Malware Analysis Report

2025-01-03 04:59

Sample ID 241202-q9greawnhy
Target b88ab587582517006609d2554572f9f4_JaffaCakes118
SHA256 da9365d6a36e9aac5c61c0a9c0fd53f2c3d03954e0e3b215f43435a5b638acf6
Tags
bitrat discovery persistence trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

da9365d6a36e9aac5c61c0a9c0fd53f2c3d03954e0e3b215f43435a5b638acf6

Threat Level: Known bad

The file b88ab587582517006609d2554572f9f4_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

bitrat discovery persistence trojan upx

Bitrat family

BitRAT

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

ACProtect 1.3x - 1.4x DLL software

Adds Run key to start application

Looks up external IP address via web service

UPX packed file

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious behavior: RenamesItself

Modifies system certificate store

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-02 13:57

Signatures

Bitrat family

bitrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-02 13:57

Reported

2024-12-02 14:00

Platform

win7-20240903-en

Max time kernel

149s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe"

Signatures

BitRAT

trojan bitrat

Bitrat family

bitrat

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\prscrt = "C:\\Users\\Admin\\AppData\\Local\\AppData\\prscrt.exe" C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A myexternalip.com N/A N/A
N/A myexternalip.com N/A N/A
N/A myexternalip.com N/A N/A
N/A myexternalip.com N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1792 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 1792 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 1792 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 1792 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 1792 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 1792 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 1792 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 1792 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 1792 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 1792 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 1792 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 1792 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 1792 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 1792 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 1792 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 1792 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 1792 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 1792 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 1792 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 1792 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe

"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc

C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe

"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc

C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe

"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc

C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe

"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc

C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe

"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc

Network

Country Destination Domain Proto
US 50.7.74.172:443 tcp
N/A 127.0.0.1:49231 tcp
US 96.253.78.108:443 tcp
DE 62.141.38.69:443 tcp
N/A 127.0.0.1:45808 tcp
FR 163.172.176.167:443 tcp
AT 86.59.21.38:443 tcp
DK 85.235.250.88:443 tcp
N/A 127.0.0.1:45808 tcp
GR 185.4.132.148:443 tcp
SE 109.105.109.162:60784 tcp
DE 157.90.183.103:9001 tcp
DE 157.90.183.103:9001 tcp
SE 109.105.109.162:60784 tcp
N/A 127.0.0.1:49351 tcp
FI 65.108.3.114:1066 tcp
DE 144.76.81.198:8443 tcp
N/A 127.0.0.1:45808 tcp
US 8.8.8.8:53 myexternalip.com udp
US 34.160.111.145:443 myexternalip.com tcp
US 8.8.8.8:53 r10.o.lencr.org udp
NL 95.101.74.210:80 r10.o.lencr.org tcp
N/A 127.0.0.1:49450 tcp
FR 94.23.172.32:444 tcp
FI 65.108.3.114:1066 tcp
N/A 127.0.0.1:45808 tcp
US 34.160.111.145:443 myexternalip.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
DE 104.124.11.17:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
FR 23.41.213.121:80 www.microsoft.com tcp
FI 135.181.63.118:9100 tcp
N/A 127.0.0.1:49526 tcp
FR 94.23.172.32:444 tcp
FI 65.108.3.114:1066 tcp
N/A 127.0.0.1:45808 tcp
US 34.160.111.145:443 myexternalip.com tcp
N/A 127.0.0.1:49594 tcp
DE 185.220.101.48:20048 tcp
FR 94.23.172.32:444 tcp

Files

memory/1792-0-0x0000000000400000-0x0000000000BD8000-memory.dmp

\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe

MD5 5cfe61ff895c7daa889708665ef05d7b
SHA1 5e58efe30406243fbd58d4968b0492ddeef145f2
SHA256 f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5
SHA512 43b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da

memory/1792-18-0x0000000004040000-0x0000000004444000-memory.dmp

memory/1100-21-0x00000000013A0000-0x00000000017A4000-memory.dmp

C:\Users\Admin\AppData\Local\89d22e83\tor\libcrypto-1_1.dll

MD5 2384a02c4a1f7ec481adde3a020607d3
SHA1 7e848d35a10bf9296c8fa41956a3daa777f86365
SHA256 c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369
SHA512 1ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503

memory/1792-17-0x0000000004040000-0x0000000004444000-memory.dmp

\Users\Admin\AppData\Local\89d22e83\tor\libssp-0.dll

MD5 2c916456f503075f746c6ea649cf9539
SHA1 fa1afc1f3d728c89b2e90e14ca7d88b599580a9d
SHA256 cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6
SHA512 1c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd

C:\Users\Admin\AppData\Local\89d22e83\tor\libevent-2-1-6.dll

MD5 099983c13bade9554a3c17484e5481f1
SHA1 a84e69ad9722f999252d59d0ed9a99901a60e564
SHA256 b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838
SHA512 89f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2

C:\Users\Admin\AppData\Local\89d22e83\tor\libgcc_s_sjlj-1.dll

MD5 b0d98f7157d972190fe0759d4368d320
SHA1 5715a533621a2b642aad9616e603c6907d80efc4
SHA256 2922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5
SHA512 41ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496

C:\Users\Admin\AppData\Local\89d22e83\tor\libwinpthread-1.dll

MD5 d407cc6d79a08039a6f4b50539e560b8
SHA1 21171adbc176dc19aaa5e595cd2cd4bd1dfd0c71
SHA256 92cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e
SHA512 378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c

memory/1100-36-0x00000000746F0000-0x0000000074778000-memory.dmp

C:\Users\Admin\AppData\Local\89d22e83\tor\libssl-1_1.dll

MD5 c88826ac4bb879622e43ead5bdb95aeb
SHA1 87d29853649a86f0463bfd9ad887b85eedc21723
SHA256 c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f
SHA512 f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3

memory/1100-33-0x0000000074040000-0x000000007414A000-memory.dmp

memory/1100-30-0x0000000074150000-0x0000000074218000-memory.dmp

memory/1100-26-0x0000000074780000-0x00000000747C9000-memory.dmp

memory/1100-25-0x0000000074220000-0x00000000744EF000-memory.dmp

C:\Users\Admin\AppData\Local\89d22e83\tor\zlib1.dll

MD5 add33041af894b67fe34e1dc819b7eb6
SHA1 6db46eb021855a587c95479422adcc774a272eeb
SHA256 8688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183
SHA512 bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa

memory/1100-42-0x0000000074820000-0x0000000074844000-memory.dmp

memory/1792-41-0x0000000004040000-0x0000000004444000-memory.dmp

memory/1100-39-0x0000000073F70000-0x000000007403E000-memory.dmp

C:\Users\Admin\AppData\Local\89d22e83\tor\torrc

MD5 644896c07049391168b23e7cbd46dcf0
SHA1 4dbdc7933b3984b6894ba5b05952de68586ef734
SHA256 a09a2fa3765c77e7dfdacc46f16da82448131b6d44754cdf984bc5b5aeb0d12f
SHA512 20faaa8ce578d9a11d4b86308a797a95d7d0757e120807b42d504b1a799dfc3131d3c3ab7610467cc4f4573ad35117c008b43b90996725b9f22647d5679decbb

memory/1100-46-0x00000000013A0000-0x00000000017A4000-memory.dmp

memory/1100-47-0x0000000074220000-0x00000000744EF000-memory.dmp

memory/1100-48-0x0000000074780000-0x00000000747C9000-memory.dmp

memory/1100-50-0x0000000074150000-0x0000000074218000-memory.dmp

memory/1792-49-0x0000000000400000-0x0000000000BD8000-memory.dmp

memory/1100-51-0x0000000074040000-0x000000007414A000-memory.dmp

memory/1100-52-0x00000000746F0000-0x0000000074778000-memory.dmp

memory/1100-53-0x0000000073F70000-0x000000007403E000-memory.dmp

memory/1100-54-0x00000000013A0000-0x00000000017A4000-memory.dmp

memory/1792-62-0x0000000000400000-0x0000000000BD8000-memory.dmp

memory/1100-63-0x00000000013A0000-0x00000000017A4000-memory.dmp

memory/1792-71-0x0000000000400000-0x0000000000BD8000-memory.dmp

C:\Users\Admin\AppData\Local\89d22e83\tor\data\cached-microdesc-consensus.tmp

MD5 0030ec38fb64384275255ed67bb74abe
SHA1 245c5b5fc9102f3fb73a442caad840663c3c98c2
SHA256 f48dc4b7791869e3d8a11420c100232a1f3ff3e95cfb4f926061c61a9ffccbda
SHA512 0d786a7786464006cb1d2d3740e1cd5da0aaba109d853fda92ce50bdd296667a140a1e81e614d612bb0a701324cf0b2ec514c2f932d585b836ebd3fb63552589

memory/1100-83-0x00000000013A0000-0x00000000017A4000-memory.dmp

C:\Users\Admin\AppData\Local\89d22e83\tor\data\cached-microdescs.new

MD5 e9c41616912c34b6b59528779e5eb05f
SHA1 921709969c30880d31aaa1439f3d9e46d6d3e679
SHA256 94819c5ebbeb3b2aea240d3a908c49444e255341b87ee982caf41bb0f9c2e003
SHA512 ef3078a956158d264d723239349acff77e5b5a407de97ceeb25ea695cf10a728f280d662ecec746e28305692ab24cd3a7494384d9c1dcc6c9401157893fa3dae

memory/1100-108-0x00000000013A0000-0x00000000017A4000-memory.dmp

memory/1100-125-0x00000000013A0000-0x00000000017A4000-memory.dmp

memory/1792-140-0x0000000004BE0000-0x0000000004FE4000-memory.dmp

memory/2424-141-0x00000000013A0000-0x00000000017A4000-memory.dmp

memory/2424-148-0x0000000074820000-0x0000000074844000-memory.dmp

memory/2424-147-0x0000000073F70000-0x000000007403E000-memory.dmp

memory/2424-146-0x0000000074040000-0x000000007414A000-memory.dmp

memory/2424-145-0x00000000746F0000-0x0000000074778000-memory.dmp

memory/2424-144-0x0000000074150000-0x0000000074218000-memory.dmp

memory/2424-143-0x0000000074780000-0x00000000747C9000-memory.dmp

C:\Users\Admin\AppData\Local\89d22e83\tor\data\cached-certs

MD5 4f85bfa3f905003b7f77309774653404
SHA1 3cf056921de5631d2df9b992c3b2d6169f23355a
SHA256 c00e96bb87763bc6d0ada5582afc7dba1217bfd1a83e8e3b01ad42a32e54fcea
SHA512 c9a501a930fd665b75728d8780568b11474a9ec5e65af26b3bcd1803c8b47919eab73e192e1e11460dd3c83278104dc2e40e44314869fed0e871d5f03883d14b

C:\Users\Admin\AppData\Local\89d22e83\tor\data\state

MD5 d77472ffb7510c53967379874015c638
SHA1 d9850d931e85c88dbd5b2590fbd46d597c48d11b
SHA256 771e4f8dc6178fd7e117be8665467d2bbb48cfb625c1ad0b50f82fc83be9801b
SHA512 fdde1382fefad6804cbf9f86add6e9b5d69705f67e276dae4ec6e5aa703006c975eb45e37acbcbf90b88201d42a9f15ab69cdd6ebce19149b7112968308c5c31

C:\Users\Admin\AppData\Local\89d22e83\tor\data\cached-microdescs.new

MD5 90838f333af7b22b964bef8b22aade9f
SHA1 a57e48a416796297a41a4f6ecf086fa349d73696
SHA256 491dab0cac60477e170c80a8f65c90a9619e52a96a9cfb3a71cb5881154b5b75
SHA512 57fd8b9be4b88277aa17276077d8536b01d5d8c87878699f4ea30a20d4abbafba23a7c5778ee11cbb104aea3a3186b35b00ff7e80b60b5053a303f5c97e02691

memory/2424-142-0x0000000074220000-0x00000000744EF000-memory.dmp

memory/1792-139-0x0000000000400000-0x0000000000BD8000-memory.dmp

memory/1792-161-0x0000000004BE0000-0x0000000004FE4000-memory.dmp

memory/2424-162-0x00000000013A0000-0x00000000017A4000-memory.dmp

memory/2424-165-0x0000000073F70000-0x000000007403E000-memory.dmp

memory/2424-164-0x0000000074150000-0x0000000074218000-memory.dmp

memory/2424-163-0x0000000074220000-0x00000000744EF000-memory.dmp

memory/2424-166-0x00000000013A0000-0x00000000017A4000-memory.dmp

memory/2424-175-0x00000000013A0000-0x00000000017A4000-memory.dmp

memory/1792-193-0x0000000000CD0000-0x0000000000CDA000-memory.dmp

memory/1792-192-0x0000000000CD0000-0x0000000000CDA000-memory.dmp

memory/2296-236-0x00000000746F0000-0x0000000074778000-memory.dmp

memory/2296-238-0x0000000074820000-0x0000000074844000-memory.dmp

memory/2296-237-0x0000000073F70000-0x000000007403E000-memory.dmp

memory/2296-235-0x0000000074040000-0x000000007414A000-memory.dmp

memory/2296-234-0x0000000074150000-0x0000000074218000-memory.dmp

memory/2296-233-0x0000000074780000-0x00000000747C9000-memory.dmp

memory/2296-232-0x0000000074220000-0x00000000744EF000-memory.dmp

memory/2296-231-0x00000000013A0000-0x00000000017A4000-memory.dmp

memory/1792-230-0x0000000005970000-0x0000000005D74000-memory.dmp

memory/2424-229-0x00000000013A0000-0x00000000017A4000-memory.dmp

C:\Users\Admin\AppData\Local\89d22e83\tor\data\state

MD5 5bdbbff3fc3675e9e82b254c6a56f9b2
SHA1 13b422dc199b10f3adaf944551340a6e00515da4
SHA256 a04f4d5a8d4077420b88862e688aeed34637d7a24b6587150283a73c059677c1
SHA512 b952dcaf995d1916d6f276604bc541bf2ddfff16f5412f339c3db9c5eb4f13d0b3224cf6663d5a43734596ea717715e040fb4a3c09237a6fed214d03e6d6d9cf

C:\Users\Admin\AppData\Local\89d22e83\tor\data\cached-microdescs

MD5 8b0ab82b2b3fe5b9c3213b41e388a710
SHA1 4c8b24ba57517b53dfb6d3c404091fa8bcb69b8e
SHA256 8d96bf2e0d2a470891c835edbe5203f1ef3b88bebb49f06e78da272c89f8fe8c
SHA512 be9f7571c8c04671f380e2fedd18c5a3a79a11de8783d82b4ddcf66a733bf861d1474ac6f388f167e19d92af2ad4bc6230cb3c546de780c420680f8f0f7bece2

memory/1792-243-0x0000000000CD0000-0x0000000000CDA000-memory.dmp

memory/1792-244-0x0000000000CD0000-0x0000000000CDA000-memory.dmp

memory/1792-247-0x0000000005970000-0x0000000005D74000-memory.dmp

memory/2296-248-0x00000000013A0000-0x00000000017A4000-memory.dmp

memory/2296-249-0x0000000074220000-0x00000000744EF000-memory.dmp

memory/2296-251-0x0000000073F70000-0x000000007403E000-memory.dmp

memory/2296-250-0x0000000074150000-0x0000000074218000-memory.dmp

memory/1792-271-0x0000000004D40000-0x0000000004D4A000-memory.dmp

memory/1792-270-0x0000000004D40000-0x0000000004D4A000-memory.dmp

memory/2296-281-0x00000000013A0000-0x00000000017A4000-memory.dmp

memory/2500-303-0x00000000747A0000-0x00000000747C4000-memory.dmp

memory/2500-302-0x00000000741B0000-0x000000007427E000-memory.dmp

memory/2500-301-0x0000000074280000-0x0000000074308000-memory.dmp

memory/2500-300-0x0000000074310000-0x000000007441A000-memory.dmp

memory/2500-299-0x0000000074420000-0x00000000744E8000-memory.dmp

memory/2500-298-0x0000000074730000-0x0000000074779000-memory.dmp

memory/2500-297-0x0000000073120000-0x00000000733EF000-memory.dmp

memory/2500-296-0x00000000013A0000-0x00000000017A4000-memory.dmp

memory/1792-295-0x0000000005970000-0x0000000005D74000-memory.dmp

C:\Users\Admin\AppData\Local\89d22e83\tor\data\state

MD5 d43b3732d91e746d0c70c77176f4ddfa
SHA1 0030347845fa58489a934e14f56072d1aceb7a90
SHA256 5a5312ba3bdd16582e4a01b4cc48d8bab1974f5c1b7b222f9fda187e20fb9285
SHA512 78273f714277371af8093b508823154d4ebd0b9f5f34a97f4760f5d4406dec3defcae003a3c5a4bea3a3006ee6d77dd546363c7b0332c3df182a87ca35597fbc

memory/1792-306-0x0000000004D40000-0x0000000004D4A000-memory.dmp

memory/1792-308-0x0000000004D40000-0x0000000004D4A000-memory.dmp

memory/1792-311-0x0000000005970000-0x0000000005D74000-memory.dmp

memory/2500-312-0x00000000013A0000-0x00000000017A4000-memory.dmp

memory/2500-314-0x0000000074420000-0x00000000744E8000-memory.dmp

memory/2500-315-0x00000000741B0000-0x000000007427E000-memory.dmp

memory/2500-313-0x0000000073120000-0x00000000733EF000-memory.dmp

memory/1792-334-0x0000000004D40000-0x0000000004D4A000-memory.dmp

memory/2500-344-0x00000000013A0000-0x00000000017A4000-memory.dmp

memory/2268-358-0x00000000013A0000-0x00000000017A4000-memory.dmp

memory/2268-365-0x0000000074820000-0x0000000074844000-memory.dmp

memory/2268-364-0x0000000073F70000-0x000000007403E000-memory.dmp

memory/2268-363-0x00000000746F0000-0x0000000074778000-memory.dmp

memory/2268-362-0x0000000074040000-0x000000007414A000-memory.dmp

memory/2268-361-0x0000000074150000-0x0000000074218000-memory.dmp

memory/2268-360-0x0000000074780000-0x00000000747C9000-memory.dmp

memory/1792-357-0x0000000005970000-0x0000000005D74000-memory.dmp

memory/2268-359-0x0000000074220000-0x00000000744EF000-memory.dmp

memory/1792-367-0x0000000004D40000-0x0000000004D4A000-memory.dmp

memory/1792-366-0x0000000004D40000-0x0000000004D4A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-02 13:57

Reported

2024-12-02 14:00

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe"

Signatures

BitRAT

trojan bitrat

Bitrat family

bitrat

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\prscrt = "C:\\Users\\Admin\\AppData\\Local\\AppData\\prscrt.exe" C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\prscrt = "C:\\Users\\Admin\\AppData\\Local\\AppData\\prscrt.exe먀" C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A myexternalip.com N/A N/A
N/A myexternalip.com N/A N/A
N/A myexternalip.com N/A N/A
N/A myexternalip.com N/A N/A
N/A myexternalip.com N/A N/A
N/A myexternalip.com N/A N/A
N/A myexternalip.com N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3656 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 3656 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 3656 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 3656 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 3656 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 3656 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 3656 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 3656 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 3656 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 3656 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 3656 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 3656 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 3656 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 3656 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 3656 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 3656 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 3656 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
PID 3656 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe

"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc

C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe

"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc

C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe

"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc

C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe

"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc

C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe

"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc

C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe

"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
DE 131.188.40.188:80 tcp
US 8.8.8.8:53 188.40.188.131.in-addr.arpa udp
SE 193.11.114.43:9001 tcp
N/A 127.0.0.1:63128 tcp
GB 140.238.101.233:9001 tcp
DE 144.76.162.202:8080 tcp
US 8.8.8.8:53 43.114.11.193.in-addr.arpa udp
US 8.8.8.8:53 233.101.238.140.in-addr.arpa udp
US 8.8.8.8:53 202.162.76.144.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
N/A 127.0.0.1:45808 tcp
DE 144.76.162.202:8080 tcp
GB 140.238.101.233:9001 tcp
PL 185.241.208.101:443 tcp
US 8.8.8.8:53 101.208.241.185.in-addr.arpa udp
US 8.8.8.8:53 myexternalip.com udp
US 34.160.111.145:443 myexternalip.com tcp
US 8.8.8.8:53 145.111.160.34.in-addr.arpa udp
US 8.8.8.8:53 r10.o.lencr.org udp
NL 95.101.74.205:80 r10.o.lencr.org tcp
US 8.8.8.8:53 49.113.40.23.in-addr.arpa udp
US 8.8.8.8:53 205.74.101.95.in-addr.arpa udp
N/A 127.0.0.1:45808 tcp
US 34.160.111.145:443 myexternalip.com tcp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 104.209.201.84.in-addr.arpa udp
DE 103.252.90.236:9300 tcp
US 8.8.8.8:53 236.90.252.103.in-addr.arpa udp
N/A 127.0.0.1:63240 tcp
N/A 127.0.0.1:63269 tcp
NL 192.42.115.101:9003 tcp
US 8.8.8.8:53 101.115.42.192.in-addr.arpa udp
N/A 127.0.0.1:45808 tcp
US 34.160.111.145:443 myexternalip.com tcp
US 8.8.8.8:53 223.74.101.95.in-addr.arpa udp
N/A 127.0.0.1:63339 tcp
NL 204.137.14.60:443 tcp
DE 103.252.90.236:9300 tcp
US 8.8.8.8:53 60.14.137.204.in-addr.arpa udp
N/A 127.0.0.1:45808 tcp
US 8.8.8.8:53 25.125.209.23.in-addr.arpa udp
US 34.160.111.145:443 myexternalip.com tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
DE 195.90.200.83:9001 tcp
N/A 127.0.0.1:63401 tcp
NL 204.137.14.60:443 tcp
US 8.8.8.8:53 83.200.90.195.in-addr.arpa udp
DE 103.252.90.236:9300 tcp
N/A 127.0.0.1:45808 tcp
US 34.160.111.145:443 myexternalip.com tcp
N/A 127.0.0.1:63453 tcp
LT 213.183.60.21:443 tcp
DE 103.252.90.236:9300 tcp
NL 204.137.14.60:443 tcp
N/A 127.0.0.1:45808 tcp
US 34.160.111.145:443 myexternalip.com tcp

Files

memory/3656-0-0x0000000000400000-0x0000000000BD8000-memory.dmp

memory/3656-1-0x0000000074920000-0x0000000074959000-memory.dmp

C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe

MD5 5cfe61ff895c7daa889708665ef05d7b
SHA1 5e58efe30406243fbd58d4968b0492ddeef145f2
SHA256 f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5
SHA512 43b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da

C:\Users\Admin\AppData\Local\89d22e83\tor\libssl-1_1.dll

MD5 c88826ac4bb879622e43ead5bdb95aeb
SHA1 87d29853649a86f0463bfd9ad887b85eedc21723
SHA256 c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f
SHA512 f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3

C:\Users\Admin\AppData\Local\89d22e83\tor\libssp-0.dll

MD5 2c916456f503075f746c6ea649cf9539
SHA1 fa1afc1f3d728c89b2e90e14ca7d88b599580a9d
SHA256 cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6
SHA512 1c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd

C:\Users\Admin\AppData\Local\89d22e83\tor\zlib1.dll

MD5 add33041af894b67fe34e1dc819b7eb6
SHA1 6db46eb021855a587c95479422adcc774a272eeb
SHA256 8688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183
SHA512 bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa

C:\Users\Admin\AppData\Local\89d22e83\tor\libwinpthread-1.dll

MD5 d407cc6d79a08039a6f4b50539e560b8
SHA1 21171adbc176dc19aaa5e595cd2cd4bd1dfd0c71
SHA256 92cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e
SHA512 378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c

C:\Users\Admin\AppData\Local\89d22e83\tor\torrc

MD5 644896c07049391168b23e7cbd46dcf0
SHA1 4dbdc7933b3984b6894ba5b05952de68586ef734
SHA256 a09a2fa3765c77e7dfdacc46f16da82448131b6d44754cdf984bc5b5aeb0d12f
SHA512 20faaa8ce578d9a11d4b86308a797a95d7d0757e120807b42d504b1a799dfc3131d3c3ab7610467cc4f4573ad35117c008b43b90996725b9f22647d5679decbb

C:\Users\Admin\AppData\Local\89d22e83\tor\libgcc_s_sjlj-1.dll

MD5 b0d98f7157d972190fe0759d4368d320
SHA1 5715a533621a2b642aad9616e603c6907d80efc4
SHA256 2922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5
SHA512 41ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496

memory/4516-24-0x0000000000170000-0x0000000000574000-memory.dmp

C:\Users\Admin\AppData\Local\89d22e83\tor\libevent-2-1-6.dll

MD5 099983c13bade9554a3c17484e5481f1
SHA1 a84e69ad9722f999252d59d0ed9a99901a60e564
SHA256 b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838
SHA512 89f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2

C:\Users\Admin\AppData\Local\89d22e83\tor\libcrypto-1_1.dll

MD5 2384a02c4a1f7ec481adde3a020607d3
SHA1 7e848d35a10bf9296c8fa41956a3daa777f86365
SHA256 c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369
SHA512 1ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503

memory/4516-40-0x0000000073810000-0x0000000073898000-memory.dmp

memory/4516-39-0x00000000739B0000-0x00000000739F9000-memory.dmp

memory/4516-38-0x0000000073A00000-0x0000000073ACE000-memory.dmp

memory/4516-37-0x0000000073AD0000-0x0000000073B98000-memory.dmp

memory/4516-42-0x00000000737E0000-0x0000000073804000-memory.dmp

memory/4516-41-0x0000000001390000-0x0000000001418000-memory.dmp

memory/4516-44-0x00000000738A0000-0x00000000739AA000-memory.dmp

memory/4516-43-0x0000000073BA0000-0x0000000073E6F000-memory.dmp

C:\Users\Admin\AppData\Local\89d22e83\tor\data\cached-microdesc-consensus.tmp

MD5 0030ec38fb64384275255ed67bb74abe
SHA1 245c5b5fc9102f3fb73a442caad840663c3c98c2
SHA256 f48dc4b7791869e3d8a11420c100232a1f3ff3e95cfb4f926061c61a9ffccbda
SHA512 0d786a7786464006cb1d2d3740e1cd5da0aaba109d853fda92ce50bdd296667a140a1e81e614d612bb0a701324cf0b2ec514c2f932d585b836ebd3fb63552589

memory/3656-53-0x00000000733D0000-0x0000000073409000-memory.dmp

memory/3656-54-0x0000000000400000-0x0000000000BD8000-memory.dmp

C:\Users\Admin\AppData\Local\89d22e83\tor\data\cached-microdescs.new

MD5 594a1951366a18f0c7c17d5f7d9ffaf9
SHA1 76d4ebfc5402de3e65ef755b62c894cec20877da
SHA256 d6a11915f2eeb2b6a3979f8da1071d01cad567286656c2e9c48a1d633b626173
SHA512 c0433d45b09e355aaede846ac1997404eae86b874b09f937be965f17080f5cd40712768ae4831bdd22667dcffa83189b71c93f30fffc3bbd191d542bd86b7328

memory/4516-71-0x0000000000170000-0x0000000000574000-memory.dmp

memory/4516-72-0x0000000000170000-0x0000000000574000-memory.dmp

memory/4516-80-0x0000000001390000-0x0000000001418000-memory.dmp

memory/3656-81-0x0000000000400000-0x0000000000BD8000-memory.dmp

memory/4516-88-0x0000000000170000-0x0000000000574000-memory.dmp

memory/3656-96-0x0000000000400000-0x0000000000BD8000-memory.dmp

memory/4516-97-0x0000000000170000-0x0000000000574000-memory.dmp

memory/4516-106-0x0000000001390000-0x0000000001418000-memory.dmp

memory/3980-117-0x0000000073AD0000-0x0000000073B98000-memory.dmp

memory/3980-116-0x0000000073BA0000-0x0000000073E6F000-memory.dmp

memory/3980-122-0x00000000737E0000-0x0000000073868000-memory.dmp

memory/3980-121-0x0000000073870000-0x000000007397A000-memory.dmp

memory/3980-120-0x0000000073980000-0x00000000739A4000-memory.dmp

memory/3980-119-0x00000000739B0000-0x00000000739F9000-memory.dmp

memory/3980-118-0x0000000073A00000-0x0000000073ACE000-memory.dmp

C:\Users\Admin\AppData\Local\89d22e83\tor\data\cached-certs

MD5 622056089c4276261f4377df7a873e98
SHA1 da9ca39d357921671b87cbdf343ccbec88cf2df9
SHA256 d9baae7c29e72b05b6cea62eadafabd5fa039d27814d564eeeade040b065d5aa
SHA512 78d269e93c6fb902f963b59d6b02c87c9d88611525edaf76db83423cc39ec0586a2310abe9888c16378a50eb8683550ea826bff54a8782ada083c73acf9deffc

C:\Users\Admin\AppData\Local\89d22e83\tor\data\state

MD5 d77472ffb7510c53967379874015c638
SHA1 d9850d931e85c88dbd5b2590fbd46d597c48d11b
SHA256 771e4f8dc6178fd7e117be8665467d2bbb48cfb625c1ad0b50f82fc83be9801b
SHA512 fdde1382fefad6804cbf9f86add6e9b5d69705f67e276dae4ec6e5aa703006c975eb45e37acbcbf90b88201d42a9f15ab69cdd6ebce19149b7112968308c5c31

memory/3980-115-0x0000000000170000-0x0000000000574000-memory.dmp

C:\Users\Admin\AppData\Local\89d22e83\tor\data\cached-microdescs.new

MD5 92fc048f480de572780d62d47d25526c
SHA1 bfae3833b55c18f43f46ca2b250a6660097426b6
SHA256 8c94761542622ba32372b3eaccc39a3fcd7cf3212ad6ae9ecf4e4205cb3e44d1
SHA512 0948553c672cb14154c573fe34c60f82221f28052a6cce2b3136fca49838e384764b1b4f434cd71aa624e259afcb8a10be7774eb8d0e5a26a50b34845488dfdb

memory/3400-142-0x0000000073980000-0x00000000739A4000-memory.dmp

memory/3400-145-0x0000000073AD0000-0x0000000073B98000-memory.dmp

memory/3400-147-0x0000000073BA0000-0x0000000073E6F000-memory.dmp

memory/3400-149-0x0000000001350000-0x000000000161F000-memory.dmp

memory/3400-144-0x00000000737E0000-0x0000000073868000-memory.dmp

memory/3400-161-0x00000000739B0000-0x00000000739F9000-memory.dmp

memory/3400-162-0x0000000073980000-0x00000000739A4000-memory.dmp

memory/3400-160-0x0000000073A00000-0x0000000073ACE000-memory.dmp

memory/3400-159-0x0000000073AD0000-0x0000000073B98000-memory.dmp

memory/3400-158-0x0000000073BA0000-0x0000000073E6F000-memory.dmp

memory/3400-157-0x00000000737E0000-0x0000000073868000-memory.dmp

memory/3400-156-0x0000000073870000-0x000000007397A000-memory.dmp

memory/3400-151-0x0000000000170000-0x0000000000574000-memory.dmp

memory/3400-143-0x0000000073870000-0x000000007397A000-memory.dmp

memory/3400-141-0x00000000739B0000-0x00000000739F9000-memory.dmp

memory/3400-140-0x0000000073A00000-0x0000000073ACE000-memory.dmp

memory/3980-164-0x0000000000170000-0x0000000000574000-memory.dmp

memory/3656-163-0x0000000000400000-0x0000000000BD8000-memory.dmp

memory/3980-167-0x0000000073BA0000-0x0000000073E6F000-memory.dmp

memory/3980-169-0x0000000073A00000-0x0000000073ACE000-memory.dmp

memory/3980-168-0x0000000073AD0000-0x0000000073B98000-memory.dmp

memory/3980-170-0x0000000000170000-0x0000000000574000-memory.dmp

memory/3980-179-0x0000000000170000-0x0000000000574000-memory.dmp

memory/3656-187-0x0000000000400000-0x0000000000BD8000-memory.dmp

memory/3980-189-0x0000000000170000-0x0000000000574000-memory.dmp

memory/1140-212-0x00000000737E0000-0x0000000073868000-memory.dmp

memory/1140-211-0x0000000073870000-0x000000007397A000-memory.dmp

memory/1140-210-0x0000000073980000-0x00000000739A4000-memory.dmp

memory/1140-209-0x00000000739B0000-0x00000000739F9000-memory.dmp

memory/1140-208-0x0000000073A00000-0x0000000073ACE000-memory.dmp

memory/1140-207-0x0000000073AD0000-0x0000000073B98000-memory.dmp

memory/1140-206-0x0000000073BA0000-0x0000000073E6F000-memory.dmp

memory/1140-205-0x0000000000170000-0x0000000000574000-memory.dmp

C:\Users\Admin\AppData\Local\89d22e83\tor\data\state

MD5 684938d05792e2e62ba50f7c18ca0e0f
SHA1 f87b57a6f183d4da087da8713819f76be7ec01d6
SHA256 bd7c2b670fc98f20e2565585c73b49b84a5ae00cc9264efb75bec2edfe949215
SHA512 075a5847ccf532ac637ae1d6389d7b4bc8ab4e7b6cdfbc63910476ed8a3543bf27e84940d1b53e568593560a25d7dac0af93f25d87f6c55fa893b8691f6c6e29

C:\Users\Admin\AppData\Local\89d22e83\tor\data\cached-microdescs

MD5 92f4cc9ee10769f5c19fd6aefdaef31b
SHA1 acddbfd9fc017e2c78a3b2916e82d611337a14d5
SHA256 8d5cdb78ccd895557addcd5e78913080b394a574f58b01042fe0a695eee5f35a
SHA512 10e6aa082c42e2cf8f4ac11bf39a6361204a1c39703e43c4757765b1be6b175d40e1d0141f53eb50b8270f8164c2ce1f6b694e57c288834d2093c05bd170a71e

memory/3656-218-0x0000000000400000-0x0000000000BD8000-memory.dmp

memory/1140-219-0x0000000000170000-0x0000000000574000-memory.dmp

memory/1140-220-0x0000000073BA0000-0x0000000073E6F000-memory.dmp

memory/1140-221-0x0000000073AD0000-0x0000000073B98000-memory.dmp

memory/1140-222-0x0000000073A00000-0x0000000073ACE000-memory.dmp

memory/3656-231-0x0000000074920000-0x0000000074959000-memory.dmp

memory/1140-251-0x0000000000170000-0x0000000000574000-memory.dmp

memory/4388-265-0x00000000737E0000-0x0000000073868000-memory.dmp

memory/4388-266-0x0000000073BA0000-0x0000000073E6F000-memory.dmp

memory/4388-264-0x0000000073870000-0x000000007397A000-memory.dmp

memory/4388-263-0x0000000073980000-0x00000000739A4000-memory.dmp

memory/4388-262-0x00000000739B0000-0x00000000739F9000-memory.dmp

memory/4388-261-0x0000000073A00000-0x0000000073ACE000-memory.dmp

memory/4388-260-0x0000000073AD0000-0x0000000073B98000-memory.dmp

C:\Users\Admin\AppData\Local\89d22e83\tor\data\state

MD5 c37c26f772602476c66a0dbcb7060cd2
SHA1 f6431f881ed0c3e333e0919f77574ef2f232c7a4
SHA256 6b473712d957ec89590fb4048dd4542e429f10a60c50bbf901059688b8ed0227
SHA512 a4e11158ed005783b3f867c7c238e547d61c0c624f4c82cdca113f0f484da4d8a7224ed1bf188b14dcd20d5f5735c182f239f1c202340aa9ce03c1e5a7226bc8

memory/4388-272-0x0000000000170000-0x0000000000574000-memory.dmp

memory/4388-273-0x0000000073AD0000-0x0000000073B98000-memory.dmp

memory/4388-274-0x0000000073A00000-0x0000000073ACE000-memory.dmp

memory/4388-276-0x0000000073870000-0x000000007397A000-memory.dmp

memory/4388-275-0x0000000073980000-0x00000000739A4000-memory.dmp

memory/4388-285-0x0000000073BA0000-0x0000000073E6F000-memory.dmp

memory/4388-305-0x0000000000170000-0x0000000000574000-memory.dmp

memory/5072-311-0x0000000073BA0000-0x0000000073E6F000-memory.dmp

memory/5072-310-0x00000000737E0000-0x0000000073868000-memory.dmp

memory/5072-309-0x0000000073870000-0x000000007397A000-memory.dmp

memory/5072-308-0x00000000739B0000-0x00000000739F9000-memory.dmp

memory/5072-307-0x0000000000170000-0x0000000000574000-memory.dmp

memory/5072-315-0x0000000000170000-0x0000000000574000-memory.dmp

memory/5072-316-0x0000000073AD0000-0x0000000073B98000-memory.dmp

memory/5072-317-0x0000000073A00000-0x0000000073ACE000-memory.dmp

memory/5072-320-0x00000000737E0000-0x0000000073868000-memory.dmp

memory/5072-319-0x0000000073870000-0x000000007397A000-memory.dmp

memory/5072-318-0x0000000073980000-0x00000000739A4000-memory.dmp

memory/5072-329-0x0000000073BA0000-0x0000000073E6F000-memory.dmp