6605c5f3f99c7063c2e942ca495fd13aaf275657a01cb5130ffe12cd283a7bc3

Analysis

max time kernel
95s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe
Size

870KB
MD5

07e257a2dc1e299ac898fa5e9016ef7d
SHA1

0a3b6d5edbf71b511a1f58b5abca357b9a5f0ee6
SHA256

6605c5f3f99c7063c2e942ca495fd13aaf275657a01cb5130ffe12cd283a7bc3
SHA512

ebb4570cecf60fd4b59c7349e4aee86d5a42ea40733059f8e1ba9d819a00320d2fc091e19fa2fd38e928c7a1e4aed3860fa73335a9da5acbbe1f67cb3109f36b
SSDEEP

24576:dueyt8398TAS1/JwxRQSRgD6ZdvpuXmR7E2ntxZDO:duPSWTACGR7atmR7Dn7ZDO

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3452	launch.exe
4388	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2480	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launch.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x0008000000023482-47.dat	nsis_installer_1
behavioral2/files/0x0008000000023482-47.dat	nsis_installer_2

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 5c00000001000000040000000008000004000000010000001000000091de0625abdafd32170cbb25172a84670300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877619000000010000001000000063664b080559a094d10f0a3c5f4f629020000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	launch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	launch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	launch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 04000000010000001000000091de0625abdafd32170cbb25172a84670300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	launch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee404000000010000001000000091de0625abdafd32170cbb25172a846720000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	launch.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2480	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4388	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe
4388	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 3452	2480	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe	82
PID 2480 wrote to memory of 3452	2480	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe	82
PID 2480 wrote to memory of 3452	2480	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe	82
PID 2480 wrote to memory of 4388	2480	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe	83
PID 2480 wrote to memory of 4388	2480	07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Users\Admin\AppData\Local\Temp\DM\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe\cadc4507a4b34fa48e24a78ed57c3f98\launch.exe
  C:\Users\Admin\AppData\Local\Temp\DM\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe\cadc4507a4b34fa48e24a78ed57c3f98\launch.exe "e07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe" "07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe" "1e130fa68b4d4af5a9b6e0b00b21f4a2" dec
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:3452
- C:\Users\Admin\AppData\Local\Temp\DM\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe\cadc4507a4b34fa48e24a78ed57c3f98\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\DM\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe\cadc4507a4b34fa48e24a78ed57c3f98\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe /path="C:\Users\Admin\AppData\Local\Temp\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:4388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\46DE64130271B61D13A0FAFD9465377C_D8840AF2A28227DC3600C6CA04024DE2

Filesize
2KB

MD5
8b478ee2ca52416de88a96957af3cee1

SHA1
d03d5c6e4b9517fd20bdbc5800174be57167c800

SHA256
17b8c78df8d1bc960a0dc245daf839f11c155bde4ebfc8aeecdd6240275ba2e3

SHA512
50c6b4200aec422500517ddfae588247363dd20c29b4852b1d42e7359a410e126a9729f45e6f2fc1cb44bd9cbe857950b2e7b039cbcc51a269c7df42cd7ace6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BBB768C456D9E2DCD3EF595C400D483D_64C05B9EB32FC3D0CE6CB126561EEBFF

Filesize
1KB

MD5
fbbd9dad8659a448d73458d021e4c972

SHA1
f3afb01a304a4b44194b9ede751dc9a042f507e6

SHA256
591b5e93486139706689709faceaa32cdf8000fd0ee74bd03c358cfdfd3bdafa

SHA512
86ae767ee3cd3999a0ccfea8bd92e8a83e9e8f315fb81ec49fd9d4eab750e07cf3305aa8b3852bf5c4fc63fb3b3b3f04671ee1cb71f593960772c5c39b4ffa96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\46DE64130271B61D13A0FAFD9465377C_D8840AF2A28227DC3600C6CA04024DE2

Filesize
466B

MD5
36e4b41b2b884bb5d60faca6ccf6d609

SHA1
5a797c8cad5c780fac8f23793e6c702d7f1e3063

SHA256
a65e50a730a782756a8c8b3d2812a8ca9c4ec6a71d22b9d694ada748f9df9f6a

SHA512
99dc7dd75d90494c03cdd02947faf9f4f0a67f9ab7e7c950c61e5b462dda085c361c08cb2b15d9ca3137715b3614e764829b52dbf59c7e3d914099f6439ab2ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BBB768C456D9E2DCD3EF595C400D483D_64C05B9EB32FC3D0CE6CB126561EEBFF

Filesize
444B

MD5
fcd987591ae7cc35be4971e672f0c061

SHA1
29c3401eec659eb5337bd5c63e621cc89acbd3a2

SHA256
f89b03f339e4760272d84485b9ca86f72ba9dd015ca4f26df796a2de84249f4a

SHA512
040c6a2c85e7a353cf491d97c648b6619c817faaa07d0bc5033b7c270f5640f76c7e9afff5e56925c997d2a7ffd6604a401a4631a64c533689f6684f35e41f30

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe\cadc4507a4b34fa48e24a78ed57c3f98\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe

Filesize
387KB

MD5
9713c85d42d9775e96bbd379fb10faa2

SHA1
228d56b093360954158343d7be011fe792e836ec

SHA256
0a200c18ef5d957e153f18f7f1dc5b6de97bc5795fe280a314cd080191300e53

SHA512
2945ffaa4ea851637a5d7e5ecb4643a9baa7369aa9e07c134e5819d853e396fba64aa01199be8307ea5b17bd8a5b6bab07efc5b09131fc1a5f76a7e637888c98

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe\cadc4507a4b34fa48e24a78ed57c3f98\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe.config

Filesize
690B

MD5
bca0ea75b6940aa86960d7b9098a5998

SHA1
3d57f82158ac72c7eb2e72ba19a80485d8103130

SHA256
5a494295936d2170433864b449257bbac7b976413811a0b6339e37f83a891f8d

SHA512
260a05c509d874239a27798421ee75ac7e2bbc0d2a0485122740e8b8adcd8f43f98f7633cef278d9f7f4a132633b4b1cdf4b641e2233e891dce2d6eb6e75c3d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe\cadc4507a4b34fa48e24a78ed57c3f98\e07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe

Filesize
387KB

MD5
ebe36d0ae513a772ea38f64301f8f365

SHA1
d8f641d801d185b3aa95cfd4d52568bf4f295d99

SHA256
7a4ddd15212c6a0a0510062682dc409db48ff03b745e01373a96e80f0319868b

SHA512
a06efd1371c0b91980619b4c4db7b6a0529b8bea08a6bf10820c584d0d3172b34d07b483c751e5463b4efd313aaf41838b59761a8f410cf14528edc4e44ba4b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe\cadc4507a4b34fa48e24a78ed57c3f98\installer.exe

Filesize
870KB

MD5
07e257a2dc1e299ac898fa5e9016ef7d

SHA1
0a3b6d5edbf71b511a1f58b5abca357b9a5f0ee6

SHA256
6605c5f3f99c7063c2e942ca495fd13aaf275657a01cb5130ffe12cd283a7bc3

SHA512
ebb4570cecf60fd4b59c7349e4aee86d5a42ea40733059f8e1ba9d819a00320d2fc091e19fa2fd38e928c7a1e4aed3860fa73335a9da5acbbe1f67cb3109f36b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe\cadc4507a4b34fa48e24a78ed57c3f98\launch.exe

Filesize
26KB

MD5
e2579df6879217499f05eef4725b3106

SHA1
905ab8f071c22be7a4fc78073d36121d17299464

SHA256
860372841f7d35c9e92f9b3d7c65c64a3904b02cbc41a5cd1318e571c27d9102

SHA512
40203c0cf7342894d05a7f4224add02206fb6d727e2e69d474d141778e556c0c3cfc3ce2a09d10c03c020fb5362904bac99890f0c3f316ce81c469fd59018645

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\07e257a2dc1e299ac898fa5e9016ef7d_JaffaCakes118.exe\cadc4507a4b34fa48e24a78ed57c3f98\launch.exe.config

Filesize
359B

MD5
05a59e8e79546860cf1e351e32e69404

SHA1
aef4ad7bcbd79f99feb7100f05938721f12f7dce

SHA256
a368ee85ee624c5adaad674a9b5986f17de7020206e93755c0d086714fcc9430

SHA512
6ec6d988e5c4736ca56118926fef22f952991688bee8408b782273622f2a1f5d8c57850bdb1992f70c23df42366bec56527ad1395484aa5916d84e1249d159fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse855E.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
memory/3452-29-0x0000000072C00000-0x00000000731B1000-memory.dmp

Filesize
5.7MB

Download
memory/3452-17-0x0000000072C00000-0x00000000731B1000-memory.dmp

Filesize
5.7MB

Download
memory/3452-16-0x0000000072C00000-0x00000000731B1000-memory.dmp

Filesize
5.7MB

Download
memory/3452-15-0x0000000072C02000-0x0000000072C03000-memory.dmp

Filesize
4KB

Download
memory/4388-42-0x00007FF844300000-0x00007FF844CA1000-memory.dmp

Filesize
9.6MB

Download
memory/4388-43-0x000000001C190000-0x000000001C19E000-memory.dmp

Filesize
56KB

Download
memory/4388-44-0x000000001C8E0000-0x000000001CDAE000-memory.dmp

Filesize
4.8MB

Download
memory/4388-45-0x000000001CE50000-0x000000001CEEC000-memory.dmp

Filesize
624KB

Download
memory/4388-46-0x000000001C140000-0x000000001C148000-memory.dmp

Filesize
32KB

Download
memory/4388-34-0x00007FF8445B5000-0x00007FF8445B6000-memory.dmp

Filesize
4KB

Download
memory/4388-49-0x0000000020A60000-0x0000000020AC2000-memory.dmp

Filesize
392KB

Download
memory/4388-51-0x00007FF8445B5000-0x00007FF8445B6000-memory.dmp

Filesize
4KB

Download
memory/4388-52-0x00007FF844300000-0x00007FF844CA1000-memory.dmp

Filesize
9.6MB

Download
memory/4388-59-0x00007FF844300000-0x00007FF844CA1000-memory.dmp

Filesize
9.6MB

Download