Overview

overview

8

Static

static

5

4511ee3b4e...18.exe

windows7-x64

8

4511ee3b4e...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    140s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/10/2024, 01:04 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4511ee3b4e5d8150c035a140dfba72c0_JaffaCakes118.exe

  • Size

    474KB

  • MD5

    4511ee3b4e5d8150c035a140dfba72c0

  • SHA1

    6a173ea0a4f37cdab59978feb1224f2d652c16a7

  • SHA256

    614ccc380536b90b5c256b6934747483544f80681a4b1f0a7b05962f0251e016

  • SHA512

    dceace1fd9f43ac5d66db22eecdd246dc5a61ba67b6eecb0ee291c8abafc6209adc3d3ac06930fcaacfc167715416d32477bf07dba651982aaec9118b840c711

  • SSDEEP

    12288:gaS8/3dZWDEIsqaRjJHvrdBswIf4KX5yxlt:jSWdZWIOalhjdG+KX5yDt

Score
8/10
discoveryupx

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 16 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4511ee3b4e5d8150c035a140dfba72c0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4511ee3b4e5d8150c035a140dfba72c0_JaffaCakes118.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2252
    • C:\Program Files (x86)\WinPcap\npf_mgm.exe
      "C:\Program Files (x86)\WinPcap\npf_mgm.exe" -r
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5080
    • C:\Program Files (x86)\WinPcap\daemon_mgm.exe
      "C:\Program Files (x86)\WinPcap\daemon_mgm.exe" -r
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1588
    • C:\Program Files (x86)\WinPcap\NetMonInstaller.exe
      "C:\Program Files (x86)\WinPcap\NetMonInstaller.exe" i
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Checks SCSI registry key(s)
      PID:3448

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    23.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    nexusrules.officeapps.live.com
    Remote address:
    8.8.8.8:53
    Request
    nexusrules.officeapps.live.com
    IN A
    Response
    nexusrules.officeapps.live.com
    IN CNAME
    prod.nexusrules.live.com.akadns.net
    prod.nexusrules.live.com.akadns.net
    IN A
    52.111.229.19
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.163.202.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.163.202.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    0.204.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.204.248.87.in-addr.arpa
    IN PTR
    Response
    0.204.248.87.in-addr.arpa
    IN PTR
    https-87-248-204-0lhrllnwnet
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360526659_1DEB5NSYP58G2E8T3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239360526659_1DEB5NSYP58G2E8T3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 586035
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: F9458F8D04964C23B5AFFA6EB97FC840 Ref B: LON601060102031 Ref C: 2024-10-15T01:06:38Z
    date: Tue, 15 Oct 2024 01:06:37 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418574_15LZ4V0VK97RULTEQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239340418574_15LZ4V0VK97RULTEQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 688331
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 45659658B69A4901B389D2320BBA244E Ref B: LON601060102031 Ref C: 2024-10-15T01:06:38Z
    date: Tue, 15 Oct 2024 01:06:37 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301726_1E13SDDIEAACEBOJ3&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239317301726_1E13SDDIEAACEBOJ3&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 417813
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 21D264CC468641B8B27B01E922D82489 Ref B: LON601060102031 Ref C: 2024-10-15T01:06:39Z
    date: Tue, 15 Oct 2024 01:06:38 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418573_1OCPZP6XQOXA94H84&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239340418573_1OCPZP6XQOXA94H84&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 442929
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: E902CD8D740946CAADBB54787EAE6FEB Ref B: LON601060102031 Ref C: 2024-10-15T01:06:41Z
    date: Tue, 15 Oct 2024 01:06:40 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360526658_1O3WYEZK6VX7G9BK6&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239360526658_1O3WYEZK6VX7G9BK6&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 550329
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: DAAB01A45A9044CAA0596EC07DA33220 Ref B: LON601060102031 Ref C: 2024-10-15T01:06:41Z
    date: Tue, 15 Oct 2024 01:06:40 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301317_1SANBEH786QEYU6TN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239317301317_1SANBEH786QEYU6TN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 467026
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 2E87FB6A54F64E1690668BBE9D3F0385 Ref B: LON601060102031 Ref C: 2024-10-15T01:06:41Z
    date: Tue, 15 Oct 2024 01:06:40 GMT
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.6kB
     7.9kB
     17
    15
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.5kB
     6.9kB
     15
    12
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.5kB
     7.8kB
     15
    13
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 150.171.27.10:443
    https://tse1.mm.bing.net/th?id=OADD2.10239317301317_1SANBEH786QEYU6TN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    tls, http2
    114.2kB
     3.3MB
     2380
    2374

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360526659_1DEB5NSYP58G2E8T3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418574_15LZ4V0VK97RULTEQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301726_1E13SDDIEAACEBOJ3&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418573_1OCPZP6XQOXA94H84&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360526658_1O3WYEZK6VX7G9BK6&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301317_1SANBEH786QEYU6TN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    23.159.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    23.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    150 B
     269 B
     2
    2

    DNS Request

    172.214.232.199.in-addr.arpa

    DNS Request

    nexusrules.officeapps.live.com

    DNS Response

    52.111.229.19

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    88.156.103.20.in-addr.arpa
    dns
    144 B
     158 B
     2
    1

    DNS Request

    88.156.103.20.in-addr.arpa

    DNS Request

    88.156.103.20.in-addr.arpa

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    200.163.202.172.in-addr.arpa
    dns
    74 B
     160 B
     1
    1

    DNS Request

    200.163.202.172.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    0.204.248.87.in-addr.arpa
    dns
    71 B
     116 B
     1
    1

    DNS Request

    0.204.248.87.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     170 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    150.171.27.10
    150.171.28.10

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\WinPcap\NetMonInstaller.exe
    Filesize

    6KB

    MD5

    87c1716cf63a2522e8d1fc123a1dd9df

    SHA1

    4f56f480ba5019fb32ad26a3e269c789d2247bad

    SHA256

    b46861813e57f52d36bdfdaf2c4625f143720dcda5b63b79b24d13feb9d432b0

    SHA512

    b56791e6d793a6442ed6e10a7f8c7690c2bf47fda705fa33415ed177a059ebb4a812ccd394a51c5dffb2881cf6aad8be33ddbcb498043fc1780266acc235bacf

    Download Submit

  • C:\Program Files (x86)\WinPcap\Uninstall.exe
    Filesize

    194KB

    MD5

    62da2c201bc09a55c97c46f0ad73c28a

    SHA1

    adbdd63ff66fada5d91836caf1f62b992953964f

    SHA256

    dc870b8ade874c66d009553139eeeb07087c4a1f2e7125a140b048e349822e4b

    SHA512

    157bade77af45e414a1ef3e6d0887c28be3e5bdb3e191405759f6bde1585be3e69e254861c39fa530e66b825ebdeb5b31fa3c8e9804750543e37cb57b53f9341

    Download Submit

  • C:\Program Files (x86)\WinPcap\daemon_mgm.exe
    Filesize

    48KB

    MD5

    5df2055815aa72ac84e0fe4466f8b295

    SHA1

    0e473d63678c336c1589d0b6da4a4b9fcb0ae308

    SHA256

    2093374f712a3642238e4da4838c58967a9225f95710f10c906ea378fa2d146c

    SHA512

    9dcae70c89870e6caa8023041a7d2eb5b993ed284dd9ec0722266e48ec49473a4c46dcceb5367ffccb962fe916d568ddec4fe0b633041973ea1c36d5ec161e30

    Download Submit

  • C:\Program Files (x86)\WinPcap\npf_mgm.exe
    Filesize

    48KB

    MD5

    07382671a64e2b63638aa8ea93390c82

    SHA1

    abb529cd04882c9a089921edc6c3b17e77ee6515

    SHA256

    81923a54de9f9ee58c9d657bacf3e32e9532f84ce9f6b0dc5beb0371a93da671

    SHA512

    96957c5d63f2a55a980eab4c71a4327c2db898dca34d71e683849ab0f459506a1ff71222e60380cb3cfd55babe954585c36e8e1826434ea463a24f524ecbb410

    Download Submit

  • C:\Temp\1MR0BSJ8\4511ee3b4e5d8150c035a140dfba72c0_JaffaCakes118\db.pdb
    Filesize

    4KB

    MD5

    b017bf2d5f6215a4a410612698696b55

    SHA1

    c4d2696dde659ca05a34ef0670277933e436f647

    SHA256

    ca68951c3479e6f8f6e8f5336a0d61a2c2d2c6f2b47f88eb6025788cd2f943c7

    SHA512

    f962b72b6cb38143396d0a4b2c87ed7ebd9024dcd272535e48d084f3b97f4827c9bd87f6c92ac0a09771915ab5a8bb784ac4de4fee1cd89dc89a62dc9b710593

    Download Submit

  • C:\Temp\1MR0BSJ8\4511ee3b4e5d8150c035a140dfba72c0_JaffaCakes118\lng\Enu.lng
    Filesize

    5KB

    MD5

    60f475862cf4363904975df475353bb4

    SHA1

    7a3dbc3ab2d7bc3f278b27e91834b5f309db316e

    SHA256

    2cf57a46d77808d30ccdfe6d67801119c6cc812f0fba02d9689a91f33399a427

    SHA512

    ebbb9dc923424cfc194ac198fbc1aa15f20e1ce2543c5c281f627980ede4d8ce7fa5eea34b33ac66d9613048a55f44df17877933947ea71fe42b1e8a74a39ecd

    Download Submit

  • C:\Temp\1MR0BSJ8\4511ee3b4e5d8150c035a140dfba72c0_JaffaCakes118\main.pdb
    Filesize

    954B

    MD5

    c022fbd0770324683d199e601c1c82a6

    SHA1

    72dd84380abfe5bbf9f37013a057cffb9a50c65e

    SHA256

    255e046fac69584eae5b6ce8a99b379f368cc8f28cb2e4ad84bbd35d64e6cd53

    SHA512

    53a92a6936ebac16276fbb4cbd3b8dcfe75ff0aa3c2f78a4f8c12f1ae1e73c2f8880e2d64c791dc5702025d1f9b19dc3925d909a2a46f0a9d6a3e67396d5520f

    Download Submit

  • C:\Temp\1MR0BSJ8\4511ee3b4e5d8150c035a140dfba72c0_JaffaCakes118\plugins\0\StdUI.dll
    Filesize

    147KB

    MD5

    0ef0df3c28f135fa78eb9dfcf1b0499e

    SHA1

    ca21f49137267b3edc8f5aae86bec80f43cd4890

    SHA256

    8d987a52990bf4ea755240b7a1ea7f73a16b1fd67f3e91fc21e87a4f7d443546

    SHA512

    26bd1e5b0996a6b653b5456e361fa373b0b0505536bb9b8095b1f1389b244810aa51513be2af1585408a0f151db2cadbb65abc02e64b8ca5e8b2e6c5d502746b

    Download Submit

  • C:\Temp\1MR0BSJ8\4511ee3b4e5d8150c035a140dfba72c0_JaffaCakes118\plugins\0\lng\Enu.lng
    Filesize

    4KB

    MD5

    ac4c7d9da804065ce25541ccfe5c9296

    SHA1

    4fdd65221399ad4a3eba47be8bb7d3e9a37501bd

    SHA256

    94ed93684eca3c16b957e34e3937c3eae52d3275c8bfe3d2d845583c2bec152b

    SHA512

    6ad24a1049f04b7651c611a9d53205bc7a24ba70431870edf56b38240acf53872135bc8bbb61d897fed06fc0ea7666aafb3418ddfc3197549ee9c98bf889a9b9

    Download Submit

  • C:\Temp\1MR0BSJ8\4511ee3b4e5d8150c035a140dfba72c0_JaffaCakes118\presetup.bmp
    Filesize

    13KB

    MD5

    65668961b4585f1564eb5bbf3b40dcde

    SHA1

    8966cd3903c4ba85dc3855f3c26ff720e3bbb369

    SHA256

    4600e337e68cdcf786b193e3d28ea5934576f8b7b3bee6241177eca56c6cea4d

    SHA512

    a4829c7ba8e4ed17c9b590bcfc96320b6b69e4189f4b928d0a694a82a7a0c9a9436f7bf588ab17e6b451c7b7572505f18e837787a1cbebd8f45fa3b9f4306de1

    Download Submit

  • C:\Temp\1MR0BSJ8\4511ee3b4e5d8150c035a140dfba72c0_JaffaCakes118\presetup.rgn
    Filesize

    1KB

    MD5

    172eeccf4687e172e12a1b4ad3023e9f

    SHA1

    2b74254b4426b38932748aae109ddd1635ee7261

    SHA256

    cc0b0c69fb12cba8230c363bf63809ac1b8c8695a533446c87c86d9f8643c8c7

    SHA512

    ffb640adc81bcdcb45a6cd9e95a96c45e49fbf75ff7c785dc79623adf2c9a54930e3437c1f48b537d271b3b63ce5c1cc7e3f90709afb334d2acab3751cc69815

    Download Submit

  • C:\Temp\1MR0BSJ8\4511ee3b4e5d8150c035a140dfba72c0_JaffaCakes118\presetup\license.txt
    Filesize

    1KB

    MD5

    3ec0cb60ee5c909909e1f5ad2b5daf5d

    SHA1

    f59c49d53243a3bf75e239f813b7f61bc26ff113

    SHA256

    4d50e52e2a23d990c784aacb2711ff2a32b3d37bac41ce2517baba65660d5a87

    SHA512

    e7139d99fa6aebd19d57928f59657d97e4b9d3c37c699c248e9593e69d25734718f7d82218d829c6d1d626ba01a663e4c455741e97e8d72a6295a3ad97b48164

    Download Submit

  • C:\Temp\1MR0BSJ8\4511ee3b4e5d8150c035a140dfba72c0_JaffaCakes118\presetup\readme.txt
    Filesize

    243B

    MD5

    f8d14b853290c277b304f2a5bb96eb5b

    SHA1

    d019aff6ef439d295ba0c69c2db71378c1903986

    SHA256

    1cb901948589399f3f1abd017640e32479b799f99865b49936f5990d5ad4c040

    SHA512

    16a73aecd2b877f8e31554752332d8ea352f2bd264f78690cfbac51b674dc0cb8629f4fbad05df1fc75280521c65b238d41e402d249785e234a0ad036b6d76f1

    Download Submit

  • C:\Temp\1MR0BSJ8\4511ee3b4e5d8150c035a140dfba72c0_JaffaCakes118\splash.bmp
    Filesize

    133KB

    MD5

    b04877cefe4914731fb49225f3b662b5

    SHA1

    e5c47f08efff81baf7f3dde1797c2528861e1c29

    SHA256

    9009f56f3e511c795bc10e9bdd7eaaa8c00866650ed310eb362097700f63b9b4

    SHA512

    12d2d20bcbb0db117eb97785c7e599923bba383ba620aa5b6982462c9a446a3d563348861d43d78b62702d5390eaee0601b0587be5c1e87d6fd0d99aca334314

    Download Submit

  • C:\Temp\1MR0BSJ8\unpack.dll
    Filesize

    34KB

    MD5

    97bb07c04a2f3a0dace5aff04d305455

    SHA1

    2a966dfb6463a5c26ffb3a247dc9281bb57d25cf

    SHA256

    2adc86ef09b5aea46bc3ee88d1740760b3ce6ae5fa92fb6eceb6efc1e6c942d9

    SHA512

    9b00d6c26dfa946b78f73192c78edd6ae6027c377406f8e57089db8426b9664c972c77eb5b998430d9ab99c750b47d8e18203b737afcedec9a9dd09404c07c9f

    Download Submit

  • memory/2252-5-0x0000000002B00000-0x0000000002B27000-memory.dmp

    Filesize

    156KB

    Download

  • memory/2252-0-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

    Download

  • memory/2252-103-0x0000000002CB0000-0x0000000002CD9000-memory.dmp

    Filesize

    164KB

    Download

  • memory/2252-102-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

    Download

  • memory/2252-54-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

    Download

  • memory/2252-49-0x0000000002CB0000-0x0000000002CD9000-memory.dmp

    Filesize

    164KB

    Download

  • memory/2252-55-0x0000000002CB0000-0x0000000002CD9000-memory.dmp

    Filesize

    164KB

    Download

  • memory/2252-131-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.