Malware Analysis Report

2024-11-13 14:03

Sample ID 240604-abc3kaea2x
Target 930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118
SHA256 7f0b385a896f1d533717002c2b789a254f61fd2a6235e4aa989f43fe94df5b7c
Tags
evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7f0b385a896f1d533717002c2b789a254f61fd2a6235e4aa989f43fe94df5b7c

Threat Level: Known bad

The file 930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

evasion persistence spyware stealer trojan

Modifies visiblity of hidden/system files in Explorer

Windows security bypass

Modifies visibility of file extensions in Explorer

Modifies Installed Components in the registry

Disables RegEdit via registry modification

Executes dropped EXE

Reads user/profile data of web browsers

Checks computer location settings

Windows security modification

Loads dropped DLL

Adds Run key to start application

Modifies WinLogon

Enumerates connected drives

AutoIT Executable

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Uses Task Scheduler COM API

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-04 00:01

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-04 00:01

Reported

2024-06-04 00:04

Platform

win7-20240508-en

Max time kernel

150s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\nnwrxnurws.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\nnwrxnurws.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\nnwrxnurws.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\nnwrxnurws.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\nnwrxnurws.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\nnwrxnurws.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\nnwrxnurws.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\nnwrxnurws.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\nnwrxnurws.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\nnwrxnurws.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\nnwrxnurws.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\nnwrxnurws.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\nnwrxnurws.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\nnwrxnurws.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\alamatyy = "nnwrxnurws.exe" C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fyatnfpc = "rdomxpsyrnorpxc.exe" C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "dbazeuyybampf.exe" C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\k: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\nnwrxnurws.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\nnwrxnurws.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\nnwrxnurws.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\nnwrxnurws.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\nnwrxnurws.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\nnwrxnurws.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\nnwrxnurws.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\nnwrxnurws.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\nnwrxnurws.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\nnwrxnurws.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\nnwrxnurws.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\nnwrxnurws.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\nnwrxnurws.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\nnwrxnurws.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\nnwrxnurws.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\nnwrxnurws.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\nnwrxnurws.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\nnwrxnurws.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\nnwrxnurws.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\nnwrxnurws.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\nnwrxnurws.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\nnwrxnurws.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\nnwrxnurws.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\eipfwqgu.exe C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\dbazeuyybampf.exe C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\nnwrxnurws.exe N/A
File created C:\Windows\SysWOW64\nnwrxnurws.exe C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\nnwrxnurws.exe C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\eipfwqgu.exe C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\dbazeuyybampf.exe C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\eipfwqgu.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\eipfwqgu.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\eipfwqgu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\eipfwqgu.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33342C769D5582226D3476A577232DDC7CF265DA" C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\nnwrxnurws.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "183DC77815E3DBBFB8CA7CE2EC9E34CA" C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\nnwrxnurws.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCEFAB0F962F19484783A4181983E98B38D02FA4367023BE2CE45E808A9" C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\nnwrxnurws.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F06BB9FE1C21ACD208D1D18B099063" C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\nnwrxnurws.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\nnwrxnurws.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\nnwrxnurws.exe N/A
N/A N/A C:\Windows\SysWOW64\nnwrxnurws.exe N/A
N/A N/A C:\Windows\SysWOW64\nnwrxnurws.exe N/A
N/A N/A C:\Windows\SysWOW64\nnwrxnurws.exe N/A
N/A N/A C:\Windows\SysWOW64\nnwrxnurws.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\eipfwqgu.exe N/A
N/A N/A C:\Windows\SysWOW64\eipfwqgu.exe N/A
N/A N/A C:\Windows\SysWOW64\eipfwqgu.exe N/A
N/A N/A C:\Windows\SysWOW64\eipfwqgu.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\eipfwqgu.exe N/A
N/A N/A C:\Windows\SysWOW64\eipfwqgu.exe N/A
N/A N/A C:\Windows\SysWOW64\eipfwqgu.exe N/A
N/A N/A C:\Windows\SysWOW64\eipfwqgu.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\nnwrxnurws.exe N/A
N/A N/A C:\Windows\SysWOW64\nnwrxnurws.exe N/A
N/A N/A C:\Windows\SysWOW64\nnwrxnurws.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\eipfwqgu.exe N/A
N/A N/A C:\Windows\SysWOW64\eipfwqgu.exe N/A
N/A N/A C:\Windows\SysWOW64\eipfwqgu.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\eipfwqgu.exe N/A
N/A N/A C:\Windows\SysWOW64\eipfwqgu.exe N/A
N/A N/A C:\Windows\SysWOW64\eipfwqgu.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\nnwrxnurws.exe N/A
N/A N/A C:\Windows\SysWOW64\nnwrxnurws.exe N/A
N/A N/A C:\Windows\SysWOW64\nnwrxnurws.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe N/A
N/A N/A C:\Windows\SysWOW64\eipfwqgu.exe N/A
N/A N/A C:\Windows\SysWOW64\eipfwqgu.exe N/A
N/A N/A C:\Windows\SysWOW64\eipfwqgu.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\SysWOW64\dbazeuyybampf.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2796 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\nnwrxnurws.exe
PID 2796 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\nnwrxnurws.exe
PID 2796 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\nnwrxnurws.exe
PID 2796 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\nnwrxnurws.exe
PID 2796 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe
PID 2796 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe
PID 2796 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe
PID 2796 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe
PID 2796 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\eipfwqgu.exe
PID 2796 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\eipfwqgu.exe
PID 2796 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\eipfwqgu.exe
PID 2796 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\eipfwqgu.exe
PID 2796 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\dbazeuyybampf.exe
PID 2796 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\dbazeuyybampf.exe
PID 2796 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\dbazeuyybampf.exe
PID 2796 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\dbazeuyybampf.exe
PID 1908 wrote to memory of 2520 N/A C:\Windows\SysWOW64\nnwrxnurws.exe C:\Windows\SysWOW64\eipfwqgu.exe
PID 1908 wrote to memory of 2520 N/A C:\Windows\SysWOW64\nnwrxnurws.exe C:\Windows\SysWOW64\eipfwqgu.exe
PID 1908 wrote to memory of 2520 N/A C:\Windows\SysWOW64\nnwrxnurws.exe C:\Windows\SysWOW64\eipfwqgu.exe
PID 1908 wrote to memory of 2520 N/A C:\Windows\SysWOW64\nnwrxnurws.exe C:\Windows\SysWOW64\eipfwqgu.exe
PID 2796 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2796 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2796 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2796 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2172 wrote to memory of 2256 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2172 wrote to memory of 2256 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2172 wrote to memory of 2256 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2172 wrote to memory of 2256 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe"

C:\Windows\SysWOW64\nnwrxnurws.exe

nnwrxnurws.exe

C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe

rdomxpsyrnorpxc.exe

C:\Windows\SysWOW64\eipfwqgu.exe

eipfwqgu.exe

C:\Windows\SysWOW64\dbazeuyybampf.exe

dbazeuyybampf.exe

C:\Windows\SysWOW64\eipfwqgu.exe

C:\Windows\system32\eipfwqgu.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"

C:\Windows\explorer.exe

explorer.exe

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

N/A

Files

memory/2796-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\rdomxpsyrnorpxc.exe

MD5 853695944c1cc70dd1562fb788782a08
SHA1 1671d11d43dd9649496d0852abb94f18418f323b
SHA256 f7da15e88b43b7b51f0cb1c83b3952a270634ad9a958d5bac44de967ac588b9e
SHA512 4e4810e9a7c5eeb29ce4a388796c5cb333458c39a67ba94388e9d91e21c5138869cf3b1611123c363faa50dbd3936ef2eb609f720adae93f8346f57ec4e7fda3

\Windows\SysWOW64\nnwrxnurws.exe

MD5 91be204c4fb79fa6522b01ea6f228354
SHA1 b9e66bf329c5aaf074cf802f02343eba29d1ffa1
SHA256 486e23514a14be94ab5260ce6a2607900709401e6c5f58f93dfec206b7d6ff1f
SHA512 f131996c09d0b00810a4180c065f44969d2fe8dc433ebfc62e124618d6c74519d0f19441068e9ac728ccdb57a228dcd5855f367fa672cf6c573ff2685dfad8a5

\Windows\SysWOW64\eipfwqgu.exe

MD5 62c1a3e618734c99d8d95b091ef29e15
SHA1 8146ac425ba3a34cca76251f100a1e0364e44831
SHA256 7bb7c457a3b24c6b71730d85b1221dada3b0d6b766d240c0cd7ab761e5ef89fb
SHA512 77dc1a728bfa2f1e4198e565d625bdf25e2363fa95c96da91c81e23d4eda6a7609b249f5e5bf453ed9c1172ea2004d82b52cd05e01461bfe5d29f5621e97644f

\Windows\SysWOW64\dbazeuyybampf.exe

MD5 aaae49d085738add5bee8d49a15e445a
SHA1 133cd3d3045b1cb8409a15c375ec1b0dd3811f00
SHA256 2dd036325ef8352c763eb3154d1e598af055435d6fe337657d7ff2865383c1b0
SHA512 069500b5262d090b6e348e014b55ab4204603d240469b943713612802cd4b8f7368d64db03cd506b82edf1d96e10ee2a548770958fa3fc81bbebac9ce675758c

memory/2172-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 d0bde0746c314a24441c935e98043c13
SHA1 8805eddc5e24b12a768524b16520bda9f08ba780
SHA256 c50c943fe3179647bd4183132fa26167b1f3cf5904dbf7ec5551739f62e70f44
SHA512 ad549596953415cf7e261bf1268dbec89558c42d2fa827ecafe7ddc363abaee6b3285efef01f2cdb47f0feaac22463278c330f9f67d8e4e8305ab1ebee4a23a9

memory/1792-78-0x0000000003BA0000-0x0000000003BB0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-04 00:01

Reported

2024-06-04 00:04

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\zragvhgyse.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\zragvhgyse.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\zragvhgyse.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\zragvhgyse.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\zragvhgyse.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\zragvhgyse.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\zragvhgyse.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\zragvhgyse.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\zragvhgyse.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\zragvhgyse.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\zragvhgyse.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\zragvhgyse.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\zragvhgyse.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\zragvhgyse.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xicnvvhb = "zragvhgyse.exe" C:\Windows\SysWOW64\xmohfznteyklulr.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jrfjioyd = "xmohfznteyklulr.exe" C:\Windows\SysWOW64\xmohfznteyklulr.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "cpgevhkelnhni.exe" C:\Windows\SysWOW64\xmohfznteyklulr.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\e: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\zragvhgyse.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\zragvhgyse.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\zragvhgyse.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\zragvhgyse.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\zragvhgyse.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\zragvhgyse.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\zragvhgyse.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\zragvhgyse.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\zragvhgyse.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\zragvhgyse.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\zragvhgyse.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\zragvhgyse.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\zragvhgyse.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\zragvhgyse.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\zragvhgyse.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\zragvhgyse.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\zragvhgyse.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\zragvhgyse.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\zragvhgyse.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\gbuxytvi.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\zragvhgyse.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\zragvhgyse.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File created C:\Windows\SysWOW64\zragvhgyse.exe C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\xmohfznteyklulr.exe C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\gbuxytvi.exe C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\cpgevhkelnhni.exe C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\zragvhgyse.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened for modification C:\Windows\SysWOW64\zragvhgyse.exe C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\xmohfznteyklulr.exe C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\gbuxytvi.exe C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\cpgevhkelnhni.exe C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\gbuxytvi.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\gbuxytvi.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\gbuxytvi.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\gbuxytvi.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\zragvhgyse.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32302D7A9C5783586D4376A770212DD77CF664DC" C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" C:\Windows\SysWOW64\zragvhgyse.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\zragvhgyse.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\zragvhgyse.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\zragvhgyse.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" C:\Windows\SysWOW64\zragvhgyse.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\zragvhgyse.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\zragvhgyse.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBDFAB9F962F191830F3A4B86EE3E95B08A03FD4363034CE2CB42EC09A8" C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8BFCFE4827856D9045D72F7DE5BD93E1475932674F6330D79D" C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0866BC3FE6721ADD109D1A88A0E9113" C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB5B128449238EA52BEB9D63393D7CF" C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184AC70815E4DAB1B8CD7C90EC9734CD" C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\zragvhgyse.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\zragvhgyse.exe N/A
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\zragvhgyse.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\zragvhgyse.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\gbuxytvi.exe N/A
N/A N/A C:\Windows\SysWOW64\gbuxytvi.exe N/A
N/A N/A C:\Windows\SysWOW64\gbuxytvi.exe N/A
N/A N/A C:\Windows\SysWOW64\gbuxytvi.exe N/A
N/A N/A C:\Windows\SysWOW64\gbuxytvi.exe N/A
N/A N/A C:\Windows\SysWOW64\gbuxytvi.exe N/A
N/A N/A C:\Windows\SysWOW64\gbuxytvi.exe N/A
N/A N/A C:\Windows\SysWOW64\gbuxytvi.exe N/A
N/A N/A C:\Windows\SysWOW64\xmohfznteyklulr.exe N/A
N/A N/A C:\Windows\SysWOW64\xmohfznteyklulr.exe N/A
N/A N/A C:\Windows\SysWOW64\xmohfznteyklulr.exe N/A
N/A N/A C:\Windows\SysWOW64\xmohfznteyklulr.exe N/A
N/A N/A C:\Windows\SysWOW64\xmohfznteyklulr.exe N/A
N/A N/A C:\Windows\SysWOW64\xmohfznteyklulr.exe N/A
N/A N/A C:\Windows\SysWOW64\xmohfznteyklulr.exe N/A
N/A N/A C:\Windows\SysWOW64\xmohfznteyklulr.exe N/A
N/A N/A C:\Windows\SysWOW64\cpgevhkelnhni.exe N/A
N/A N/A C:\Windows\SysWOW64\cpgevhkelnhni.exe N/A
N/A N/A C:\Windows\SysWOW64\cpgevhkelnhni.exe N/A
N/A N/A C:\Windows\SysWOW64\cpgevhkelnhni.exe N/A
N/A N/A C:\Windows\SysWOW64\cpgevhkelnhni.exe N/A
N/A N/A C:\Windows\SysWOW64\cpgevhkelnhni.exe N/A
N/A N/A C:\Windows\SysWOW64\cpgevhkelnhni.exe N/A
N/A N/A C:\Windows\SysWOW64\cpgevhkelnhni.exe N/A
N/A N/A C:\Windows\SysWOW64\cpgevhkelnhni.exe N/A
N/A N/A C:\Windows\SysWOW64\cpgevhkelnhni.exe N/A
N/A N/A C:\Windows\SysWOW64\cpgevhkelnhni.exe N/A
N/A N/A C:\Windows\SysWOW64\cpgevhkelnhni.exe N/A
N/A N/A C:\Windows\SysWOW64\zragvhgyse.exe N/A
N/A N/A C:\Windows\SysWOW64\zragvhgyse.exe N/A
N/A N/A C:\Windows\SysWOW64\zragvhgyse.exe N/A
N/A N/A C:\Windows\SysWOW64\zragvhgyse.exe N/A
N/A N/A C:\Windows\SysWOW64\zragvhgyse.exe N/A
N/A N/A C:\Windows\SysWOW64\zragvhgyse.exe N/A
N/A N/A C:\Windows\SysWOW64\zragvhgyse.exe N/A
N/A N/A C:\Windows\SysWOW64\zragvhgyse.exe N/A
N/A N/A C:\Windows\SysWOW64\zragvhgyse.exe N/A
N/A N/A C:\Windows\SysWOW64\zragvhgyse.exe N/A
N/A N/A C:\Windows\SysWOW64\xmohfznteyklulr.exe N/A
N/A N/A C:\Windows\SysWOW64\xmohfznteyklulr.exe N/A
N/A N/A C:\Windows\SysWOW64\gbuxytvi.exe N/A
N/A N/A C:\Windows\SysWOW64\gbuxytvi.exe N/A
N/A N/A C:\Windows\SysWOW64\gbuxytvi.exe N/A
N/A N/A C:\Windows\SysWOW64\gbuxytvi.exe N/A
N/A N/A C:\Windows\SysWOW64\gbuxytvi.exe N/A
N/A N/A C:\Windows\SysWOW64\gbuxytvi.exe N/A
N/A N/A C:\Windows\SysWOW64\gbuxytvi.exe N/A
N/A N/A C:\Windows\SysWOW64\gbuxytvi.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2896 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\zragvhgyse.exe
PID 2896 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\zragvhgyse.exe
PID 2896 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\zragvhgyse.exe
PID 2896 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\xmohfznteyklulr.exe
PID 2896 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\xmohfznteyklulr.exe
PID 2896 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\xmohfznteyklulr.exe
PID 2896 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\gbuxytvi.exe
PID 2896 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\gbuxytvi.exe
PID 2896 wrote to memory of 4908 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\gbuxytvi.exe
PID 2896 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\cpgevhkelnhni.exe
PID 2896 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\cpgevhkelnhni.exe
PID 2896 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Windows\SysWOW64\cpgevhkelnhni.exe
PID 2896 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 2896 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 2952 wrote to memory of 1616 N/A C:\Windows\SysWOW64\zragvhgyse.exe C:\Windows\SysWOW64\gbuxytvi.exe
PID 2952 wrote to memory of 1616 N/A C:\Windows\SysWOW64\zragvhgyse.exe C:\Windows\SysWOW64\gbuxytvi.exe
PID 2952 wrote to memory of 1616 N/A C:\Windows\SysWOW64\zragvhgyse.exe C:\Windows\SysWOW64\gbuxytvi.exe

Processes

C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\930fa2cd09ec1041791fa2fba5a4ff17_JaffaCakes118.exe"

C:\Windows\SysWOW64\zragvhgyse.exe

zragvhgyse.exe

C:\Windows\SysWOW64\xmohfznteyklulr.exe

xmohfznteyklulr.exe

C:\Windows\SysWOW64\gbuxytvi.exe

gbuxytvi.exe

C:\Windows\SysWOW64\cpgevhkelnhni.exe

cpgevhkelnhni.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""

C:\Windows\SysWOW64\gbuxytvi.exe

C:\Windows\system32\gbuxytvi.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 18.89.109.52.in-addr.arpa udp
GB 52.109.28.47:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 47.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 170.117.168.52.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
NL 23.62.61.184:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 184.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 23.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 99.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

memory/2896-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\xmohfznteyklulr.exe

MD5 95e1a40de69f0ae59d201b22fdb44fd6
SHA1 a472a8cbcc65022b5a54f1ba094e2acac7e5a146
SHA256 55587f626e7dbfc1c875dfdb0f3365c447b1c6637bfd29d433b65399cc3297c0
SHA512 1d1a68caf73354b928103107cef680557a07052ae5de547d0729e9f951ba09157ff93499d8c3494fecd489cd3992793fca9376e2f02404a857da887e775af8c1

C:\Windows\SysWOW64\zragvhgyse.exe

MD5 3852450803a789a1fdd4688397940f9f
SHA1 95ee2d279699c6a4a69c8d9c0d124e774b752553
SHA256 643ccbb7acc75226d1479cdf7cf59234a8ec42d3ffeae2302e669896e7e4f779
SHA512 90139add7b831c301e6c937ce22681599b03d833c760591df8e614f3373cb4aea779969324b0f0b212bc6f181a17b1b3cfecd774c3e598039cfe3a3cdd7372ed

C:\Windows\SysWOW64\gbuxytvi.exe

MD5 8b14ce372f82157c325f403fc0cc2601
SHA1 2b0b9ffe82d871b5102dd6320568b53f14c745e2
SHA256 b02b26195816c6b0ad057f99ce7bc671af6c87f89092ac0992ecef75614769a4
SHA512 0bb5915ea148872126765ebdd29cbd2ca9607907421d9636fb992041e39fc547296b87b4e3579139a17363c929ab9465b415e70471824bf3d03fe15ca05dbace

C:\Windows\SysWOW64\cpgevhkelnhni.exe

MD5 0357c1c89cad5953e8510f99eac942f1
SHA1 6371f572fc9563e6bae2cf6ae0b7431e3ab903df
SHA256 bc72b5ddb998da09995552e23bb74a7514fab5e1823542cc114ed6cc11fcac7d
SHA512 e02096140a9d6892df94f55710e933daca6ff0790e25a5579d232b0f312cf7a75de302cddffd66823f4eb2e8af6d50b0bfe810945ab2daf3843031c4af0a3b08

memory/3060-37-0x00007FFF30810000-0x00007FFF30820000-memory.dmp

memory/3060-36-0x00007FFF30810000-0x00007FFF30820000-memory.dmp

memory/3060-35-0x00007FFF30810000-0x00007FFF30820000-memory.dmp

memory/3060-39-0x00007FFF30810000-0x00007FFF30820000-memory.dmp

memory/3060-38-0x00007FFF30810000-0x00007FFF30820000-memory.dmp

memory/3060-40-0x00007FFF2E540000-0x00007FFF2E550000-memory.dmp

memory/3060-42-0x00007FFF2E540000-0x00007FFF2E550000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 12b138a5a40ffb88d1850866bf2959cd
SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

MD5 948534a3df373b8c7c4a97c71aeb6d9f
SHA1 19b7ff286774797021ba2f11d33b6bd5ea42e225
SHA256 62175cd5dd889dd125c7bfda76b8aaf2787d73829183e9ebfb3686e42266c2ab
SHA512 c613e59c359f38f70fcaf92c0db2c42a14e6425c0e001f74e530a3b0a3e6a76b4cfdd58014009a2c7083b38ef158dcf200d5cb16d1185cae0d06e7c3cf147e74

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

MD5 a70bbcbb960e3fde298b54d357f23605
SHA1 c10c16aaf3ca7b0dddcaf9b3aac2a54c888eb4ef
SHA256 d6567502bc545b9e0c40e7e26f1e536c9bffbb5a585f7443fb6f475653698dbc
SHA512 b20ffc5b98237bcdb721f28834d9d60437960e188bc250fc88063fb30918e08720bc26a17eaea18c402c48a0bec035636ba7a79c420112656f4b244e0f9772e9

C:\Users\Admin\AppData\Roaming\SubmitFormat.doc.exe

MD5 753b329154cb00a72d18c74b4c357771
SHA1 be75716d7029378eab036bc98c9990668477b970
SHA256 e03f09595a199dabaf70be1510598e200eb64b160e6ac8b471f9a49c6b933a55
SHA512 c1a0c7ac035e0b7d2a9e28a6df24f31d745ad69d22ce001a08808c5371bb3cc986f1422afec905707c88229b1eab3c9658fe98cbc2165caf4fc248ef090727a8

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 892f18dd7e32fbcbd290e0dde0dd4d0f
SHA1 9122a5c3655116dcbdd9b34a666416280c0321d8
SHA256 b0316c3679731a6d31b6f143ceb7ed6e24e7cea59f08e35fbfabf6359ecf834f
SHA512 ef97c28de25551225dce6204ccc4a5b00bfa78c8fe46259d1fc6b5732231028f9f31c3e3224d1dc66cdb94f541c14d31a1d33b1d8fd844f77c830bd0bdc94c9f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 f62f289d99a71b6319215a55b1d74fe6
SHA1 aa91654582d6d6055bd03db7c5b61100a516100f
SHA256 bbca51806873ab5a92e9d4b4c22431f22244b037c14b720d214f5460b99e7f44
SHA512 02abb7ad7a1763eaa2ee5522587d42b3f15b346226b57c2092828b89bbb2bd9fc981abe718b459e6aaade811770dee3c9383ef552d2276a75c8dee2fb0a1edd9

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 c01630d88191cf4b9ba097574033fe61
SHA1 28e2ade5a3b1b8d0ec6aa9356f60b0c94c394598
SHA256 a457ac005d0bedd2ad3e2fa653947026919884d372937034e96057a972105857
SHA512 d4310039afa85c2b3e7efaccb7a1471310bf058d6bebe1c7f2e32f6df4a26b065c22589db8dfa298158c97d2f2eaa98fcc3ff0d283ac4b8488c67fbf845abfda

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 174f1cd26f208342eddf33a17542bf1f
SHA1 f1bc1bdf85043e00dd679ce59ae5b6d49235da45
SHA256 f543df4b5dc5e0987d7879148ad3c4aee33aa2867a7b125cb3c007bc0c7b3b04
SHA512 517791ca5da882b347d21e8abf41fa736ed8415a3f6ec8a7c607652b96c0cdfc5b42d1ae3808ccf517f3d21b9ae41177bd0c642eb09497286fcef71f9fa5248e

C:\Users\Admin\AppData\Local\Temp\TCD7D7A.tmp\iso690.xsl

MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

memory/3060-606-0x00007FFF30810000-0x00007FFF30820000-memory.dmp

memory/3060-607-0x00007FFF30810000-0x00007FFF30820000-memory.dmp

memory/3060-609-0x00007FFF30810000-0x00007FFF30820000-memory.dmp

memory/3060-608-0x00007FFF30810000-0x00007FFF30820000-memory.dmp