Overview

overview

7

Static

static

3

jaffacakes...ic.exe

windows10-2004-x64

7

jaffacakes...ic.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/10/2026, 03:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  • Size 202KB
  • Sample261014-dms5psfv4r
  • SHA256 8b3983c4251e067dd045c14a466f0061e39569bbce0b4fbbab57de1bb1e41554
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 52 IoCs
  • Adds Run key to start application 2 TTPs 26 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 53 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3720
    • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202.exe
      c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1048
      • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202a.exe
        c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202a.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3552
        • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202b.exe
          c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202b.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3508
          • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202c.exe
            c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202c.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:2476
            • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202d.exe
              c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202d.exe
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:5604
              • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202e.exe
                c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202e.exe
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:4832
                • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202f.exe
                  c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202f.exe
                  8⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:5208
                  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202g.exe
                    c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202g.exe
                    9⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:2800
                    • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202h.exe
                      c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202h.exe
                      10⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:6120
                      • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202i.exe
                        c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202i.exe
                        11⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:3888
                        • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202j.exe
                          c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202j.exe
                          12⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:752
                          • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202k.exe
                            c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202k.exe
                            13⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:3676
                            • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202o.exe
                              c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202o.exe
                              14⤵
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious use of WriteProcessMemory
                              PID:2284
                              • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202v.exe
                                c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202v.exe
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:5400
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202d.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202d.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5160
    • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202l.exe
      c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202l.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2920
      • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202m.exe
        c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202m.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2976
        • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202q.exe
          c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202q.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2128
          • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202r.exe
            c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202r.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:2588
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202b.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202b.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4848
    • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202n.exe
      c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202n.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3712
      • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202p.exe
        c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202p.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4344
        • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202u.exe
          c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202u.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:3036
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3736
    • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202s.exe
      c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202s.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:4088
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202g.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202g.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2296
    • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202w.exe
      c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202w.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5804
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202a.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202a.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3876
    • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202x.exe
      c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202x.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:2320
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202h.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202h.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4084
    • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202t.exe
      c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202t.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:3728
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202i.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202i.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4912
    • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202y.exe
      c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202y.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:2940
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202c.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202c.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:1668
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202f.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202f.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:3952
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202e.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202e.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:3240
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202j.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202j.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:5168
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202m.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202m.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:624
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202t.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202t.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:3356
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202o.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202o.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:1560
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202l.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202l.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:1368
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202w.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202w.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:4384
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202p.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202p.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:2360
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202u.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202u.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:5712
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202y.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202y.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:2944
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202x.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202x.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:6012
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202q.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202q.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2964
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202r.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202r.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:1400
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202n.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202n.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:4972
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202v.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202v.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:2528
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202k.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202k.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:4140
  • \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202s.exe
    "c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202s.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:3752

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        jaffacakes118_heur.trojan.win32.generic_3202.exe
        • Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_heur.trojan.win32.generic_3202.exe
        • Size 202KB
        • SHA256 59ba3b6f2d8c3266c4cb308d1d303b1371da8fa8a04c0428e2981730d8cdfb37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202a.exe
        • Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_heur.trojan.win32.generic_3202a.exe
        • Size 202KB
        • SHA256 2386df26293f654e7f3a0bbde4e21ec412f4792b9c4c16dad29486adab9381f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202b.exe
        • Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_heur.trojan.win32.generic_3202b.exe
        • Size 203KB
        • SHA256 b5e05fe54b06189315f2783f4027c85a22774869bf8902b30e9cb97983bfe475
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202c.exe
        • Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_heur.trojan.win32.generic_3202c.exe
        • Size 203KB
        • SHA256 3115ca5091a2c210f6c5d7a77fad1c42c99c618a6558a3a40986a924ae16bfde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202d.exe
        • Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_heur.trojan.win32.generic_3202d.exe
        • Size 203KB
        • SHA256 b5939d50c95a7f8abb30df474715c2d794ceb260a68b221e95dfed2420ec97e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202e.exe
        • Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_heur.trojan.win32.generic_3202e.exe
        • Size 203KB
        • SHA256 8c2b9c67a15c5380fa8fbb16ef61ecf55207f8a18136010315a410e7083daef5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202f.exe
        • Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_heur.trojan.win32.generic_3202f.exe
        • Size 203KB
        • SHA256 811b0cf0dea82cafe63e740e70ce43efaa5dcfd2d493ea7b473b02b08c587827
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202g.exe
        • Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_heur.trojan.win32.generic_3202g.exe
        • Size 204KB
        • SHA256 00a9c3875cbde4f5a45bcb9f15d96de419c09d84e51b383c3d87db84944c6348
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202i.exe
        • Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_heur.trojan.win32.generic_3202i.exe
        • Size 204KB
        • SHA256 20eb2012e5735c13d71964416eb9aec93527e02c9e6f6dcbac49a0e5ef0c4f22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202j.exe
        • Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_heur.trojan.win32.generic_3202j.exe
        • Size 204KB
        • SHA256 190f22b7746aaca5a98bf91979783683c8398b3a766b2be125df9e42ba4b5864
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202l.exe
        • Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_heur.trojan.win32.generic_3202l.exe
        • Size 203KB
        • SHA256 df7f1a12f723a6375ab4485fdb674862222a8be35e1fa7fc86f5a3a1b836afda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202m.exe
        • Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_heur.trojan.win32.generic_3202m.exe
        • Size 203KB
        • SHA256 0cc92ef51ffe9c14e1bc98c45b511716f5593a6639cfcbe20891bd1d0d11ee17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202n.exe
        • Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_heur.trojan.win32.generic_3202n.exe
        • Size 203KB
        • SHA256 cc366042cc557a0981b8e37912d72c679b1dd2883479210ae92168c1f1f2adf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202p.exe
        • Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_heur.trojan.win32.generic_3202p.exe
        • Size 203KB
        • SHA256 444b9c73fd740e4065cfd3acfcc24bc31e1f38354936a98c3c5add3b434d65ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202q.exe
        • Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_heur.trojan.win32.generic_3202q.exe
        • Size 204KB
        • SHA256 2a9cc3f48305abe51e8e43a1b1b5f6d17729872270dc9d41cd4dfa825d6a76f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202x.exe
        • Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_heur.trojan.win32.generic_3202x.exe
        • Size 203KB
        • SHA256 e6b2326a7fe75a6066b3ce7023dbb49fefd9f37a0c8e6619a517f2fe0c54a4e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202y.exe
        • Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_heur.trojan.win32.generic_3202y.exe
        • Size 204KB
        • SHA256 9834335afc146d7a921db5ff3ec968ba363687fcb90fe79913a0ba00cc7d52ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202h.exe
        • Path \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202h.exe
        • Size 204KB
        • SHA256 c091dba1a68060b4f2bd1f44aeb6fb852fffc2460a4fb75ac3f914e4c7a0a6cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202k.exe
        • Path \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202k.exe
        • Size 205KB
        • SHA256 954a81413280a7df165dc3517a4fe92ce9c7064e8edeec9730f0559af6969612
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202o.exe
        • Path \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202o.exe
        • Size 205KB
        • SHA256 1ce36766075e6d3e589ae484ef18a6c73490002da617ee71433396a5206b1c5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202r.exe
        • Path \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202r.exe
        • Size 204KB
        • SHA256 52d61b6de0fee37982c1c1041b1c2deb696cb7f0f6cbddd16b3b2df16d70a3c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202s.exe
        • Path \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202s.exe
        • Size 202KB
        • SHA256 b9a5a9a327353f4d76b65bc12eb659dbbbc5a3273d29a0798b4f56eab91ab791
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202t.exe
        • Path \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202t.exe
        • Size 204KB
        • SHA256 3bdda535185f7548e89c46811738152d46890f1f9e7886c6cb7fe78fdc1194a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202u.exe
        • Path \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202u.exe
        • Size 203KB
        • SHA256 2ec2658dae13bc4432ccaeb8df2a7fa002d1983b3cc3d997a51833677accacc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202v.exe
        • Path \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202v.exe
        • Size 205KB
        • SHA256 685cd6e32dbb35ac8bbab3ba429b664a5d302a6d01249934cbd95c2d3cc54956
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaffacakes118_heur.trojan.win32.generic_3202w.exe
        • Path \??\c:\users\admin\appdata\local\temp\jaffacakes118_heur.trojan.win32.generic_3202w.exe
        • Size 204KB
        • SHA256 dab50d710c3193d687769d86b3abadaf24571a0ed595912f8fda0722d593d0b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/624-265-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/752-122-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/1048-18-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/1368-268-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/1400-278-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/1560-266-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/1668-262-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/2128-216-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/2128-236-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/2284-247-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/2296-201-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/2320-231-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/2360-270-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/2476-44-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/2528-282-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/2588-249-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/2800-80-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/2920-151-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/2940-246-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/2944-273-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/2964-277-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/2976-159-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/3036-248-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/3240-256-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/3356-267-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/3508-35-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/3552-25-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/3676-176-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/3712-157-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/3720-0-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/3720-9-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/3728-250-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/3736-218-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/3752-281-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/3876-209-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/3888-98-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/3952-261-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/4084-239-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/4084-227-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/4088-245-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/4140-279-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/4344-244-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/4344-214-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/4384-269-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/4832-62-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/4848-137-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/4912-219-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/4972-280-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/5160-117-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/5168-260-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/5208-71-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/5400-251-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/5604-53-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/5712-271-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/5804-232-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/6012-275-0x0000000000400000-0x0000000000442000-memory.dmp
        Download

        memory/6120-89-0x0000000000400000-0x0000000000442000-memory.dmp
        Download