Malware Analysis Report

2024-09-11 13:19

Sample ID 240613-26k57svcjc
Target a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118
SHA256 5e27869b5cd954e33653582caba1cdfc8dd3cf8882cc45a66f5d4906073aa284
Tags
evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5e27869b5cd954e33653582caba1cdfc8dd3cf8882cc45a66f5d4906073aa284

Threat Level: Known bad

The file a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

evasion persistence spyware stealer trojan

Modifies visiblity of hidden/system files in Explorer

Modifies visibility of file extensions in Explorer

Windows security bypass

Disables RegEdit via registry modification

Reads user/profile data of web browsers

Windows security modification

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Modifies WinLogon

Enumerates connected drives

AutoIT Executable

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

Checks processor information in registry

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Defense Evasion
TA0005
Hide Artifacts
T1564
Hidden Files and Directories
T1564.001
Modify Registry
T1112
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-13 23:11

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 23:11

Reported

2024-06-13 23:14

Platform

win7-20240611-en

Max time kernel

150s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\otxgitsugf.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\otxgitsugf.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\otxgitsugf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\otxgitsugf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\otxgitsugf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\otxgitsugf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\otxgitsugf.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\otxgitsugf.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\otxgitsugf.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\otxgitsugf.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\otxgitsugf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\otxgitsugf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\otxgitsugf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\otxgitsugf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\otxgitsugf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\otxgitsugf.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\rldggfkq = "otxgitsugf.exe" C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wxczmzes = "ngavcfbqzdhztzm.exe" C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "hxqcwbtodskhj.exe" C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\n: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\otxgitsugf.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\ywomjoqe.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\otxgitsugf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\otxgitsugf.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\otxgitsugf.exe C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\otxgitsugf.exe C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ywomjoqe.exe C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\ywomjoqe.exe C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\hxqcwbtodskhj.exe C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\hxqcwbtodskhj.exe C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\otxgitsugf.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\ywomjoqe.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\ywomjoqe.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\ywomjoqe.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\ywomjoqe.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\ywomjoqe.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" C:\Windows\SysWOW64\otxgitsugf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\otxgitsugf.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193EC77915E1DBB1B8C97F97EDE237CA" C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\otxgitsugf.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EF9FC8F4F5885129046D75A7E91BDE2E136584467356336D79E" C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\otxgitsugf.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\otxgitsugf.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABBFACAF917F2E483083B4786993E90B3FC02F043600233E2CA45EA08A7" C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\otxgitsugf.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\otxgitsugf.exe N/A
N/A N/A C:\Windows\SysWOW64\otxgitsugf.exe N/A
N/A N/A C:\Windows\SysWOW64\otxgitsugf.exe N/A
N/A N/A C:\Windows\SysWOW64\otxgitsugf.exe N/A
N/A N/A C:\Windows\SysWOW64\otxgitsugf.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\otxgitsugf.exe N/A
N/A N/A C:\Windows\SysWOW64\otxgitsugf.exe N/A
N/A N/A C:\Windows\SysWOW64\otxgitsugf.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe N/A
N/A N/A C:\Windows\SysWOW64\otxgitsugf.exe N/A
N/A N/A C:\Windows\SysWOW64\otxgitsugf.exe N/A
N/A N/A C:\Windows\SysWOW64\otxgitsugf.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\hxqcwbtodskhj.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A
N/A N/A C:\Windows\SysWOW64\ywomjoqe.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2268 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\otxgitsugf.exe
PID 2268 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\otxgitsugf.exe
PID 2268 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\otxgitsugf.exe
PID 2268 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\otxgitsugf.exe
PID 2268 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe
PID 2268 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe
PID 2268 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe
PID 2268 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe
PID 2268 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\ywomjoqe.exe
PID 2268 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\ywomjoqe.exe
PID 2268 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\ywomjoqe.exe
PID 2268 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\ywomjoqe.exe
PID 2268 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\hxqcwbtodskhj.exe
PID 2268 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\hxqcwbtodskhj.exe
PID 2268 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\hxqcwbtodskhj.exe
PID 2268 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\hxqcwbtodskhj.exe
PID 3040 wrote to memory of 2612 N/A C:\Windows\SysWOW64\otxgitsugf.exe C:\Windows\SysWOW64\ywomjoqe.exe
PID 3040 wrote to memory of 2612 N/A C:\Windows\SysWOW64\otxgitsugf.exe C:\Windows\SysWOW64\ywomjoqe.exe
PID 3040 wrote to memory of 2612 N/A C:\Windows\SysWOW64\otxgitsugf.exe C:\Windows\SysWOW64\ywomjoqe.exe
PID 3040 wrote to memory of 2612 N/A C:\Windows\SysWOW64\otxgitsugf.exe C:\Windows\SysWOW64\ywomjoqe.exe
PID 2268 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2268 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2268 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2268 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2452 wrote to memory of 924 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2452 wrote to memory of 924 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2452 wrote to memory of 924 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2452 wrote to memory of 924 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe"

C:\Windows\SysWOW64\otxgitsugf.exe

otxgitsugf.exe

C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe

ngavcfbqzdhztzm.exe

C:\Windows\SysWOW64\ywomjoqe.exe

ywomjoqe.exe

C:\Windows\SysWOW64\hxqcwbtodskhj.exe

hxqcwbtodskhj.exe

C:\Windows\SysWOW64\ywomjoqe.exe

C:\Windows\system32\ywomjoqe.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

N/A

Files

memory/2268-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\ngavcfbqzdhztzm.exe

MD5 3c02a49ce906b3c15fa2544100ec793b
SHA1 9799fbc3a852784646b2aa0edd5704bb9643269c
SHA256 fbd2d8582d4a35f0a5d274032d88e93567bb3b5668ad318c0ed90eaf31bc2337
SHA512 d77f02a09a04836cb7d2ca260cca5f4975674e37c7413d211d5097293777e6af15365471f47c454b8db2142bd173e534ff17b5cbae1cd809c087f79dc2f0ea78

\Windows\SysWOW64\otxgitsugf.exe

MD5 368e1d86d83df71d72df7b743651d2e4
SHA1 54fb8c1cf161e64397d0e5f15b4247a6f9cbf297
SHA256 94a6404541202ea1e5d790e32a0966c2100480521a9106db24f29cfc3ebf1bfa
SHA512 5f91de785b394a1d0802a3166bef519a5b05bd837767cb0a831a1f3aa45c298d33058072e681bf2cd4ee51a89a6fde48fcecd968dc0da3427cf59a90ebdfd558

\Windows\SysWOW64\ywomjoqe.exe

MD5 8fbb39d18796e9f95802a7eb9af81fa6
SHA1 f3b1e2d496f96b1698637c8834bce2555f4a0969
SHA256 ec9446b7ecf5bc7c42956c70a6bad6fcdaaacf638754b2edf8ffe07d5ad485e9
SHA512 e2b513a4fbd304067b9d88a63adf641700600b0591e1197398b9e68af44d7217a90de9f1fc46ac4919893f61302a87f47cec45169726c35e43e3dd03c3d39f4f

C:\Windows\SysWOW64\hxqcwbtodskhj.exe

MD5 044e8b4054b9fc90ec906c565ab2a4fc
SHA1 493fdcd3134af9e5090d5bc0d832496e5de163a9
SHA256 f99aea3c319ca86f2620f9675d28765b750d164004c3de9443f758d3bac0b552
SHA512 d889cb26f8ee64631c284d0bd493c0525579666e5ad76978b4b169d474a8fa22d2dc60b017aaffcd5fd589ff90bee6e6f050f6f16a303e8c76b67cfcfa13c6ea

memory/2452-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

MD5 1b0f20b7ff5d914682bb4608da8a4fd3
SHA1 fd1e1b55c39dd2a307745e4a772335693ae08a8d
SHA256 ff26cdda971b581e499843ee060b9f7c61e897a6499279d10d38061065a902c3
SHA512 fa4c29df83dbacc1bfdeec803c1685304fb1543f3f0f09ce0e402d2840596e5a0abbf584b826bde38689f9b84580f18a66bc6278f0eb0285b234682fb24f049b

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

MD5 c410eb107a52f54bb8537cbb2a462905
SHA1 88bc2ae0ae403f70e4a46e8e8b211cfeb0610394
SHA256 85d5545039203d85a174dd479d8f20aac8c41d0883b46121e048cb1f87b7a446
SHA512 be0411dd55271b28e26f666f9e464ee18505ebff6236f756f813348f29ae5519f1f3bc68d02cad7f6d04a7148377243897ed237912aefd439752d362c3106fae

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

MD5 81f27666d79c0f92fd443966f961a7c0
SHA1 3eec0e34fddd6036938808c8583531310b842b9c
SHA256 20cd6ee5d3121e8223b8045160bfa6046fc9d5c7ba1d4fad53812a606c070d9f
SHA512 b40dcc8bf6f1234a1acd12d394746a8e5f86ce1bced024dff071f9fe99b6dbc6fb07e1f0d98803c199ff41f68ef6b2ccf30ff087c0d5a6f727a6c9edeb0eecca

memory/2452-96-0x000000005FFF0000-0x0000000060000000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 23:11

Reported

2024-06-13 23:14

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

110s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
N/A N/A C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\nwbxchqvfyght.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iecbwtmf = "mdxhygjwnw.exe" C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wtvzdrri = "vrigcoljwvodiyi.exe" C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "nwbxchqvfyght.exe" C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\v: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\vldqvlbs.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\mdxhygjwnw.exe C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\nwbxchqvfyght.exe C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification C:\Windows\SysWOW64\mdxhygjwnw.exe C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\vrigcoljwvodiyi.exe C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\vrigcoljwvodiyi.exe C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\vldqvlbs.exe C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\vldqvlbs.exe C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\nwbxchqvfyght.exe C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\vldqvlbs.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\vldqvlbs.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "334E2C7C9D2183576D3576D770552DD97D8065DE" C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCAF9CDF964F1E783083B37869739E2B388038B4367033DE1BE45E908A3" C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFFFCFB485D82199142D72F7E94BC92E134583767406336D690" C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7816BB0FE6721DAD10ED1D18A749117" C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193EC77514E4DBB1B8C07FE6ECE734B9" C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB6B15F479538E352C8BAA532E8D4C5" C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\mdxhygjwnw.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A
N/A N/A C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A
N/A N/A C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A
N/A N/A C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A
N/A N/A C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A
N/A N/A C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A
N/A N/A C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A
N/A N/A C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A
N/A N/A C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
N/A N/A C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
N/A N/A C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
N/A N/A C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
N/A N/A C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
N/A N/A C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
N/A N/A C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
N/A N/A C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
N/A N/A C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
N/A N/A C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
N/A N/A C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A
N/A N/A C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\nwbxchqvfyght.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\nwbxchqvfyght.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\nwbxchqvfyght.exe N/A
N/A N/A C:\Windows\SysWOW64\nwbxchqvfyght.exe N/A
N/A N/A C:\Windows\SysWOW64\nwbxchqvfyght.exe N/A
N/A N/A C:\Windows\SysWOW64\nwbxchqvfyght.exe N/A
N/A N/A C:\Windows\SysWOW64\nwbxchqvfyght.exe N/A
N/A N/A C:\Windows\SysWOW64\nwbxchqvfyght.exe N/A
N/A N/A C:\Windows\SysWOW64\nwbxchqvfyght.exe N/A
N/A N/A C:\Windows\SysWOW64\nwbxchqvfyght.exe N/A
N/A N/A C:\Windows\SysWOW64\nwbxchqvfyght.exe N/A
N/A N/A C:\Windows\SysWOW64\nwbxchqvfyght.exe N/A
N/A N/A C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A
N/A N/A C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A
N/A N/A C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A
N/A N/A C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A
N/A N/A C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
N/A N/A C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
N/A N/A C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\nwbxchqvfyght.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\nwbxchqvfyght.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\nwbxchqvfyght.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A
N/A N/A C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A
N/A N/A C:\Windows\SysWOW64\vrigcoljwvodiyi.exe N/A
N/A N/A C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
N/A N/A C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
N/A N/A C:\Windows\SysWOW64\mdxhygjwnw.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\nwbxchqvfyght.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\nwbxchqvfyght.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\nwbxchqvfyght.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A
N/A N/A C:\Windows\SysWOW64\vldqvlbs.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 220 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\mdxhygjwnw.exe
PID 220 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\mdxhygjwnw.exe
PID 220 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\mdxhygjwnw.exe
PID 220 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\vrigcoljwvodiyi.exe
PID 220 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\vrigcoljwvodiyi.exe
PID 220 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\vrigcoljwvodiyi.exe
PID 220 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\vldqvlbs.exe
PID 220 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\vldqvlbs.exe
PID 220 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\vldqvlbs.exe
PID 220 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\nwbxchqvfyght.exe
PID 220 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\nwbxchqvfyght.exe
PID 220 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Windows\SysWOW64\nwbxchqvfyght.exe
PID 220 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 220 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 1284 wrote to memory of 1224 N/A C:\Windows\SysWOW64\mdxhygjwnw.exe C:\Windows\SysWOW64\vldqvlbs.exe
PID 1284 wrote to memory of 1224 N/A C:\Windows\SysWOW64\mdxhygjwnw.exe C:\Windows\SysWOW64\vldqvlbs.exe
PID 1284 wrote to memory of 1224 N/A C:\Windows\SysWOW64\mdxhygjwnw.exe C:\Windows\SysWOW64\vldqvlbs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a70bdd6b98b5eb169f5d98ee8d95b11d_JaffaCakes118.exe"

C:\Windows\SysWOW64\mdxhygjwnw.exe

mdxhygjwnw.exe

C:\Windows\SysWOW64\vrigcoljwvodiyi.exe

vrigcoljwvodiyi.exe

C:\Windows\SysWOW64\vldqvlbs.exe

vldqvlbs.exe

C:\Windows\SysWOW64\nwbxchqvfyght.exe

nwbxchqvfyght.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""

C:\Windows\SysWOW64\vldqvlbs.exe

C:\Windows\system32\vldqvlbs.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp

Files

memory/220-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\vrigcoljwvodiyi.exe

MD5 bc1b076fd148b89240e00a7577e4dbf2
SHA1 66623e7df91eedad2c00a28957b8f370411f9ec0
SHA256 72957adb97e9288add4d63f5b545f3e4bb203bd9849d56f10fa5e00791207b66
SHA512 bb6d52d3e05e3a1a0e0d6764479cf8418c3e28d6645c38fb2dac594c4182bea336f9b00a0223ac4fbb51b81c24ac09a76a341836fffc1b82464cdae3b97b5604

C:\Windows\SysWOW64\mdxhygjwnw.exe

MD5 3f49c3bfd80e3fdd44b7418300b0ccf9
SHA1 6062ebb6e7137213339d3d56c168e129835980ce
SHA256 13f7474facc2aadbdcd24a6b1f0002d16d27d5eba953db7c64db4d277b852529
SHA512 c8b774412ee7a569786bd1cdd04003f4177c92f6012dec4389b0faae474f2dfbc2416a52acbe9c9a2d1e54f57f17fc169990f8a59c2d68b3cbffd2ba64e15d70

C:\Windows\SysWOW64\vldqvlbs.exe

MD5 9f4bd83f312cd3c4b32067febf7b52c5
SHA1 8936067d7fb10b520f63a5d593b2d46333be0f4e
SHA256 bf2a1ee04d942990cc2760d96f46e09f4498b364a917573042330404d726a49d
SHA512 f87918c8952eb50501ebd5fb215065acc20be10b00edbad69c014b6ed345f2215190135aef11f70c985e2f651693d8b3ddb414e9fe24fb6581e5822bede6ac8c

C:\Windows\SysWOW64\nwbxchqvfyght.exe

MD5 dfd16ad38ef2f1ae95e5420344c5b5b4
SHA1 e5eade68a5bc902350ec65c0635f99d012bb3741
SHA256 9c175187cd53344e68cfd20d5b5477902ba5d9ba052f179ead1e2bfa66127008
SHA512 3a481a0fecf495738b8c6a2a14a658bbe5b354edc21d8239d78c1853f495392b4db0a4fc23f7acaf1aa1978e44e0a686d1ddb324c3bc5a639b8f575bc6c84471

memory/1728-35-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

memory/1728-37-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

memory/1728-38-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

memory/1728-36-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

memory/1728-39-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

memory/1728-42-0x00007FF8F32D0000-0x00007FF8F32E0000-memory.dmp

memory/1728-43-0x00007FF8F32D0000-0x00007FF8F32E0000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 12b138a5a40ffb88d1850866bf2959cd
SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

MD5 6282af309bd89068e3e293b6742cf73e
SHA1 e5e0b73a263a9357a742dec5cc331f9805b1ce07
SHA256 00257331791e5723c7e0bd5dee84af3afb6e6068499978043e3f32b2fac89b26
SHA512 069f093e1eb48628d40044f64dc84e0ecca302793f617cd113613c5c7b1c770559483f0b59e8b060e6c79487aca97fef6213ec0c46e753c7dab3f6018b67f33d

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

MD5 bfb154e8084cf03815bc9244abcc4bb1
SHA1 b21e51d45e794b5dc4775d96826484b875cbdcb5
SHA256 1cbaa494da9c1b0f54b37fc026a6598f3d7fa4c9f7860ca05fb89c6332dd4a2a
SHA512 3d82a3e07773d14cdd81c45fb720bb281ae48da45ed2d41239e4a44649d1ca15078943b41b3b266e79dfbb9671c43b8d1638be3807a0005ce09a50f189fcfc5c

C:\Users\Admin\Documents\SetStep.doc.exe

MD5 a1c57c25a5eaab4ad77c430f4c6b52cf
SHA1 ed000ec717ebc96c57826fa7ab51467691486736
SHA256 5622fe5f75191ad61932ec53fc9e0f6a5330eef49d6499399fb38bd2effc50a3
SHA512 99e6c4945103b976a928e08a08f4ace7e4f1b84e30a9a7d46c0275cdd08f81e522c067941eacdc1013c5c833b15d14d0fde9be6f50adac9aebd06748292beea8

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 e3244f2d1484e74082c33a1c50f130f4
SHA1 cc2b1d3c0c081aa01d0d62581f44e001d8b0a744
SHA256 454b41964fcfdf205e267f3c807eceb3a5cf572bdef396a01dc9bd8c71ef6929
SHA512 dcd1e061a742c98fcbfa0a692aa213780cd526fc4cb056d06659c47d19691327333439abe295bcc0bfd2d4bba15d34e76aef72ccd63ea0159cbc1ae4a5a73241

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 51dd95744e83be93538c8451776b00c2
SHA1 29b8920ab138f5489636eec591db5fd148843aa4
SHA256 cb54024fc773b4ac8878f69abef48caad0d2fdeb6a8141985c9c7d0b984465ba
SHA512 7130067a4f890c981f80f09e87efc2a05003d69ed0532354a47fca958c9d52b88cb7e5995b24c76341e4aa2f7e591fa0f9ee70e367edbc562b0e9fbdf6cd58ad

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 8670ff775821f522200495a13ec46002
SHA1 99f3a267bfbff0061b3126fbc83b056913e7a139
SHA256 3a9f4aa9b25270849210e19e3d84ff133d07669ecb26daf495a9876a602a9313
SHA512 8cdd83628dfa57c75d83af80d9d769ad3cc015b9fb111b26679e03cab5e9b300a2d788b2a6de648d87ce9042912ad0263ac19160d1776fffc4f40e5fbd14b66d

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 daa084d30679559fc8340b01f0894bcd
SHA1 7e88bc95d2c16568eb8e2710fccacc9149a3df2a
SHA256 63d329ee0d1df129589579304dbdf2e4eba12cb21e277f77a23ada085952546f
SHA512 02b6aeb3e83fea8442f1d57291010a92aeda9acfe1d8bdebe536e81d9de21cd77e6373a0ed132453ad251442ad005f311754506d64eadd17255b12797b0ca8cd

memory/1728-122-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

memory/1728-123-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

memory/1728-121-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

memory/1728-124-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp