Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 06:44
Static task
static1
Behavioral task
behavioral1
Sample
6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe
-
Size
512KB
-
MD5
6a1377f2d670fe2c3632a6b485699d15
-
SHA1
f4329395a3d64238f615a44dbbe58bac93055015
-
SHA256
948bc15d0c5e50162870518c73fe06805de301354ba358f0c26d56ae26d38006
-
SHA512
cfb98935cb1f8aaac247eb3cc6006c9502ec1ada184c52a3f275d431c846c75b05815df465cb127d9dc28ac6ffee7c6fe16b2d5f0bc13779a979213f3416410f
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6n:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5q
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
rmrtuwvcaq.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" rmrtuwvcaq.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
rmrtuwvcaq.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rmrtuwvcaq.exe -
Processes:
rmrtuwvcaq.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rmrtuwvcaq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rmrtuwvcaq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" rmrtuwvcaq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rmrtuwvcaq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rmrtuwvcaq.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
rmrtuwvcaq.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" rmrtuwvcaq.exe -
Executes dropped EXE 5 IoCs
Processes:
rmrtuwvcaq.exesqsxpwlcsjabgbt.exempqaituq.exenquicygbhuqni.exempqaituq.exepid process 2120 rmrtuwvcaq.exe 2592 sqsxpwlcsjabgbt.exe 2740 mpqaituq.exe 2716 nquicygbhuqni.exe 2580 mpqaituq.exe -
Loads dropped DLL 5 IoCs
Processes:
6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exermrtuwvcaq.exepid process 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 2120 rmrtuwvcaq.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
rmrtuwvcaq.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rmrtuwvcaq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" rmrtuwvcaq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rmrtuwvcaq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rmrtuwvcaq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rmrtuwvcaq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" rmrtuwvcaq.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
sqsxpwlcsjabgbt.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ktusudjw = "rmrtuwvcaq.exe" sqsxpwlcsjabgbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\jkzcubsk = "sqsxpwlcsjabgbt.exe" sqsxpwlcsjabgbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "nquicygbhuqni.exe" sqsxpwlcsjabgbt.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
mpqaituq.exermrtuwvcaq.exempqaituq.exedescription ioc process File opened (read-only) \??\e: mpqaituq.exe File opened (read-only) \??\i: mpqaituq.exe File opened (read-only) \??\o: mpqaituq.exe File opened (read-only) \??\x: mpqaituq.exe File opened (read-only) \??\y: mpqaituq.exe File opened (read-only) \??\l: rmrtuwvcaq.exe File opened (read-only) \??\p: rmrtuwvcaq.exe File opened (read-only) \??\g: mpqaituq.exe File opened (read-only) \??\y: rmrtuwvcaq.exe File opened (read-only) \??\k: mpqaituq.exe File opened (read-only) \??\s: mpqaituq.exe File opened (read-only) \??\z: mpqaituq.exe File opened (read-only) \??\l: mpqaituq.exe File opened (read-only) \??\h: rmrtuwvcaq.exe File opened (read-only) \??\a: mpqaituq.exe File opened (read-only) \??\g: mpqaituq.exe File opened (read-only) \??\m: mpqaituq.exe File opened (read-only) \??\o: mpqaituq.exe File opened (read-only) \??\a: mpqaituq.exe File opened (read-only) \??\j: mpqaituq.exe File opened (read-only) \??\s: mpqaituq.exe File opened (read-only) \??\w: mpqaituq.exe File opened (read-only) \??\r: rmrtuwvcaq.exe File opened (read-only) \??\t: mpqaituq.exe File opened (read-only) \??\a: rmrtuwvcaq.exe File opened (read-only) \??\b: rmrtuwvcaq.exe File opened (read-only) \??\e: rmrtuwvcaq.exe File opened (read-only) \??\i: rmrtuwvcaq.exe File opened (read-only) \??\n: mpqaituq.exe File opened (read-only) \??\h: mpqaituq.exe File opened (read-only) \??\v: mpqaituq.exe File opened (read-only) \??\l: mpqaituq.exe File opened (read-only) \??\y: mpqaituq.exe File opened (read-only) \??\r: mpqaituq.exe File opened (read-only) \??\k: rmrtuwvcaq.exe File opened (read-only) \??\s: rmrtuwvcaq.exe File opened (read-only) \??\t: mpqaituq.exe File opened (read-only) \??\m: rmrtuwvcaq.exe File opened (read-only) \??\i: mpqaituq.exe File opened (read-only) \??\u: rmrtuwvcaq.exe File opened (read-only) \??\z: rmrtuwvcaq.exe File opened (read-only) \??\e: mpqaituq.exe File opened (read-only) \??\j: mpqaituq.exe File opened (read-only) \??\u: mpqaituq.exe File opened (read-only) \??\g: rmrtuwvcaq.exe File opened (read-only) \??\x: mpqaituq.exe File opened (read-only) \??\q: mpqaituq.exe File opened (read-only) \??\n: mpqaituq.exe File opened (read-only) \??\q: rmrtuwvcaq.exe File opened (read-only) \??\v: rmrtuwvcaq.exe File opened (read-only) \??\q: mpqaituq.exe File opened (read-only) \??\m: mpqaituq.exe File opened (read-only) \??\n: rmrtuwvcaq.exe File opened (read-only) \??\w: rmrtuwvcaq.exe File opened (read-only) \??\x: rmrtuwvcaq.exe File opened (read-only) \??\r: mpqaituq.exe File opened (read-only) \??\v: mpqaituq.exe File opened (read-only) \??\w: mpqaituq.exe File opened (read-only) \??\k: mpqaituq.exe File opened (read-only) \??\z: mpqaituq.exe File opened (read-only) \??\o: rmrtuwvcaq.exe File opened (read-only) \??\t: rmrtuwvcaq.exe File opened (read-only) \??\u: mpqaituq.exe File opened (read-only) \??\b: mpqaituq.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
rmrtuwvcaq.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" rmrtuwvcaq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" rmrtuwvcaq.exe -
AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2868-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe C:\Windows\SysWOW64\sqsxpwlcsjabgbt.exe autoit_exe \Windows\SysWOW64\rmrtuwvcaq.exe autoit_exe \Windows\SysWOW64\mpqaituq.exe autoit_exe \Windows\SysWOW64\nquicygbhuqni.exe autoit_exe C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe autoit_exe -
Drops file in System32 directory 9 IoCs
Processes:
6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exermrtuwvcaq.exedescription ioc process File opened for modification C:\Windows\SysWOW64\sqsxpwlcsjabgbt.exe 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe File created C:\Windows\SysWOW64\mpqaituq.exe 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mpqaituq.exe 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll rmrtuwvcaq.exe File created C:\Windows\SysWOW64\sqsxpwlcsjabgbt.exe 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rmrtuwvcaq.exe 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe File created C:\Windows\SysWOW64\nquicygbhuqni.exe 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\nquicygbhuqni.exe 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe File created C:\Windows\SysWOW64\rmrtuwvcaq.exe 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe -
Drops file in Program Files directory 14 IoCs
Processes:
mpqaituq.exempqaituq.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal mpqaituq.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe mpqaituq.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe mpqaituq.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe mpqaituq.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal mpqaituq.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal mpqaituq.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe mpqaituq.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe mpqaituq.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe mpqaituq.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe mpqaituq.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe mpqaituq.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe mpqaituq.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe mpqaituq.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal mpqaituq.exe -
Drops file in Windows directory 5 IoCs
Processes:
WINWORD.EXE6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\mydoc.rtf 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXErmrtuwvcaq.exe6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" rmrtuwvcaq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E78368B1FF1822DBD10CD0D18A089014" 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg rmrtuwvcaq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf rmrtuwvcaq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc rmrtuwvcaq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC6B02A44EF39E353BEB9D633E9D4BC" 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" rmrtuwvcaq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh rmrtuwvcaq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 2500 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exermrtuwvcaq.exempqaituq.exesqsxpwlcsjabgbt.exenquicygbhuqni.exempqaituq.exepid process 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 2120 rmrtuwvcaq.exe 2120 rmrtuwvcaq.exe 2120 rmrtuwvcaq.exe 2120 rmrtuwvcaq.exe 2120 rmrtuwvcaq.exe 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 2740 mpqaituq.exe 2740 mpqaituq.exe 2740 mpqaituq.exe 2740 mpqaituq.exe 2592 sqsxpwlcsjabgbt.exe 2592 sqsxpwlcsjabgbt.exe 2592 sqsxpwlcsjabgbt.exe 2592 sqsxpwlcsjabgbt.exe 2592 sqsxpwlcsjabgbt.exe 2716 nquicygbhuqni.exe 2716 nquicygbhuqni.exe 2716 nquicygbhuqni.exe 2716 nquicygbhuqni.exe 2716 nquicygbhuqni.exe 2716 nquicygbhuqni.exe 2580 mpqaituq.exe 2580 mpqaituq.exe 2580 mpqaituq.exe 2580 mpqaituq.exe 2592 sqsxpwlcsjabgbt.exe 2716 nquicygbhuqni.exe 2716 nquicygbhuqni.exe 2592 sqsxpwlcsjabgbt.exe 2592 sqsxpwlcsjabgbt.exe 2716 nquicygbhuqni.exe 2716 nquicygbhuqni.exe 2592 sqsxpwlcsjabgbt.exe 2716 nquicygbhuqni.exe 2716 nquicygbhuqni.exe 2592 sqsxpwlcsjabgbt.exe 2716 nquicygbhuqni.exe 2716 nquicygbhuqni.exe 2592 sqsxpwlcsjabgbt.exe 2716 nquicygbhuqni.exe 2716 nquicygbhuqni.exe 2592 sqsxpwlcsjabgbt.exe 2716 nquicygbhuqni.exe 2716 nquicygbhuqni.exe 2592 sqsxpwlcsjabgbt.exe 2716 nquicygbhuqni.exe 2716 nquicygbhuqni.exe 2592 sqsxpwlcsjabgbt.exe 2716 nquicygbhuqni.exe 2716 nquicygbhuqni.exe 2592 sqsxpwlcsjabgbt.exe 2716 nquicygbhuqni.exe 2716 nquicygbhuqni.exe 2592 sqsxpwlcsjabgbt.exe 2716 nquicygbhuqni.exe 2716 nquicygbhuqni.exe 2592 sqsxpwlcsjabgbt.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exermrtuwvcaq.exempqaituq.exesqsxpwlcsjabgbt.exenquicygbhuqni.exempqaituq.exepid process 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 2120 rmrtuwvcaq.exe 2120 rmrtuwvcaq.exe 2120 rmrtuwvcaq.exe 2740 mpqaituq.exe 2740 mpqaituq.exe 2740 mpqaituq.exe 2592 sqsxpwlcsjabgbt.exe 2592 sqsxpwlcsjabgbt.exe 2592 sqsxpwlcsjabgbt.exe 2716 nquicygbhuqni.exe 2716 nquicygbhuqni.exe 2716 nquicygbhuqni.exe 2580 mpqaituq.exe 2580 mpqaituq.exe 2580 mpqaituq.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exermrtuwvcaq.exempqaituq.exesqsxpwlcsjabgbt.exenquicygbhuqni.exempqaituq.exepid process 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe 2120 rmrtuwvcaq.exe 2120 rmrtuwvcaq.exe 2120 rmrtuwvcaq.exe 2740 mpqaituq.exe 2740 mpqaituq.exe 2740 mpqaituq.exe 2592 sqsxpwlcsjabgbt.exe 2592 sqsxpwlcsjabgbt.exe 2592 sqsxpwlcsjabgbt.exe 2716 nquicygbhuqni.exe 2716 nquicygbhuqni.exe 2716 nquicygbhuqni.exe 2580 mpqaituq.exe 2580 mpqaituq.exe 2580 mpqaituq.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 2500 WINWORD.EXE 2500 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exermrtuwvcaq.exeWINWORD.EXEdescription pid process target process PID 2868 wrote to memory of 2120 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe rmrtuwvcaq.exe PID 2868 wrote to memory of 2120 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe rmrtuwvcaq.exe PID 2868 wrote to memory of 2120 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe rmrtuwvcaq.exe PID 2868 wrote to memory of 2120 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe rmrtuwvcaq.exe PID 2868 wrote to memory of 2592 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe sqsxpwlcsjabgbt.exe PID 2868 wrote to memory of 2592 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe sqsxpwlcsjabgbt.exe PID 2868 wrote to memory of 2592 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe sqsxpwlcsjabgbt.exe PID 2868 wrote to memory of 2592 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe sqsxpwlcsjabgbt.exe PID 2868 wrote to memory of 2740 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe mpqaituq.exe PID 2868 wrote to memory of 2740 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe mpqaituq.exe PID 2868 wrote to memory of 2740 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe mpqaituq.exe PID 2868 wrote to memory of 2740 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe mpqaituq.exe PID 2868 wrote to memory of 2716 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe nquicygbhuqni.exe PID 2868 wrote to memory of 2716 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe nquicygbhuqni.exe PID 2868 wrote to memory of 2716 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe nquicygbhuqni.exe PID 2868 wrote to memory of 2716 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe nquicygbhuqni.exe PID 2120 wrote to memory of 2580 2120 rmrtuwvcaq.exe mpqaituq.exe PID 2120 wrote to memory of 2580 2120 rmrtuwvcaq.exe mpqaituq.exe PID 2120 wrote to memory of 2580 2120 rmrtuwvcaq.exe mpqaituq.exe PID 2120 wrote to memory of 2580 2120 rmrtuwvcaq.exe mpqaituq.exe PID 2868 wrote to memory of 2500 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe WINWORD.EXE PID 2868 wrote to memory of 2500 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe WINWORD.EXE PID 2868 wrote to memory of 2500 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe WINWORD.EXE PID 2868 wrote to memory of 2500 2868 6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe WINWORD.EXE PID 2500 wrote to memory of 1768 2500 WINWORD.EXE splwow64.exe PID 2500 wrote to memory of 1768 2500 WINWORD.EXE splwow64.exe PID 2500 wrote to memory of 1768 2500 WINWORD.EXE splwow64.exe PID 2500 wrote to memory of 1768 2500 WINWORD.EXE splwow64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6a1377f2d670fe2c3632a6b485699d15_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rmrtuwvcaq.exermrtuwvcaq.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mpqaituq.exeC:\Windows\system32\mpqaituq.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\sqsxpwlcsjabgbt.exesqsxpwlcsjabgbt.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\mpqaituq.exempqaituq.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\nquicygbhuqni.exenquicygbhuqni.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
7Impair Defenses
2Disable or Modify Tools
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exeFilesize
512KB
MD51aec7060692412fe6d04c9a61069d47f
SHA1c1df08d723e8c6634dad0b914647db02678c617d
SHA2568cc17e2bf85e9c8641c8ae53a5d60399f4839c915c5993d1abf56616e305e034
SHA512d32930bfb799a6b3d2478a72c1764b7873655a4bf1b7157ad221d10ea805510b3db145acf5484df3dbfdcd2a6e0efc1dfe9e4db4a11385845dff4634a8cda78b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.datFilesize
68B
MD56943fe5c965e7f33a32f1b695b187e5d
SHA184c5d3c659854c0347cb6cf50563c3d404ec2a27
SHA256be12cb0bfc01ed621e04aafa94c1d2f105aa4d64e4001aff5fa97c3f130edc2a
SHA5120069cdbd6b91acda61de7dc6dbf4a2dff51dc5236161ef9b971437f17d2db4e8ccf73a2e129130895c3ff8967daea9077e668b81a9b1f1fd2c5ffc53e624e5af
-
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotmFilesize
20KB
MD58fc30385df9aed7a91b4d3e185ab0f66
SHA1358e536eb0435d6abaccd58adaac1475cac54ffe
SHA256fcf8e468571e0b18df6465a2d41f9abff73f97e5683d7ca9e23bbeaddadefc23
SHA512397a49a54c8f538241709b80eb4baea7c9f51e184bf929d9465bd89ea7a498100c53f9ba04169ae0a33b0759f901a26017777afc7bc51e87dcbc4b7eadf29a14
-
C:\Windows\SysWOW64\sqsxpwlcsjabgbt.exeFilesize
512KB
MD511a712fecbba1f88b92ef12987159b0a
SHA1b99d60acc6e33d5f515748e4f8639baa0c1043fe
SHA256e24d04771e11a68106bd8a3997ede0764fd4b7f1770eca17abda9d42fc0e813e
SHA5128b551ac215a98f9e97d3956fb4174cf2e08b1576c2230ef2f043cc75fa678b63e51c4f4af482e2a50f3f3620244dfda18f9d82699697f40dec28e7724fdbfb59
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
\Windows\SysWOW64\mpqaituq.exeFilesize
512KB
MD525b6c484c4d79330c2e861f19b9b05e1
SHA1212d248e73cc0666a576a8af9d61d59cb7848c23
SHA25682bda9a7922be67a6a087963ee50ecd01a36378810960e4b90589a92bd4562f2
SHA51235d3bf6590746a27a0d80648bba1e490181ad0a3491cd19476cbbe97e9751663047997ad270b420dc7490707bdda2b1958b91c965df4e80cb286684c5c5575b6
-
\Windows\SysWOW64\nquicygbhuqni.exeFilesize
512KB
MD5dda16ea67da5d4450563d39ea26dad88
SHA1661fad824d12d9b24d4f356a0395b9cc4a3b0cb6
SHA25686aee01eb50a4a1373b69442c7fcf02031d1fe9aa77de9316e0b60607ebcbbca
SHA51216675cc9dddab069a23c1f83dafcb33d20cadd49591b000debe2905e932eb4cd21bc1386d754f46b1000fe5c4bb01f842092e8cf0888f31987c0587a625229ae
-
\Windows\SysWOW64\rmrtuwvcaq.exeFilesize
512KB
MD54b567d71278ded515a0be0d39ac0315c
SHA149aeaad42ab45ee93a46ff2788d96edf18eb6055
SHA25694689bc549a5f61c2dc6b2c758414f2fa210103c8eaac1b07534b18f1c0156ac
SHA51220cd93a6a88b018226431f650427e4f0d32992b94779f62d9784182e7f4dba08b031686d26af9fe39c19a92bee8edcb9ce8a3d8593c94dbeb5fb29a40bcbdf1d
-
memory/2500-45-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2500-95-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2868-0-0x0000000000400000-0x0000000000496000-memory.dmpFilesize
600KB