Malware Analysis Report

2024-11-30 04:14

Sample ID 240613-allgpazgrn
Target a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118
SHA256 568fefad3e99375d017c336a480cc00557e4d3755f89fcfb9c16beaf1b9646c1
Tags
evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

568fefad3e99375d017c336a480cc00557e4d3755f89fcfb9c16beaf1b9646c1

Threat Level: Known bad

The file a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

evasion persistence spyware stealer trojan

Modifies visibility of file extensions in Explorer

Windows security bypass

Modifies visiblity of hidden/system files in Explorer

Disables RegEdit via registry modification

Modifies Installed Components in the registry

Checks computer location settings

Reads user/profile data of web browsers

Windows security modification

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Adds Run key to start application

Modifies WinLogon

Drops file in System32 directory

AutoIT Executable

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

Checks processor information in registry

Enumerates system info in registry

Modifies registry class

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 00:18

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 00:18

Reported

2024-06-13 00:20

Platform

win7-20240508-en

Max time kernel

150s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\hurbgvbskn.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\hurbgvbskn.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\hurbgvbskn.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\hurbgvbskn.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\hurbgvbskn.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\hurbgvbskn.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\hurbgvbskn.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\hurbgvbskn.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\hurbgvbskn.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\hurbgvbskn.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\hurbgvbskn.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\hurbgvbskn.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\hurbgvbskn.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\hurbgvbskn.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "fpnlrwnflqarm.exe" C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\jwmxahtf = "hurbgvbskn.exe" C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qtmsifzv = "nkfiemipocjuoaz.exe" C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\l: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\hurbgvbskn.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\hurbgvbskn.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\hurbgvbskn.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\hurbgvbskn.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\hurbgvbskn.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\hurbgvbskn.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\hurbgvbskn.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\hurbgvbskn.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\hurbgvbskn.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\hurbgvbskn.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\hurbgvbskn.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\hurbgvbskn.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\hurbgvbskn.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\hurbgvbskn.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\hurbgvbskn.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\hurbgvbskn.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\hurbgvbskn.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\hurbgvbskn.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\hurbgvbskn.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\hurbgvbskn.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\hurbgvbskn.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\hurbgvbskn.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\hurbgvbskn.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\nkfiemipocjuoaz.exe C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\fpnlrwnflqarm.exe C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\fpnlrwnflqarm.exe C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\hurbgvbskn.exe N/A
File created C:\Windows\SysWOW64\hurbgvbskn.exe C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\hurbgvbskn.exe C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\nkfiemipocjuoaz.exe C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\lzgefytm.exe C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\lzgefytm.exe C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\HideApprove.nal C:\Windows\SysWOW64\lzgefytm.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\lzgefytm.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened for modification C:\Program Files\HideApprove.doc.exe C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened for modification \??\c:\Program Files\HideApprove.doc.exe C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened for modification \??\c:\Program Files\HideApprove.doc.exe C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\lzgefytm.exe N/A
File created \??\c:\Program Files\HideApprove.doc.exe C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened for modification C:\Program Files\HideApprove.doc.exe C:\Windows\SysWOW64\lzgefytm.exe N/A
File opened for modification C:\Program Files\HideApprove.nal C:\Windows\SysWOW64\lzgefytm.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\hurbgvbskn.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1938C7751594DBC3B8CD7CE2EC9437CF" C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33322D7D9D5283226A4477D670242DDD7D8564D7" C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\hurbgvbskn.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\hurbgvbskn.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\hurbgvbskn.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\hurbgvbskn.exe N/A
N/A N/A C:\Windows\SysWOW64\hurbgvbskn.exe N/A
N/A N/A C:\Windows\SysWOW64\hurbgvbskn.exe N/A
N/A N/A C:\Windows\SysWOW64\hurbgvbskn.exe N/A
N/A N/A C:\Windows\SysWOW64\hurbgvbskn.exe N/A
N/A N/A C:\Windows\SysWOW64\lzgefytm.exe N/A
N/A N/A C:\Windows\SysWOW64\lzgefytm.exe N/A
N/A N/A C:\Windows\SysWOW64\lzgefytm.exe N/A
N/A N/A C:\Windows\SysWOW64\lzgefytm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\lzgefytm.exe N/A
N/A N/A C:\Windows\SysWOW64\lzgefytm.exe N/A
N/A N/A C:\Windows\SysWOW64\lzgefytm.exe N/A
N/A N/A C:\Windows\SysWOW64\lzgefytm.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\hurbgvbskn.exe N/A
N/A N/A C:\Windows\SysWOW64\hurbgvbskn.exe N/A
N/A N/A C:\Windows\SysWOW64\hurbgvbskn.exe N/A
N/A N/A C:\Windows\SysWOW64\lzgefytm.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\lzgefytm.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\lzgefytm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\lzgefytm.exe N/A
N/A N/A C:\Windows\SysWOW64\lzgefytm.exe N/A
N/A N/A C:\Windows\SysWOW64\lzgefytm.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\hurbgvbskn.exe N/A
N/A N/A C:\Windows\SysWOW64\hurbgvbskn.exe N/A
N/A N/A C:\Windows\SysWOW64\hurbgvbskn.exe N/A
N/A N/A C:\Windows\SysWOW64\lzgefytm.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\lzgefytm.exe N/A
N/A N/A C:\Windows\SysWOW64\nkfiemipocjuoaz.exe N/A
N/A N/A C:\Windows\SysWOW64\lzgefytm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\SysWOW64\fpnlrwnflqarm.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2552 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\hurbgvbskn.exe
PID 2552 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\hurbgvbskn.exe
PID 2552 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\hurbgvbskn.exe
PID 2552 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\hurbgvbskn.exe
PID 2552 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\nkfiemipocjuoaz.exe
PID 2552 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\nkfiemipocjuoaz.exe
PID 2552 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\nkfiemipocjuoaz.exe
PID 2552 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\nkfiemipocjuoaz.exe
PID 2552 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\lzgefytm.exe
PID 2552 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\lzgefytm.exe
PID 2552 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\lzgefytm.exe
PID 2552 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\lzgefytm.exe
PID 2552 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\fpnlrwnflqarm.exe
PID 2552 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\fpnlrwnflqarm.exe
PID 2552 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\fpnlrwnflqarm.exe
PID 2552 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\fpnlrwnflqarm.exe
PID 2108 wrote to memory of 2800 N/A C:\Windows\SysWOW64\hurbgvbskn.exe C:\Windows\SysWOW64\lzgefytm.exe
PID 2108 wrote to memory of 2800 N/A C:\Windows\SysWOW64\hurbgvbskn.exe C:\Windows\SysWOW64\lzgefytm.exe
PID 2108 wrote to memory of 2800 N/A C:\Windows\SysWOW64\hurbgvbskn.exe C:\Windows\SysWOW64\lzgefytm.exe
PID 2108 wrote to memory of 2800 N/A C:\Windows\SysWOW64\hurbgvbskn.exe C:\Windows\SysWOW64\lzgefytm.exe
PID 2552 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2552 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2552 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2552 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2640 wrote to memory of 268 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2640 wrote to memory of 268 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2640 wrote to memory of 268 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2640 wrote to memory of 268 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe"

C:\Windows\SysWOW64\hurbgvbskn.exe

hurbgvbskn.exe

C:\Windows\SysWOW64\nkfiemipocjuoaz.exe

nkfiemipocjuoaz.exe

C:\Windows\SysWOW64\lzgefytm.exe

lzgefytm.exe

C:\Windows\SysWOW64\fpnlrwnflqarm.exe

fpnlrwnflqarm.exe

C:\Windows\SysWOW64\lzgefytm.exe

C:\Windows\system32\lzgefytm.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"

C:\Windows\explorer.exe

explorer.exe

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

N/A

Files

memory/2552-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\nkfiemipocjuoaz.exe

MD5 8f0e3e9c4dec649398272270789d0b37
SHA1 b1423247b67c412c8319c0db476e9ce62d46f359
SHA256 b15e442aa9d1b796b4059deea663d0b718eb7e3770a3d89116521209041a3cdd
SHA512 30f76345201a264279939041b3240953bec380a33bad664606c4ec37a8408c120dad3936c3ccb8335c89c93b056987ef84b2295993de7424c3737af6e3bc6384

\Windows\SysWOW64\hurbgvbskn.exe

MD5 b13ba9a7052291bb75c0749733ffac78
SHA1 48893a60a5962f7d940f47159093e8344ad3d64e
SHA256 7b88fa9a83bfbd0950926138d9da23c29f5cb50cb98776830b700b862dc02e99
SHA512 e4c27b8f624c3c3cdc749a93340ce3a15a009c03a8f7ef0d2675b3907b1be13e6dce4af3202222077a3adfb3e38f2c7555253a115cc2aabea650b70971b613d9

C:\Windows\SysWOW64\lzgefytm.exe

MD5 4ffb2f93f1ee413322931b514fd9b1ed
SHA1 136dfac17e4002d4cdd2c32027b6b93d40535532
SHA256 616491b8911036846786b1076fe3cd0285605f69cd437ffdf9fa539d5848757d
SHA512 9372fe102ffe7656403e993753b86dc9140fe0730c0e6741e082f883f11a895c323bada9f1beabb5722478886dec558ee25e4bf5c0dea239b9549f7ed207c906

C:\Windows\SysWOW64\fpnlrwnflqarm.exe

MD5 0a9ef6de038ddccb847b7c3962fc8232
SHA1 bea03e3b0760c76134a7b59f1d2b4dc2cef6350f
SHA256 4a113d245956b3a329ce50ec269f3003d7dcf7d4752faea9430bb2f196bba1a3
SHA512 93652c9194edb897c0e9e832bcee8c347b5b4473736c0f2936021130d5c528cd1f9932060f48012fdf3cd526de594a3405f9e9d0308d9e03eb66152c53816ca7

memory/2640-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Program Files\HideApprove.doc.exe

MD5 a523fa3485539b6c72e7d2581d70117c
SHA1 c3610558f4fb869eb48cc74635fbbe1169e4cf0d
SHA256 1a12a97d0356443302bcb7717a76c26752c1f0a2cdca164b29e279801b8e7c74
SHA512 5101051f427ef9965cee653e72af5f3f501b1d6aa739060d54181c79b4e736aac656369397aa18f5c42cdebed352064e752202c18a118b4d9fe79bfe6ebd2c94

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

MD5 fea1759098942dd357c9bdb23f39f6b3
SHA1 e59f307ac11e588a4a9ce7d85772165d25b4d5a8
SHA256 db2c90cb33c4456e9e4712a31521b4c6543553eec7c7993fbfda3cdde183f2f5
SHA512 f7e22d737b5e3134b0fe67abbbe3778723191d78646ff8b3a782a8c7cc325be6debe3616f1255c7c08bc4df846b513df4d5f16a3396138353aa1990108c77a0d

memory/1932-85-0x0000000003BE0000-0x0000000003BF0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 00:18

Reported

2024-06-13 00:20

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kzluytaq = "xqbxvrdjgc.exe" C:\Windows\SysWOW64\nbyormfxaeqqbrl.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ljavdfde = "nbyormfxaeqqbrl.exe" C:\Windows\SysWOW64\nbyormfxaeqqbrl.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "aznuaooucqgmt.exe" C:\Windows\SysWOW64\nbyormfxaeqqbrl.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\i: C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\nhedzlfr.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\nbyormfxaeqqbrl.exe C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification C:\Windows\SysWOW64\xqbxvrdjgc.exe C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\nhedzlfr.exe C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\aznuaooucqgmt.exe C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\xqbxvrdjgc.exe C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File created C:\Windows\SysWOW64\nbyormfxaeqqbrl.exe C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\nhedzlfr.exe C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\aznuaooucqgmt.exe C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\nhedzlfr.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABBFACDFE64F196840B3B35869D3E99B08E02F142690238E1CC459B08A6" C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184CC67B15E3DBC4B8C07CE2EDE534CC" C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32322D799C5282576D4377D270222CAD7DF264DA" C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC5B15B4792399F52C4BAA53293D4C4" C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E89FC8D482E826D9140D7287DE1BC93E131584667406333D690" C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E78368C6FE6822DDD179D1D18A78906B" C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
N/A N/A C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
N/A N/A C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
N/A N/A C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
N/A N/A C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
N/A N/A C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
N/A N/A C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
N/A N/A C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
N/A N/A C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
N/A N/A C:\Windows\SysWOW64\xqbxvrdjgc.exe N/A
N/A N/A C:\Windows\SysWOW64\nbyormfxaeqqbrl.exe N/A
N/A N/A C:\Windows\SysWOW64\nbyormfxaeqqbrl.exe N/A
N/A N/A C:\Windows\SysWOW64\nbyormfxaeqqbrl.exe N/A
N/A N/A C:\Windows\SysWOW64\nbyormfxaeqqbrl.exe N/A
N/A N/A C:\Windows\SysWOW64\nbyormfxaeqqbrl.exe N/A
N/A N/A C:\Windows\SysWOW64\nbyormfxaeqqbrl.exe N/A
N/A N/A C:\Windows\SysWOW64\nbyormfxaeqqbrl.exe N/A
N/A N/A C:\Windows\SysWOW64\nbyormfxaeqqbrl.exe N/A
N/A N/A C:\Windows\SysWOW64\nbyormfxaeqqbrl.exe N/A
N/A N/A C:\Windows\SysWOW64\nbyormfxaeqqbrl.exe N/A
N/A N/A C:\Windows\SysWOW64\aznuaooucqgmt.exe N/A
N/A N/A C:\Windows\SysWOW64\nhedzlfr.exe N/A
N/A N/A C:\Windows\SysWOW64\aznuaooucqgmt.exe N/A
N/A N/A C:\Windows\SysWOW64\nhedzlfr.exe N/A
N/A N/A C:\Windows\SysWOW64\aznuaooucqgmt.exe N/A
N/A N/A C:\Windows\SysWOW64\aznuaooucqgmt.exe N/A
N/A N/A C:\Windows\SysWOW64\nhedzlfr.exe N/A
N/A N/A C:\Windows\SysWOW64\nhedzlfr.exe N/A
N/A N/A C:\Windows\SysWOW64\aznuaooucqgmt.exe N/A
N/A N/A C:\Windows\SysWOW64\aznuaooucqgmt.exe N/A
N/A N/A C:\Windows\SysWOW64\aznuaooucqgmt.exe N/A
N/A N/A C:\Windows\SysWOW64\aznuaooucqgmt.exe N/A
N/A N/A C:\Windows\SysWOW64\aznuaooucqgmt.exe N/A
N/A N/A C:\Windows\SysWOW64\aznuaooucqgmt.exe N/A
N/A N/A C:\Windows\SysWOW64\aznuaooucqgmt.exe N/A
N/A N/A C:\Windows\SysWOW64\aznuaooucqgmt.exe N/A
N/A N/A C:\Windows\SysWOW64\nhedzlfr.exe N/A
N/A N/A C:\Windows\SysWOW64\nhedzlfr.exe N/A
N/A N/A C:\Windows\SysWOW64\nhedzlfr.exe N/A
N/A N/A C:\Windows\SysWOW64\nhedzlfr.exe N/A
N/A N/A C:\Windows\SysWOW64\nhedzlfr.exe N/A
N/A N/A C:\Windows\SysWOW64\nhedzlfr.exe N/A
N/A N/A C:\Windows\SysWOW64\nhedzlfr.exe N/A
N/A N/A C:\Windows\SysWOW64\nhedzlfr.exe N/A
N/A N/A C:\Windows\SysWOW64\nhedzlfr.exe N/A
N/A N/A C:\Windows\SysWOW64\nhedzlfr.exe N/A
N/A N/A C:\Windows\SysWOW64\nhedzlfr.exe N/A
N/A N/A C:\Windows\SysWOW64\nhedzlfr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 548 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\xqbxvrdjgc.exe
PID 548 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\xqbxvrdjgc.exe
PID 548 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\xqbxvrdjgc.exe
PID 548 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\nbyormfxaeqqbrl.exe
PID 548 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\nbyormfxaeqqbrl.exe
PID 548 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\nbyormfxaeqqbrl.exe
PID 548 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\nhedzlfr.exe
PID 548 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\nhedzlfr.exe
PID 548 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\nhedzlfr.exe
PID 548 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\aznuaooucqgmt.exe
PID 548 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\aznuaooucqgmt.exe
PID 548 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Windows\SysWOW64\aznuaooucqgmt.exe
PID 3860 wrote to memory of 1888 N/A C:\Windows\SysWOW64\xqbxvrdjgc.exe C:\Windows\SysWOW64\nhedzlfr.exe
PID 3860 wrote to memory of 1888 N/A C:\Windows\SysWOW64\xqbxvrdjgc.exe C:\Windows\SysWOW64\nhedzlfr.exe
PID 3860 wrote to memory of 1888 N/A C:\Windows\SysWOW64\xqbxvrdjgc.exe C:\Windows\SysWOW64\nhedzlfr.exe
PID 548 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 548 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a31ae939fbb3885501f82d470b4b0af6_JaffaCakes118.exe"

C:\Windows\SysWOW64\xqbxvrdjgc.exe

xqbxvrdjgc.exe

C:\Windows\SysWOW64\nbyormfxaeqqbrl.exe

nbyormfxaeqqbrl.exe

C:\Windows\SysWOW64\nhedzlfr.exe

nhedzlfr.exe

C:\Windows\SysWOW64\aznuaooucqgmt.exe

aznuaooucqgmt.exe

C:\Windows\SysWOW64\nhedzlfr.exe

C:\Windows\system32\nhedzlfr.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 8.167.79.40.in-addr.arpa udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
NL 23.62.61.162:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 162.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 41.43.201.23.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 137.71.105.51.in-addr.arpa udp

Files

memory/548-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\nbyormfxaeqqbrl.exe

MD5 f32f1d87e07c7c9cc7b5b8dbae1c6584
SHA1 465d370f56c5916744ae2add4f71acc69f4300e0
SHA256 40d301f286522a56d67182268f1973b7789e165ad2a35885ebd419c4790e2173
SHA512 ab116d2378c32edd31693524960b53dc6faeb62ec537a5e61642c110082e5b74d2b97c513759c6ffee232d4501ff5cc2ba368e8041f1edbd93c1037f821401de

C:\Windows\SysWOW64\xqbxvrdjgc.exe

MD5 82f9316c8eacdb5bdb07e34050ee9b67
SHA1 7ca64c05fd0ffd99dc0e48a52131d7f79e098148
SHA256 c6e4fc758820e1c9695a8b08a3c15c95c6fdf5b02d48841f0e4f1ac9e1b48cea
SHA512 186541a35de91ccda3fd304d3bddd2cf29bce667f5014f237897c0f96a4b5b219560234a00d1c3005c710f42e4b816645eabaef5ebe5a3321b69c33779a138a6

C:\Windows\SysWOW64\nhedzlfr.exe

MD5 d7a22cbaa4f1bb9ef277cc47eecb61ea
SHA1 245dd8a8006b3b3454051d1cc93c81a5deef926c
SHA256 1f2c2abd35435b21d02c18922a598986067cbc37d3843fc090fc72dac0b0d6b4
SHA512 e6448de72f4450a0a8341190717987a7f2eb2feb45d95d4e449da97979ba43fd61f8da39d9b23d50ca4f2bf086070f7ab0d89b69bb584f6ca9caf7e1e05d8eac

C:\Windows\SysWOW64\aznuaooucqgmt.exe

MD5 14596fd9c7da79e6b09ba9dc67fcc13f
SHA1 8c942583c3febedc81bf00720c9260904e1ec82c
SHA256 e507c50a06077c9f38a9033e9617852557418ac26b8d1985f89cd7ffc375d840
SHA512 81bd803c8b5bbaf24866777f022cd1c263464cc6315a3d6d19450884aeaa03330b47307721da252b518912f177ee130b9524c0bfa057e8c22bae300ce3d42d18

memory/4772-37-0x00007FFEC1D10000-0x00007FFEC1D20000-memory.dmp

memory/4772-38-0x00007FFEC1D10000-0x00007FFEC1D20000-memory.dmp

memory/4772-39-0x00007FFEC1D10000-0x00007FFEC1D20000-memory.dmp

memory/4772-40-0x00007FFEC1D10000-0x00007FFEC1D20000-memory.dmp

memory/4772-41-0x00007FFEC1D10000-0x00007FFEC1D20000-memory.dmp

memory/4772-42-0x00007FFEBFA40000-0x00007FFEBFA50000-memory.dmp

memory/4772-43-0x00007FFEBFA40000-0x00007FFEBFA50000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 12b138a5a40ffb88d1850866bf2959cd
SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

MD5 94d5d568fff7f85897be973fe758e499
SHA1 720daa702270ffdbd419720d10ab7d13f3921029
SHA256 b279588f8601f67f716a072549334eb7bd7620d5228e6ceeee32f9a8047fa48b
SHA512 88ae18388d3f55f28ab2533dc11ef83b8de0572c23d0f2161a5751ca7efd9ee8226b6bde23a733805f81f4a840db45899329ed428f468eca366758aa9e9bf76a

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

MD5 d7ac38582dd2a776ad5ed161ad3af0da
SHA1 316b407122ebc2c522e6be0344b46a27b478e4ec
SHA256 104675d3562ec0a64ee0a1af3f479dedef5e1eab6604bcdd82912cb24e522324
SHA512 728ef6b695f0963f5a896e69efa39ff51ad96be672220611f503cf2ae560fba550204f913ebfbd56f8a1ca59672c03b4cbfaca0418acba635da35a3ad4801dbe

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 d73ce7178631d9cc30bac89b66041a67
SHA1 82e6ede6995a25c267affe4bcc11591f843174fc
SHA256 ea9483bad8b926445baa5bddf28095fa137dd3917da847e334165e8b6e5fb2e5
SHA512 56caac0d8ba161cc19a9ab46ec70018b204d6863247461afa033ddf4ddedd3af0df80d71be1d66ce386633ff35faa08ce8e829018b44b640963c444849b7bc1b

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 8393bbfa6085a2dd6034cda7b6bbe743
SHA1 dfc29dda1aa521b8f59fe8a54e73023c5c08d050
SHA256 730839752a85027d9892ecb683a04e427c21397412f8f2cc23517f43e0d34b64
SHA512 4ddb195d250366be01cc8f2fb5d6b65760fa95808e7db7bd83c068014a1f5a517363852775a4ebe8abe5cee0c266c9a949c0a840cce0af0dbb7c1455e6a182c1

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 e63a93774d43000337fd3d1adb0f2c33
SHA1 d0872fcae39c36b58681e30eb58b857541799ecc
SHA256 bea07e3f48279a5609a70a11f80b3d3c1e051bacd28edee2ee04c9d3c1a385bd
SHA512 7fd94e2f8d5495812b493739628732de60b1061aea18da0abd2d9bf628509230b66dbc8ed01cf377c8b1bf6e9303fc75782324cf6baa3ddfdf697ebaf7a2614b

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 1b790b0216dee2a0b55b440364b43d6c
SHA1 b630796627d21e101894407c0c95e81843fb90b5
SHA256 f9578fb15cce0cc4f89f4d00c9c85416e9c044ce253cbf072a2cc2c2762eaead
SHA512 4da67553f1430479c2233060db58adabbe87a28817dc135c1b842b85c47f9c74c4e835975f50c0201b32bd5b0c2eeb8444c22e18b8d7539e6ed9f5d8e92b3ffd

C:\Users\Admin\AppData\Local\Temp\TCD7F8D.tmp\iso690.xsl

MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

memory/4772-595-0x00007FFEC1D10000-0x00007FFEC1D20000-memory.dmp

memory/4772-594-0x00007FFEC1D10000-0x00007FFEC1D20000-memory.dmp

memory/4772-596-0x00007FFEC1D10000-0x00007FFEC1D20000-memory.dmp

memory/4772-597-0x00007FFEC1D10000-0x00007FFEC1D20000-memory.dmp