34fa48e24a78ed57c3f98\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe

Filesize
387KB

MD5
9713c85d42d9775e96bbd379fb10faa2

SHA1
228d56b093360954158343d7be011fe792e836ec

SHA256
0a200c18ef5d957e153f18f7f1dc5b6de97bc5795fe280a314cd080191300e53

SHA512
2945ffaa4ea851637a5d7e5ecb4643a9baa7369aa9e07c134e5819d853e396fba64aa01199be8307ea5b17bd8a5b6bab07efc5b09131fc1a5f76a7e637888c98

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe\cadc4507a4b34fa48e24a78ed57c3f98\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe.config

Filesize
690B

MD5
bca0ea75b6940aa86960d7b9098a5998

SHA1
3d57f82158ac72c7eb2e72ba19a80485d8103130

SHA256
5a494295936d2170433864b449257bbac7b976413811a0b6339e37f83a891f8d

SHA512
260a05c509d874239a27798421ee75ac7e2bbc0d2a0485122740e8b8adcd8f43f98f7633cef278d9f7f4a132633b4b1cdf4b641e2233e891dce2d6eb6e75c3d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe\cadc4507a4b34fa48e24a78ed57c3f98\e07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe

Filesize
387KB

MD5
ebe36d0ae513a772ea38f64301f8f365

SHA1
d8f641d801d185b3aa95cfd4d52568bf4f295d99

SHA256
7a4ddd15212c6a0a0510062682dc409db48ff03b745e01373a96e80f0319868b

SHA512
a06efd1371c0b91980619b4c4db7b6a0529b8bea08a6bf10820c584d0d3172b34d07b483c751e5463b4efd313aaf41838b59761a8f410cf14528edc4e44ba4b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe\cadc4507a4b34fa48e24a78ed57c3f98\installer.exe

Filesize
870KB

MD5
07e257a2dc1e299ac898fa5e9016ef7d

SHA1
0a3b6d5edbf71b511a1f58b5abca357b9a5f0ee6

SHA256
6605c5f3f99c7063c2e942ca495fd13aaf275657a01cb5130ffe12cd283a7bc3

SHA512
ebb4570cecf60fd4b59c7349e4aee86d5a42ea40733059f8e1ba9d819a00320d2fc091e19fa2fd38e928c7a1e4aed3860fa73335a9da5acbbe1f67cb3109f36b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe\cadc4507a4b34fa48e24a78ed57c3f98\launch.exe.config

Filesize
359B

MD5
05a59e8e79546860cf1e351e32e69404

SHA1
aef4ad7bcbd79f99feb7100f05938721f12f7dce

SHA256
a368ee85ee624c5adaad674a9b5986f17de7020206e93755c0d086714fcc9430

SHA512
6ec6d988e5c4736ca56118926fef22f952991688bee8408b782273622f2a1f5d8c57850bdb1992f70c23df42366bec56527ad1395484aa5916d84e1249d159fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF250.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\DM\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe\cadc4507a4b34fa48e24a78ed57c3f98\launch.exe

Filesize
26KB

MD5
e2579df6879217499f05eef4725b3106

SHA1
905ab8f071c22be7a4fc78073d36121d17299464

SHA256
860372841f7d35c9e92f9b3d7c65c64a3904b02cbc41a5cd1318e571c27d9102

SHA512
40203c0cf7342894d05a7f4224add02206fb6d727e2e69d474d141778e556c0c3cfc3ce2a09d10c03c020fb5362904bac99890f0c3f316ce81c469fd59018645

Download Submit
\Users\Admin\AppData\Local\Temp\nsyEFEC.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
memory/1552-5-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/2128-94-0x00000000004D0000-0x00000000004DE000-memory.dmp

Filesize
56KB

Download
memory/2976-19-0x00000000740F0000-0x000000007469B000-memory.dmp

Filesize
5.7MB

Download
memory/2976-73-0x00000000740F0000-0x000000007469B000-memory.dmp

Filesize
5.7MB

Download
memory/2976-20-0x00000000740F0000-0x000000007469B000-memory.dmp

Filesize
5.7MB

Download
memory/2976-18-0x00000000740F1000-0x00000000740F2000-memory.dmp

Filesize
4KB

Download