Overview

overview

10

Static

static

10

JaffaCakes...83.exe

windows7-x64

10

JaffaCakes...83.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    58s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04-01-2025 16:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_7a93711b9e43bf3592afa82d08a39183.exe

  • Size

    1.0MB

  • MD5

    7a93711b9e43bf3592afa82d08a39183

  • SHA1

    31002d95ede8024a4391250c4f52c9639efb47a4

  • SHA256

    4d9592240ba9b45e0926420620c3d3edfbb1eb628c9dbb40d47769455301bc1c

  • SHA512

    a62360cfc580051b6980f47619a9008b29d9ff3986923838e0d19fd3dfab9e69e43b5f308021605084360f184170ffc0e4a1a215cea417a36ec514a6e1bcf8f7

  • SSDEEP

    24576:lKT4+OyYLf9lVvCNkFNXCaSUsGSY/Dwyw8rGaF:lKE+6BlFCNkFNXCaSdVN8JF

Score
10/10
neshtasalitybackdoordiscoveryevasionpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Detect Neshta payload 7 IoCs
  • Modifies firewall policy service 3 TTPs 6 IoCs
    evasion
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Neshta family
    neshta
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Sality family
    sality
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 12 IoCs
    evasiontrojan
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 34 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 32 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1088
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1168
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1192
          • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7a93711b9e43bf3592afa82d08a39183.exe
            "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7a93711b9e43bf3592afa82d08a39183.exe"
            2⤵
            • Loads dropped DLL
            • Modifies system executable filetype association
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:2936
            • C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_7a93711b9e43bf3592afa82d08a39183.exe
              "C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_7a93711b9e43bf3592afa82d08a39183.exe"
              3⤵
              • Modifies firewall policy service
              • UAC bypass
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • Checks whether UAC is enabled
              • Enumerates connected drives
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2808
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1440
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
            1⤵
              PID:2252
            • C:\Windows\system32\taskeng.exe
              taskeng.exe {1CC51587-D796-451A-8C48-3A882BAC8636} S-1-5-21-3063565911-2056067323-3330884624-1000:KHBTHJFA\Admin:Interactive:[1]
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:1508
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe" http://www.skype.com/go/downloading?source=lightinstaller&ver=5.5.0.124.259&LastError=12007
                2⤵
                • Modifies Internet Explorer settings
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3040
                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
                  3⤵
                  • Modifies firewall policy service
                  • UAC bypass
                  • Windows security bypass
                  • Deletes itself
                  • Enumerates connected drives
                  • System Location Discovery: System Language Discovery
                  • Modifies Internet Explorer settings
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:1876

            Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Change Default File Association

            1
            T1546.001

            Privilege Escalation

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Change Default File Association

            1
            T1546.001

            Defense Evasion

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Impair Defenses

            4
            T1562

            Disable or Modify System Firewall

            1
            T1562.004

            Disable or Modify Tools

            3
            T1562.001

            Modify Registry

            7
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Peripheral Device Discovery

            1
            T1120

            Query Registry

            1
            T1012

            System Information Discovery

            3
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\MSOCACHE\ALL USERS\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe
              Filesize

              186KB

              MD5

              58b58875a50a0d8b5e7be7d6ac685164

              SHA1

              1e0b89c1b2585c76e758e9141b846ed4477b0662

              SHA256

              2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae

              SHA512

              d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b

              Download Submit

            • C:\MSOCACHE\ALL USERS\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe
              Filesize

              1.1MB

              MD5

              566ed4f62fdc96f175afedd811fa0370

              SHA1

              d4b47adc40e0d5a9391d3f6f2942d1889dd2a451

              SHA256

              e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460

              SHA512

              cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7

              Download Submit

            • C:\MSOCACHE\ALL USERS\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE
              Filesize

              859KB

              MD5

              02ee6a3424782531461fb2f10713d3c1

              SHA1

              b581a2c365d93ebb629e8363fd9f69afc673123f

              SHA256

              ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc

              SHA512

              6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec

              Download Submit

            • C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe
              Filesize

              547KB

              MD5

              cf6c595d3e5e9667667af096762fd9c4

              SHA1

              9bb44da8d7f6457099cb56e4f7d1026963dce7ce

              SHA256

              593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

              SHA512

              ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

              Download Submit

            • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
              Filesize

              129KB

              MD5

              b1e0da67a985533914394e6b8ac58205

              SHA1

              5a65e6076f592f9ea03af582d19d2407351ba6b6

              SHA256

              67629b025fed676bd607094fa7f21550e18c861495ba664ee0d2b215a4717d7f

              SHA512

              188ebb9a58565ca7ed81a46967a66d583f7dea43a2fc1fe8076a79ef4a83119ccaa22f948a944abae8f64b3a4b219f5184260eff7201eb660c321f6c0d1eba22

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              aef891e570314f3440bd2d5856f2168b

              SHA1

              10875ea13e158407d44fffe9a8b2f531f09e673b

              SHA256

              19e7d26e2e3420110c7e8722b9f2b291fc2895a26caab77ef170722a1c3fe7cd

              SHA512

              35e69ea616cf56ccacac54480cdf4813947ab5d8444232b7acbf84baae87c81e56b8f2bfdde310f7dd14d1de938eddbfe15c62cbd7df3069aea9cddc70a4fb6d

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              92390be9c418cd010866d5e4fd7d0208

              SHA1

              a28829314c2a21aefc4fdbaafb0d5a078b56bc80

              SHA256

              fbf1d02164a6d17a2b14176971d7f4ffe57008da270ec910fbaf3381278feb1e

              SHA512

              633370efb45a813dbdab59df77629481abd384dd3dca689e6046fbd24b7fd5faf76600ed28d423e80c1a0c5ed6f15fba6f3b96eed9ff59ed357e221572a5b249

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              412e66a5eb155700822b14351f2bfbda

              SHA1

              ee26f6c6a70202be9492e53054ea32a616afd818

              SHA256

              573a0156f660410145afe145c9605571d8c51752fc08763ae0d99e7f0253e2bf

              SHA512

              8416f5da6168f97cb0e870ec12ff381da0cd3ffb85b3a56a096714186b382bff061456945e55631e825c94e584b63166a15ab2a47382e6e150e6c5122b26205f

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              e4ad99089c2e332a9512a393d170947c

              SHA1

              c9070383e72900bc6949c251757ff07673f88876

              SHA256

              f5f84a46fc639a1842d6d29a5f46ad6d2bfc443117a5036fee93bb0d94c118e7

              SHA512

              115a824f722b83cc04772da500a8b19cf080a8f968f9b9aacc3eac30ee1dff32df86a12e8078d2d4c02e69a41b2833f4ec61999fe1c5611526336839d6a8d71e

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              7990e99be0652ad40056817b2a45c371

              SHA1

              52be791660139f1146aa6702449f06a7adc5490e

              SHA256

              dfa4794f9f37b05089ea75d3bf44c929f21d52f619102f2b0a2ef972e4ea9d9b

              SHA512

              996461e7fc98592ac47f7c8e344769cdeb4b8cd0244cd4d9be0f4d5069528ebb49b0314f75ccda2bcf9781966cd138bdcca1e9cc0d9f8c513b5c8cc5e24efdc9

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              a4d01769c4e50a580a3b64f484917e09

              SHA1

              dbb81669f641cafabab3146c9a56029a3f3fd324

              SHA256

              37036cc0139c1251b6a07163f235cb11e243c545db1698ad62d4ed5ad9c1d3f4

              SHA512

              787eb41de2b84e0c60114e02ddd0cdb6e81b570f78d98d24e038fc8125d0f77a5fc8d94002c1f766f62d78ee8ebcee1d454e1ad4696e722e298e031b61e57c28

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              4f54e7c21898267709247d481a61308e

              SHA1

              f7ac29b969cfe2742235c3640c1c5d62ae71aeea

              SHA256

              cb9e8ac51e7226e381891252f8c548cf2620920b4e709399cf0d169f3cd72596

              SHA512

              ce47e766bb80be81d54e01f2252efa0c5a2db386cc77f5efae62636129a4bfc2d32593211d42d6e0c98c150897f33ab57f6526b6b4fe8b7df975ea3f5160d3ee

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              7ae78574f5b668e613d7d99b74664a8f

              SHA1

              8f3d372dcf05b0944c34c523ae8e084e67fd1503

              SHA256

              1d7512c36d7f579a11ca810950078fc7ee9a28260d08529e18d99dbe45a0bbd6

              SHA512

              411262610b3c10a319c9ecb0d7de04a8cb8afb22a73842f331467f7b614e06337b2df1a7b692f5afd2ac00ae407e0a7e424db5987b1e8fa58af512b830c51d0a

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              f0e6c195637cf95a5bc6511e38afc6cc

              SHA1

              373f5fde26ed324a4420dbe8c7ad0c9f0ca0a97f

              SHA256

              f3c6a2e6d94419eaaa32fb88650fa15e6aaa0500e2def996f3c0c45a5661a3ff

              SHA512

              faf21622d679aa9bb7242b265e8b50f535a3283a33095a28066b7d7d3d004f33adfc726fac5da0d68977f66b9de64a89c656f79dd442e23f07f29b1c87d32b64

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              81501ffaadbed303e94f21335775ee73

              SHA1

              bb4eaefd4ce4dadbd6192dd9a17427b5ef1dde93

              SHA256

              2673a6ee1e0d53a8bfc5d27c55be6ef971fdccbd3bdc2784bd9b15bd97537a22

              SHA512

              caf3d59afc1178e5cd6af57158ffef850eeac52a5449341610ab0579e98569549f37c11c840196e82179781d5ee59fda97cfc45292666b75bfc2f79495ffacdf

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              ee06e63bb4a1fb574227aac35e1cce15

              SHA1

              0f047359c8b35f9255a66000425edd21e4554aff

              SHA256

              1dd8cec11243377d45f9b4d5ed01a22858ccda7a25be18a9bf62fb874b114f38

              SHA512

              a7e406988ccfbed9032195686fe4532ba872feeaa26ed1925f4d511b1daba268a49ab2ef046489c7fc7c5be26cbff0356eac1591fadcd76bae594f4619cc1cbe

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              cbcae4fb4371f8effa4d120bd2a2fb2c

              SHA1

              10c5723f0cfb6daf4b24742b3161185c63a90142

              SHA256

              736c4104391d186a79cf28e4b2335c6a3bae1852462e5243542717ba98169ad0

              SHA512

              6d5aef5506bcfc9c87655cb19b406318af0f3de8026d32a9c14dc8241185562c32d658a8513ef670e9c9ee3b1037059662d4e05ac3af85fa3613040b1fa8cb35

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              d669ae626916fb6639e9c7966730429b

              SHA1

              af1a2a61c89d15521e16f51d1971977cf0387550

              SHA256

              28a5a6123f2146b45f6be33754cbfef7758d04d764f7f89bfdb8452444ce615c

              SHA512

              88e38ec294778789308588fd91f94b26af150ce152af66c50ac8820d70ed11cf051975a4ba8e269e88df79a6d10efa3f2ba30d4ac8363beeda36dcf47e6ff710

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              5d40072be8a2d66c0136618080f181ed

              SHA1

              3d4922e25b3cc6d03c73450c938abaf6eecdd49b

              SHA256

              50b90633b1c30b4202c447950a1b30e55d2466735192c770b254d7cd7db3b7f3

              SHA512

              9ef18bf4de8d1441e3b8579f53a829d2a45dee10aac970471de911d4b56de56569c2a23f78b835a4f8bcc5800928c961d701367757d317bc1e885d3e4d48bf0a

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              3b7ab8423d1968b4c882e00455cfa5f4

              SHA1

              277bede735705d9fef30a666bed8207aff48a171

              SHA256

              6afe0cafc9d04029442ddd34cad722a40f173a72556b6e728076a1c2524a580a

              SHA512

              9815978a9cf911d432d13cec4d3bf36535744909b7ab6d48bb5471d27dd844ffb26e9286a747b27550b1b3825a9ac231a75f45e1010b083a4c1e5bece91d3752

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              3d81584809b9856dd9732750172bd4b3

              SHA1

              d5bd85edec148eeb32aa889ae167f7bc2254edbb

              SHA256

              fb433b06de33c350295bc90b6f71b17852ec39cde61bc89ae7ceee8ecb74e0b5

              SHA512

              9cfb7ddd9b86285ee5ffd9f39f5904d29c71e3a2cf6be1c0841f3cf1313018f113cafcd0edf6acdaeda0ed237359eaf65090f3afa5bc3df5a80a5b0763390ea2

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              3a5ff709ef574918f9f8cc6680e77645

              SHA1

              8f4b1a67ca228ceb13e6f3e0b757adb3f95fc17e

              SHA256

              951c2828fdda763ecc9da8b76f07166a4130e0646ce1a4aa95d169b57afadc74

              SHA512

              fa9b22f633805c649430b88acad9c46b2d60c254a806fa4ca1d99be452a0f1dff6912442546a50dd585b78d21001cf283b817536be191206bd3d7a6172a8e9bd

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              4d633851cda4361e8f5adc4c6eff6882

              SHA1

              97ef8d1001598bfa7420cb1187c71b404b3b8809

              SHA256

              690af5930e556d60b68d85a2bf86358691fad18b6e7cc1434fb1fb101c7d56ae

              SHA512

              296d72101c83376bf4d58fb71f66a997506bbbbe319b9754a656680c0870ef9b3b9d1e3b8d55c0bed75f25e26cf24b99d797b31047e8bef66f2502ba436c74a0

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              a1bc1cae42aca4222b6db899747bf7a0

              SHA1

              a4c6bc6cb134a29c8184c8fe1c92d98776a92d9c

              SHA256

              089092fdbc5a6c3f60dd02a890e6d56ef6662103e2a7bba9ea5e13e6ec9904a8

              SHA512

              23d28cafb0115a062b591ef0a2bd773a5617c1d18e67491a41c6c6e316c0beb4acb5e91b03420d6919af4794810a9888e47ece0c7122ccf74a664c22109eb4ab

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              77c3854ca554bbb4cdc32d9583752b34

              SHA1

              5863620856a67988cc4540ad3b485252f07e8fef

              SHA256

              9c2be90ce6586392e254439e6817de3fed6a38c5a0147e6c7aac7d02c3ad57dc

              SHA512

              edc74a8cc6c335f637942c225a26d361c5642edd2c07596ffc49af87358d3d08a5d4e08f94b6413c78965b70fdeb8eece774945b8379f064b086d449623d74ad

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              a34b3385705b90e4688f232c6abfbe16

              SHA1

              1a4a93c51b6bfc2868bd55d6da7510cdc07b5aea

              SHA256

              3b7a8ada224d16308728fa4f77bfa465ee6043fa9a3fc10ece3b0e01a124412f

              SHA512

              49b72b2f0b797d804a76fcd1eab5ffa542af1438d600270988e8dd2ddc785d0c1e30c6e8897af5b08a1c2379eae0756418d773ce8bda4f3ada9d9181995cc219

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              08d3cea83a6e5cb60ed7848ab192b05c

              SHA1

              b4b56a255c0d85e249a0fb7f970e68fe2d31cc8d

              SHA256

              6f1bd5f22e3b004401d3d84c4b2db772dc26e5bbcde9e9b687dbf0b4018afefd

              SHA512

              b9b17cc221856895913ab4997000b5d9836c1ee2d39ebb34a173b034f0b9c39a60583af098461054a33e5d78c3a359569f6a1af8287149604520f0937ca61439

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              3d41ab5c29bd6534904f885bdeed037b

              SHA1

              d99a72acd1f01b3145606d27827b63621eb43ae5

              SHA256

              5dee9739eb527df8f0e796a450ae28e6510ca6681d39e35ce0d2d703eb60de7c

              SHA512

              269e33ad0d26ab6fc53681b7c04295adc04eeb0debec0b40624fb3c0798500827c9f480feabf006813b740dc3843112d3bd7c7c80ade890353c1e2f612cc9715

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\CabE39D.tmp
              Filesize

              70KB

              MD5

              49aebf8cbd62d92ac215b2923fb1b9f5

              SHA1

              1723be06719828dda65ad804298d0431f6aff976

              SHA256

              b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

              SHA512

              bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\TarE48A.tmp
              Filesize

              181KB

              MD5

              4ea6026cf93ec6338144661bf1202cd1

              SHA1

              a1dec9044f750ad887935a01430bf49322fbdcb7

              SHA256

              8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

              SHA512

              6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

              Download Submit

            • C:\Windows\SYSTEM.INI
              Filesize

              257B

              MD5

              7cfb6d2ae0c40d2057a09d5e27537024

              SHA1

              04a22aab2d8f3a5f1d3f5cd05ffc704102d13d6a

              SHA256

              f4274b97e16ccb7d3aa9b47f3eb8004c41316d98b29ebd69005e7344509342a6

              SHA512

              cb3369fed983188f2efcaf462d8d1cbc1ef14697116b3e03cf4e24620093f414b8670886f01f1b4915a6d39dd7002dcc2ba28f5761f0bba3033770a92ac65a56

              Download Submit

            • C:\lntb.exe
              Filesize

              100KB

              MD5

              d974cd809b1785111dfc4b02f2935e3e

              SHA1

              f7c9fc083e22cb400736071c567d71ca2cf3695e

              SHA256

              c4fe27ddf34245634e1ababec33d5e195e3bada02d1c5be0568418406a575194

              SHA512

              2af18d2fd2b0be9d2a81cd6590033de0cc8b5f4e0653bd4bd42ca3903d47d12557db52b28da1e6b11f4a92cf5067977c06dd6abd25007a88031421b17593df7a

              Download Submit

            • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
              Filesize

              252KB

              MD5

              9e2b9928c89a9d0da1d3e8f4bd96afa7

              SHA1

              ec66cda99f44b62470c6930e5afda061579cde35

              SHA256

              8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

              SHA512

              2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

              Download Submit

            • \Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_7a93711b9e43bf3592afa82d08a39183.exe
              Filesize

              1.0MB

              MD5

              3e94f3a89ead26df2c1de2b61728ba35

              SHA1

              9c14329a1c6dd06dd2811adb5262c1341f35f97f

              SHA256

              3ff5ce6815d547eefecff64298f97f748201d84390c2ec92f2f758c8a9c97ce9

              SHA512

              c0135394d652845d2333fad8b20935dece0f2cdf6c63d2da0891818c3ff85a483fac2621b9848cf86eb2c9d4acecdd4a9f01190ad0b102ce01f59628df8ebcf9

              Download Submit

            • memory/1088-21-0x0000000000220000-0x0000000000222000-memory.dmp

              Filesize

              8KB

              Download

            • memory/2808-43-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-107-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-140-0x00000000002C0000-0x00000000002C1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2808-141-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-143-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-145-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-146-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-149-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-150-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-138-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-128-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-153-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-156-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-158-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-13-0x0000000000400000-0x0000000000683000-memory.dmp

              Filesize

              2.5MB

              Download

            • memory/2808-202-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-203-0x0000000000400000-0x0000000000683000-memory.dmp

              Filesize

              2.5MB

              Download

            • memory/2808-20-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-18-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-127-0x0000000000240000-0x0000000000242000-memory.dmp

              Filesize

              8KB

              Download

            • memory/2808-124-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-123-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-122-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-139-0x0000000000400000-0x0000000000683000-memory.dmp

              Filesize

              2.5MB

              Download

            • memory/2808-41-0x0000000000240000-0x0000000000242000-memory.dmp

              Filesize

              8KB

              Download

            • memory/2808-109-0x0000000000400000-0x0000000000683000-memory.dmp

              Filesize

              2.5MB

              Download

            • memory/2808-106-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-44-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-45-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-19-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-15-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-16-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-42-0x00000000002C0000-0x00000000002C1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2808-39-0x0000000000240000-0x0000000000242000-memory.dmp

              Filesize

              8KB

              Download

            • memory/2808-17-0x0000000001FB0000-0x000000000303E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2808-37-0x00000000002B0000-0x00000000002B1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2936-31-0x0000000002870000-0x0000000002871000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2936-38-0x0000000000350000-0x0000000000352000-memory.dmp

              Filesize

              8KB

              Download

            • memory/2936-29-0x0000000002870000-0x0000000002871000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2936-28-0x0000000000350000-0x0000000000352000-memory.dmp

              Filesize

              8KB

              Download

            • memory/2936-40-0x0000000000350000-0x0000000000352000-memory.dmp

              Filesize

              8KB

              Download

            • memory/2936-108-0x0000000002D90000-0x0000000003013000-memory.dmp

              Filesize

              2.5MB

              Download

            • memory/2936-126-0x0000000000350000-0x0000000000352000-memory.dmp

              Filesize

              8KB

              Download

            • memory/2936-129-0x0000000000400000-0x000000000041B000-memory.dmp

              Filesize

              108KB

              Download

            • memory/2936-161-0x0000000000400000-0x000000000041B000-memory.dmp

              Filesize

              108KB

              Download

            • memory/2936-7-0x0000000002D90000-0x0000000003013000-memory.dmp

              Filesize

              2.5MB

              Download