Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/03/2025, 16:05

General

  • Target
    JaffaCakes118_5a064addca31cc7ca448cbb6e4c78a4a.exe
  • Size 2.7MB
  • Sample250309-tjf9qsvmt3
  • SHA256 9dae201039484054b1ff046169b7b4b5647c391b6bdb5817bcb25684fe364c09
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • latentbot

C2
  • flaboyserver.zapto.org

Signatures

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

  • Latentbot family
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Drops file in System32 directory 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3416
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5a064addca31cc7ca448cbb6e4c78a4a.exe
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5a064addca31cc7ca448cbb6e4c78a4a.exe"
        2⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:456
        • C:\Users\Admin\AppData\Roaming\JaffaCakes118_5a064addca31cc7ca448cbb6e4c78a4a.exe
          "C:\Users\Admin\AppData\Roaming\JaffaCakes118_5a064addca31cc7ca448cbb6e4c78a4a.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3284
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\tPOqY.exe.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\tPOqY.exe.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1956
            • C:\Users\Admin\AppData\Roaming\lolilol.exe
              "C:\Users\Admin\AppData\Roaming\lolilol.exe"
              5⤵
              • Adds policy Run key to start application
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:2100
              • C:\Windows\SysWOW64\explorer.exe
                explorer.exe
                6⤵
                • Boot or Logon Autostart Execution: Active Setup
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:1380
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe"
                6⤵
                  PID:3220
                • C:\Users\Admin\AppData\Roaming\lolilol.exe
                  "C:\Users\Admin\AppData\Roaming\lolilol.exe"
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3424
                  • C:\Windows\SysWOW64\WinDir\Svchost.exe
                    "C:\Windows\system32\WinDir\Svchost.exe"
                    7⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2648
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 584
                      8⤵
                      • Program crash
                      PID:4012
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2648 -ip 2648
        1⤵
          PID:2680

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              JaffaCakes118_5a064addca31cc7ca448cbb6e4c78a4a.exe.log

              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\JaffaCakes118_5a064addca31cc7ca448cbb6e4c78a4a.exe.log
              • Size 319B
              • SHA256 1493eb1dc75a64eb2eb06bc9eb2c864b78fc4a2c674108d5183ac7824013ff2d
              • MD5 SHA1 SHA512

              Admin2.txt

              • Path C:\Users\Admin\AppData\Local\Temp\Admin2.txt
              • Size 225KB
              • SHA256 5e01bd1ff7f024a3d726c2dc12e1885be4f02aedae42be6f3c4daacf75639f12
              • MD5 SHA1 SHA512 SSDEEP

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 75b931d477d2a7259cd47594072a49c38253f073c4cbab2635b1ba2836a65916
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 63a5c5e5c8030ecb159cf83eddfbd9bc930e9b1783cc0ab725c0b9a2c045225f
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 2efdc1053ad0d51daa4b92ccfbfaad51ddf71fc15bb87db97baa528f38aa6609
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 f36d88e7965c5aa65f7cd0614719c81cdd43f81413f4484ea70669979a4cabd0
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 286e66bb7df2c5a5a43e91a488ea55ce8e11de45255cfbb1cb5b9b3b4190e9b2
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 20ac07528eac5b9a940a978b249044ec44e78281afd4cb57b0ceb1cdb33a5a06
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 1c22de2680786198efc0e1b60ed094a81722cee0b0c45568b9099bace4695c37
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 e27d38bdf9e4026ee3bb3f7818c2191c16829b756552bbc31bd35ff3fa393dcb
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 991e468a88977c7e2217aa765e9f1c6c85bf7f3c6ca14f13baf5f02969692ea7
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 91f88f0095189c94744814a3413338d2145289c13f2d3e43c69ad595d9741e3c
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 375acf6c9e0834bc575f0a0160270b962d5ee43d5b19b1ceb0128e5d0cec4e6d
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 60b6ccc09ba3fca94cd1183ad7c62455cace2b39420c5079fd7b79874beef44c
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 8fd58517118d38a4910a872e04575773cb10f3a8f3f6ddefb793f3047fc9d20f
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 2877c38a51b9c9959d06e3d3ba531432ef061b979cf11ed516fbed4ac386009c
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 cfb8dc2f5a4ccf902f87527db5cefef426e8941218f6b076a38fb6c21d8cf792
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 999a70280592f1765dbf1be92b067d3b981432d825988e9730c5d24af01b6b02
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 619e3cdf59f647b9778af23ba2472182b8b19e768ae63f6d2c277337d847ef0d
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 bc0d9d694754e549e4025d6890081e154384d768244c65a45480c7e1b7a3a714
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 fa101c76e6440eeabdae9bed7228e6630cf93b8c65cc233ee3725446e5816b54
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 80d4c57d4c8e82cb48fa9c53e29cdef3bcb19f30bfb1b1b0e319fd3045718541
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 09553469fb8afedaaf06863d6b8216934feabc15773a2179ba132aa23e1e6905
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 4a469e57e835d35893fc7bec03a7536192a389c6c92c9b354d12b63fbb5d5ad1
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 2908f630c8569b030c8c95d743ed7d07ae3188d1d4f96f171b4ac1ff60668cd8
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 3d124ab7e435b91f15aea5aaa55d6dfa0de9145a21e393494ae8c6d107ff2f6a
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 6a0f2ace099fc7f0a86be412b9f46852d67fa732cf194eef4d54c3046d27a454
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 36aee568f159cb79ba24b0deb314144afc4692146bbc8ed762f91d38bff91d9c
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 e3e99298c0668594b815f49d4079c559657b56345c18121f94b85049607ff759
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 1e5e72751130739dcf0b99ebb47cb5509253c63b9007e3121a4cb7ef0fd34900
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 230eca36caf5ae537ce70aeb349ae16db6f4dcfd409b38fccdfeda7594fc84e1
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 9102d7e09c48d4383fd04c958f702df52e7543598ba0c80a4fdcd70fa632c61c
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 4c493c2e70b3ee8f8466ccefef8630c3860a761c105ec9e91ed424610cd221bd
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 ed1db5a1673194eb2699c0c3946b0cbcde435b49c9afa792650d88d8c302946c
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 2966e30d1ffd675155cd8b82eb5284472a5b778c588706940d4458c76ecace3b
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 215f073704ec82704a3362e6f6a83ee150dd970f66fb043b44d0cb37abcd02e9
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 35ad0743d2720f40054a61d6d1f35cdfc9dc3cb4bfcbfc52dcdb9c91a42298be
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 58d287d9666bfb38cc2e91e267fcb12381ae91891178f8c1a23d8abb74a37212
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 9dfde8773a4e47e0e13594ab4090ecd39e678715354b19e36823c5d940ab7e07
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 2d6220e15784e6a55cf0ee16b8ed155d902dc93ff221a395b84eee2e83730337
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 71e0ca16c27806a047a9f40d86d528f13f120e33b5c00165d5ce3052a432b02f
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 c73e401c2b8bf58a6359980c48e6c21f50e868d042668db008d242f26e2dd7cd
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 b6eb30d1053b27caab80a739e7260109641babb2c23cb173f29d115a208374cf
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 aaa9e54da76080c0e4f47b6484509e8db11f92bd464ae800f2b315cf8dc77339
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 7deb7b47d76fcc7bdbd8b6c2f52d22a8469f31ab284abe59f82e511cdd28f16f
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 fe549b47537a4bae3de787434794131f075cc6808f49c8024c35ca5ec58ee481
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 9e71d5db8fae0b3b8003f4fc638ab92cfc3aca80930f07a13195e8d7551480d9
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 1e6445dc3b6f5a3f4838cd0a58564434d68e1b3ec72dcdff20e34159ceb2ba44
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 c4cd3d9555d27784ec3815bb47f4e84134b1ec0e064d13dbbc3e6c46e2f79105
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 548519d90570064455db7528c94b3c128d1b64e000161c905a07e39feba87953
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 32f0f5f17352de603ec1db20e231311c880bfcc6eec708ac97b8c70945f5d41d
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 217073e7b8ccac4026fba00101f51d08ef6de286e4beac56fe172e58fdbea035
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 fd1622e2febabeaa50ff6514d250ec97a071d9821891f7830d70ef847fac5927
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 576027dcfddf402509ae4e20d074cce9ff50e3b642b47a01b69a43d5c2f79836
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 a4d220d854bfc2695255a62c990c307444ff503225efba4016d0cde488a8b499
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 35a3be75e972ac80f5d759705843044fbe5bc257a1993339fa67ccd485079bc1
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 1b55cf216d1cb70dd5228a4d3e985480d998f5ead357879deb53115653dbd555
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 7942f89367ffb90d3af96529dc6b2a6fb5c5a4e1cca546fcfafc9d56433d2611
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 269e6a1dcf02022e4bbb3783f4d6d262836c97fe5f492d449656cda7afd2ef1c
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 114bd890b8300b064a8674f0ae6f4d8d244144a89d333d1f6b31e85930b50136
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 daebfd258ee0b76790b32fc5619c83e1cdb3b59dfd8811b038bf8b9059567164
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 6cc16b9e11d466cb378edd839712897ddd3eccc09164343e05c5ce6ef414f92b
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 d8180698a61f6c255adc4e84aed9ca3376b2594c65dcd6d5a9a4a9f878d11670
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 d0d247fb801979e92904003992916a67203c91b567af678c4c53f46792d275c8
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 6fc2ac1adadf57454412de01f3bf2fa31153f2cb2dba977cf9a81687b6ac8e32
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 3a099c3b21446a38445fd4ada45740e0f8be8774c451c4d71e0a04124d4837ca
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 06f52017b8c846d3689f508ecb454e660ccc1e559f0e86b9d22b057cea346ee0
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 9d9adf2c8026ca2f509b3a865e62072caad663db693eaca03cc321b3e3999a46
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 3a900b817bd5b90f3d485517e938efa667ff6c61afea03e8bbface1844f4636b
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 06c587ae46e8b63b0421bb030db721c8a93ee4b85ec3b0ad8ad72ad073eca50e
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 55a33fdf60f172eaf27f18bc8eac0cac48833947ba7529de0e3c4363f6f791c7
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 34cb405d21d15426604042abf46064258f11cd43a7ce62c6398ea9dc9dd46108
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 6c56d9ad6250a9c01345d098d858a63afe48c2e9d52b0b42f1439117b39ab6dc
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 651b3e557bdf2fe2a61a47b5fcf4836c7912b58f76fe921af8eecc72d7602dcb
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 950c2c1e504e3944a65baeb786172f89a725dddea1ab80ceeb5eeecdf4edb0a2
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 305dc23393ebeaf7195d56ff74a5684d6b48fb5dcee1d932e51be1342ecaea35
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 ddc496709c3fe74e05a23ff63a18f78ce47be08433e68f06fcd8b319c8f860ce
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 3a785405c138d9cfcf0add4d362586d2f63c585924b0991c35f8fe26e042e61f
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 300b967e8f1fa5adb9301ca728aba3368cd302dfbd510ec069715f0001618b4b
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 f7f424e68d7f1d60fbe34b5c3212101fa122baea73b566b0882fe3fca84a94ba
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 3060284ba516364e29625e121dc740923d579fcb93c31f794b70b5f4fb025e39
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 2e1ef2170d861406b6c091efc85891214415b860247a02d24501d58da41ec415
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 dd9207bf575506ab6a2409cbf3210a24a0bb1d05c82f2d8dc948cbc42a0bd068
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 7f448c9a1080e4e010616e7a3b41f3d65831be0798d9cc249e8a2fac995c720b
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 92fc87a1feb04bd799c2f7777c69f1f4b6de059f0c3f4fbb66fd263426621b67
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 d4a80b02ee5cdf97eb6d8f2028feacc0dee9e91b5ef0362c16d156182bdd401d
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 da615d4c9170a4a01c0ad7549abb42a1c0a2b87d6c1b6d605d5553215d5523cd
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 d4d9ed8bc38b69342ad1cd8be744c8f7817e2dca26be67cbc1c1c5c5a80269ad
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 889c915842dfba27108f4e9a39363f2734dc454ad34ca70eba3ebf17c1097721
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 5c37660f0bd9be1ceac483643f8dd78611e0617ef2cf91ed86bff1583b638690
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 5c3e83dd91e837b6ee926e5f83906b61f1145030754e6fe03532440b4c9babfb
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 e4b10f16daf8c2d5aaa8b94b1ec45aca264519c154e97635bd9da01fdd5310b8
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 ee77f65711cf5b34582d6b3a9e2ec2685e9e021ebd685741e3d37d5161a2bc06
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 c1be65d1562f16d3a3db2c1924fd36d9120082ed6a1f5d09d8498d0bc2b094b8
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 9329a371a1baa9f4e0edf51b3012c43ca886ededf4501564b40df172fcbeb548
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 77865e698ffc513064888905233b27b8db8f0a0a643070695fc85b31825789ed
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 59bd849c58540ae46071b9143a66f4cb6ad1acf414e27ccc90a56937be654d8d
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 b7b3885999c38db50cee9d37acfc973a843b40c0ed98c99f5fda65d07744f54c
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 135952843f0af0c63ee44000b87733e76ebbc323b235f0d2198e6cf0848ca1e2
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 aa2f7d4bd07712d7f402e75dcc83e8f2ebf2cb31cb8a05749ff95b0fcebb1492
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 179e262d0ba82448bbf86813fb6e18dd5fddbd40b9a2670c328b63b9303c95bd
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 e739f25c68baf9dbb6acb8ebd955b7eac8109f406d54375fdd2dfee196646873
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 8d737b0edba706bdda4c69f627a1b6da46d44d9cb6ad39e27e3e93b9a9d81e01
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 5c5a09ff00000211c9d92a44035857620239965c7bc893d45c566e0ec6c7ab72
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 1f37e7796717cc61e6bbcef32f6e2f3a900f1359fa72461f69abb2afe98bbf03
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 36e4a14ca4b7fea098e3e653df3b09a849f6d8814d5d408f6f84d24c9e0d22ea
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 62760b5572df22c3545e82c68486ac57c892100e9edc79cd6500bf139011b5a1
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 daf02a02646a449d0fff67f0e6dc156a9d074e7d07c275976ae324e232c479b7
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 808060ea1f98897d806ad795a6c6712499c6cf0c79b6b6c8ee7bc283498eaf58
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 1fa1cde7b54ae5fc0abc4d682307207138a385ac707fa286479ccf98f0d945dd
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 943620dc86c23695dd278d60c53eb90b009eb2212c20ea1beb067cd42efeb930
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 634eec677813c8b0c0caba57475bfb6378ac3ccd87421581e3ea999a3240cf15
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 1d4508e0ef132c1ab11053657fef070dec32069de497737d2efbf9b05a9209b9
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 554ae5aca31b12d12a92ccb8476f96c6641c218cc85eab6397364a7c25a00a13
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 ef64b2bba3e02a56626291c5f48448d465e5467dd7f3af25459847cf8be939cf
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 cf49e37a0c37c1471963141acf77755ece2824124ffc0c6c088ccc1181526e9b
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 cb85b3e70b7bb541fdaa27bde3af4234594c07c7fcd1e15b4fe450c97999fbad
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 b920c12aec2933002ec1d6e0acf8177c64022fada31fa465b948db2017c4cb94
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 2b9e8c7c9f329c77cd5172cb9ed1d3f0a33ab23c7806e958fff2f6417a01520a
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 3d6f3661e39d70fb1dcff4ed82f42a1eac2884100e915a9c1e7b7317afd29978
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 9f39295325c70a21825e25893465ad54731bede542365a1fdd44843019c729a4
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 44866b5268badaa76e74c4f71c672cd5386c2585ed4dd9ef88580d9766d0fa7c
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 22876480b1ee38e87a2e8f7327eb79e980842d196e96dd831de5245d3cb59b62
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 5da040f62c6600260f141b3c37b337c02c0163eb3e42e21a8d23aa11bea0bdc2
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 a9a0ed532ed958f8a0fdc6be4d6eff9ec81fe9d4caa47c95a66a17f7cac89120
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 e4917dc199afbc223a083ccfb0b2d5fbeb2787079700a6d45839913f03374575
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 2b739aed2dd259e8a9e9d4fa5fbb34d96916fd8b7d1d831a04bdb7ac25d8aa7f
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 2382b59e2c77a1b7d4e44bc849a2ad9f4de4bc051184e7bdd7e6a8153f6be773
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 83c051589c0c59649ac1e5a0b48b2250e8c2cf5ffa80674b7ba43548be8e7c74
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 30b772c62561ada851eed4d46172f9c57dfd78bc817442722d9b5b06d443a6f9
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 e0706569f7fa91c19cf7614fcf68f31af01a96deb0b778646afc8f83e197d641
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 bdf7e28a367955fa725aa5abda71c6a9bb4eb9b5213f30651e03eea5e840fb2f
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 b2a91d7545dc2b02ed5990c570660a977518866f6347597e1c4813da01caf9b8
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 beba613862735d34c36da2f56d0a0f2aac46e2fb12bbeac95d978932b368a9e3
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 2ea086a8c42a95bc1b4aeb455556f93e5e0b929629ccc971502bd0d2a3abb800
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 ef6c6950b9a2ee2d372814e3d99df00fbbc3f4194a00305d2f4871d7c1ff17d2
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 06b682a5158091d60a7adb1143bfa4a76d555724fba57a3800c7b6c9ee7d76c3
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 e794a1164432efc259b6165a1a5f20948f34c6d14ee390f44aaee2f507e1d974
              • MD5 SHA1 SHA512

              Admin7

              • Path C:\Users\Admin\AppData\Local\Temp\Admin7
              • Size 8B
              • SHA256 8fa9dec4943aa83ea1cb67bd03c8f8f078a388b74be7c208883a255bbd6c2bee
              • MD5 SHA1 SHA512

              Admin8

              • Path C:\Users\Admin\AppData\Local\Temp\Admin8
              • Size 8B
              • SHA256 6c9651d5ff58099cf3c7ee111a778da3e2a5c804c7cb439286d20c04a9181a4d
              • MD5 SHA1 SHA512

              Adminlog.dat

              • Path C:\Users\Admin\AppData\Roaming\Adminlog.dat
              • Size 15B
              • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
              • MD5 SHA1 SHA512

              JaffaCakes118_5a064addca31cc7ca448cbb6e4c78a4a.exe

              • Path C:\Users\Admin\AppData\Roaming\JaffaCakes118_5a064addca31cc7ca448cbb6e4c78a4a.exe
              • Size 2.7MB
              • SHA256 9dae201039484054b1ff046169b7b4b5647c391b6bdb5817bcb25684fe364c09
              • MD5 SHA1 SHA512 SSDEEP

              tPOqY.exe.exe

              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\tPOqY.exe.exe
              • Size 768KB
              • SHA256 aa34cf13d9291f9afc6e154f2f643e84d59031cb56491e83e883a62254d7ef9d
              • MD5 SHA1 SHA512 SSDEEP

              Twain.dll

              • Path C:\Users\Admin\AppData\Roaming\Twain.dll
              • Size 18KB
              • SHA256 645b30a3ef5cf05ad0df575fbbdbc05387b5493ce1778935b60d98681fea7bc0
              • MD5 SHA1 SHA512 SSDEEP

              lolilol.exe

              • Path C:\Users\Admin\AppData\Roaming\lolilol.exe
              • Size 290KB
              • SHA256 1f6b818eb4fa5b5dd0d29864c099d45918970528170b9d84acfb19cc4603e8ac
              • MD5 SHA1 SHA512 SSDEEP

              memory/456-1-0x0000000075190000-0x0000000075741000-memory.dmp

              memory/456-2-0x0000000075190000-0x0000000075741000-memory.dmp

              memory/456-0-0x0000000075192000-0x0000000075193000-memory.dmp

              memory/456-18-0x0000000075190000-0x0000000075741000-memory.dmp

              memory/1380-62-0x00000000005E0000-0x00000000005E1000-memory.dmp

              memory/1380-63-0x00000000008A0000-0x00000000008A1000-memory.dmp

              memory/2100-61-0x0000000010480000-0x00000000104E5000-memory.dmp

              memory/2100-58-0x0000000010410000-0x0000000010475000-memory.dmp

              memory/2100-57-0x0000000010410000-0x0000000010475000-memory.dmp

              memory/2100-118-0x0000000010480000-0x00000000104E5000-memory.dmp

              memory/3284-45-0x0000000075190000-0x0000000075741000-memory.dmp

              memory/3284-17-0x0000000075190000-0x0000000075741000-memory.dmp