Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12-08-2024 05:38
Behavioral task
behavioral1
Sample
8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
26 signatures
150 seconds
General
-
Target
8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe
-
Size
255KB
-
MD5
8d858c85a16a087c0f35a90d191299c6
-
SHA1
62e3eb8a010750c12c7ab12c71b0c7b853acda12
-
SHA256
af59b1f04419954dc52889849884bd738862a42494ec353a6564a4ba56e616fe
-
SHA512
fb9c1bb139d93bb0a185497e02f81633278b6b184d934e5e596efa05fcdc1e0ea124febe3d2cc6a82e22eb570b94f40311c29bce983fa38a999295f405e83864
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJV:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIg
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" zqdkakmsuv.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zqdkakmsuv.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" zqdkakmsuv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" zqdkakmsuv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" zqdkakmsuv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" zqdkakmsuv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" zqdkakmsuv.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zqdkakmsuv.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe -
Executes dropped EXE 5 IoCs
pid Process 3896 zqdkakmsuv.exe 3456 meykntzpktnamtr.exe 3100 xxxldevg.exe 2276 mdvycknplxxkm.exe 3548 xxxldevg.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3236-0-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x00080000000234b0-5.dat upx behavioral2/files/0x000900000002349f-18.dat upx behavioral2/memory/3896-26-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3456-28-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x00070000000234b4-27.dat upx behavioral2/files/0x00070000000234b5-29.dat upx behavioral2/memory/2276-31-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3548-35-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3236-36-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x00070000000234c3-73.dat upx behavioral2/files/0x00070000000234c4-75.dat upx behavioral2/files/0x00070000000234d0-85.dat upx behavioral2/files/0x00070000000234d1-91.dat upx behavioral2/memory/3896-93-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3100-95-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3548-97-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2276-96-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3456-94-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3456-123-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3896-124-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x00070000000234db-263.dat upx behavioral2/memory/3100-456-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3548-458-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2276-457-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3456-455-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3896-454-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3100-459-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2276-460-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3548-461-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3896-462-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3548-466-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2276-465-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3100-464-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3456-463-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3456-468-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3896-467-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3100-469-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3548-471-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2276-470-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3896-472-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3100-474-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3548-476-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2276-475-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3456-473-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3100-480-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3548-479-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3896-481-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2276-483-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3456-482-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3896-489-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2276-491-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3456-490-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3896-492-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3456-493-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2276-494-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3896-495-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3456-496-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2276-497-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3896-511-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2276-513-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3456-512-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3896-522-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2276-524-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" zqdkakmsuv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" zqdkakmsuv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" zqdkakmsuv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" zqdkakmsuv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" zqdkakmsuv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" zqdkakmsuv.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lyecrkif = "meykntzpktnamtr.exe" meykntzpktnamtr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mdvycknplxxkm.exe" meykntzpktnamtr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\buvetcwb = "zqdkakmsuv.exe" meykntzpktnamtr.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\r: zqdkakmsuv.exe File opened (read-only) \??\m: xxxldevg.exe File opened (read-only) \??\p: xxxldevg.exe File opened (read-only) \??\r: xxxldevg.exe File opened (read-only) \??\y: xxxldevg.exe File opened (read-only) \??\y: zqdkakmsuv.exe File opened (read-only) \??\i: xxxldevg.exe File opened (read-only) \??\k: xxxldevg.exe File opened (read-only) \??\v: xxxldevg.exe File opened (read-only) \??\j: xxxldevg.exe File opened (read-only) \??\b: zqdkakmsuv.exe File opened (read-only) \??\e: zqdkakmsuv.exe File opened (read-only) \??\g: zqdkakmsuv.exe File opened (read-only) \??\h: xxxldevg.exe File opened (read-only) \??\q: xxxldevg.exe File opened (read-only) \??\w: xxxldevg.exe File opened (read-only) \??\g: xxxldevg.exe File opened (read-only) \??\q: xxxldevg.exe File opened (read-only) \??\b: xxxldevg.exe File opened (read-only) \??\r: xxxldevg.exe File opened (read-only) \??\z: xxxldevg.exe File opened (read-only) \??\l: zqdkakmsuv.exe File opened (read-only) \??\o: zqdkakmsuv.exe File opened (read-only) \??\t: zqdkakmsuv.exe File opened (read-only) \??\u: xxxldevg.exe File opened (read-only) \??\o: xxxldevg.exe File opened (read-only) \??\a: zqdkakmsuv.exe File opened (read-only) \??\k: xxxldevg.exe File opened (read-only) \??\u: xxxldevg.exe File opened (read-only) \??\u: zqdkakmsuv.exe File opened (read-only) \??\t: xxxldevg.exe File opened (read-only) \??\n: xxxldevg.exe File opened (read-only) \??\x: xxxldevg.exe File opened (read-only) \??\a: xxxldevg.exe File opened (read-only) \??\t: xxxldevg.exe File opened (read-only) \??\x: zqdkakmsuv.exe File opened (read-only) \??\x: xxxldevg.exe File opened (read-only) \??\w: xxxldevg.exe File opened (read-only) \??\i: zqdkakmsuv.exe File opened (read-only) \??\l: xxxldevg.exe File opened (read-only) \??\s: xxxldevg.exe File opened (read-only) \??\p: xxxldevg.exe File opened (read-only) \??\q: zqdkakmsuv.exe File opened (read-only) \??\o: xxxldevg.exe File opened (read-only) \??\v: xxxldevg.exe File opened (read-only) \??\y: xxxldevg.exe File opened (read-only) \??\i: xxxldevg.exe File opened (read-only) \??\n: xxxldevg.exe File opened (read-only) \??\m: zqdkakmsuv.exe File opened (read-only) \??\n: zqdkakmsuv.exe File opened (read-only) \??\v: zqdkakmsuv.exe File opened (read-only) \??\g: xxxldevg.exe File opened (read-only) \??\h: xxxldevg.exe File opened (read-only) \??\z: xxxldevg.exe File opened (read-only) \??\h: zqdkakmsuv.exe File opened (read-only) \??\j: zqdkakmsuv.exe File opened (read-only) \??\s: zqdkakmsuv.exe File opened (read-only) \??\z: zqdkakmsuv.exe File opened (read-only) \??\l: xxxldevg.exe File opened (read-only) \??\m: xxxldevg.exe File opened (read-only) \??\e: xxxldevg.exe File opened (read-only) \??\k: zqdkakmsuv.exe File opened (read-only) \??\p: zqdkakmsuv.exe File opened (read-only) \??\w: zqdkakmsuv.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" zqdkakmsuv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" zqdkakmsuv.exe -
AutoIT Executable 59 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3896-26-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3456-28-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3236-36-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3896-93-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3100-95-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3548-97-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2276-96-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3456-94-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3456-123-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3896-124-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3100-456-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3548-458-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2276-457-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3456-455-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3896-454-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3100-459-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2276-460-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3548-461-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3896-462-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3548-466-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2276-465-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3100-464-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3456-463-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3456-468-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3896-467-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3100-469-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3548-471-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2276-470-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3896-472-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3100-474-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3548-476-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2276-475-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3456-473-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3100-480-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3548-479-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3896-481-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2276-483-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3456-482-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3896-489-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2276-491-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3456-490-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3896-492-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3456-493-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2276-494-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3896-495-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3456-496-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2276-497-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3896-511-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2276-513-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3456-512-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3896-522-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2276-524-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3456-523-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3896-525-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2276-527-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3456-526-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3896-528-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3456-529-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2276-530-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\xxxldevg.exe 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe xxxldevg.exe File created C:\Windows\SysWOW64\meykntzpktnamtr.exe 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mdvycknplxxkm.exe 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll zqdkakmsuv.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe xxxldevg.exe File created C:\Windows\SysWOW64\zqdkakmsuv.exe 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\meykntzpktnamtr.exe 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe xxxldevg.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe xxxldevg.exe File opened for modification C:\Windows\SysWOW64\zqdkakmsuv.exe 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xxxldevg.exe 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe File created C:\Windows\SysWOW64\mdvycknplxxkm.exe 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe xxxldevg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe xxxldevg.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe xxxldevg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal xxxldevg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe xxxldevg.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe xxxldevg.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe xxxldevg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe xxxldevg.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe xxxldevg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal xxxldevg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal xxxldevg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal xxxldevg.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe xxxldevg.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe xxxldevg.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe xxxldevg.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe xxxldevg.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe xxxldevg.exe File opened for modification C:\Windows\mydoc.rtf 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe xxxldevg.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe xxxldevg.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe xxxldevg.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe xxxldevg.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe xxxldevg.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe xxxldevg.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe xxxldevg.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe xxxldevg.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe xxxldevg.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe xxxldevg.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe xxxldevg.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe xxxldevg.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe xxxldevg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zqdkakmsuv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meykntzpktnamtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdvycknplxxkm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxldevg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxldevg.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EC3B05B44E639EE53CABAD73393D7BE" 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F368B0FF1D21DDD10FD0D48B7E9113" 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184CC77815E7DAC3B9BD7C94ED9734CF" 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" zqdkakmsuv.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" zqdkakmsuv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc zqdkakmsuv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" zqdkakmsuv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" zqdkakmsuv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" zqdkakmsuv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" zqdkakmsuv.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32302D799C2D83546A4676A270542DDD7CF465DF" 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFCFF834F2682189142D72C7DE2BC94E1475830664F6335D799" 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh zqdkakmsuv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf zqdkakmsuv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs zqdkakmsuv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AB8FAB1FE64F192837E3A4581EA3E91B0FB03F043660338E1BA459D09A8" 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg zqdkakmsuv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat zqdkakmsuv.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1448 WINWORD.EXE 1448 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3896 zqdkakmsuv.exe 3896 zqdkakmsuv.exe 3896 zqdkakmsuv.exe 3896 zqdkakmsuv.exe 3896 zqdkakmsuv.exe 3896 zqdkakmsuv.exe 3896 zqdkakmsuv.exe 3896 zqdkakmsuv.exe 3896 zqdkakmsuv.exe 3896 zqdkakmsuv.exe 3456 meykntzpktnamtr.exe 3456 meykntzpktnamtr.exe 3456 meykntzpktnamtr.exe 3456 meykntzpktnamtr.exe 3456 meykntzpktnamtr.exe 3456 meykntzpktnamtr.exe 3456 meykntzpktnamtr.exe 3456 meykntzpktnamtr.exe 2276 mdvycknplxxkm.exe 2276 mdvycknplxxkm.exe 2276 mdvycknplxxkm.exe 2276 mdvycknplxxkm.exe 2276 mdvycknplxxkm.exe 2276 mdvycknplxxkm.exe 2276 mdvycknplxxkm.exe 2276 mdvycknplxxkm.exe 2276 mdvycknplxxkm.exe 2276 mdvycknplxxkm.exe 2276 mdvycknplxxkm.exe 2276 mdvycknplxxkm.exe 3456 meykntzpktnamtr.exe 3456 meykntzpktnamtr.exe 3100 xxxldevg.exe 3100 xxxldevg.exe 3100 xxxldevg.exe 3100 xxxldevg.exe 3100 xxxldevg.exe 3100 xxxldevg.exe 3100 xxxldevg.exe 3100 xxxldevg.exe 3548 xxxldevg.exe 3548 xxxldevg.exe 3548 xxxldevg.exe 3548 xxxldevg.exe 3548 xxxldevg.exe 3548 xxxldevg.exe 3548 xxxldevg.exe 3548 xxxldevg.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3896 zqdkakmsuv.exe 3896 zqdkakmsuv.exe 3896 zqdkakmsuv.exe 3456 meykntzpktnamtr.exe 2276 mdvycknplxxkm.exe 3456 meykntzpktnamtr.exe 2276 mdvycknplxxkm.exe 3456 meykntzpktnamtr.exe 2276 mdvycknplxxkm.exe 3100 xxxldevg.exe 3100 xxxldevg.exe 3100 xxxldevg.exe 3548 xxxldevg.exe 3548 xxxldevg.exe 3548 xxxldevg.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 3896 zqdkakmsuv.exe 3896 zqdkakmsuv.exe 3896 zqdkakmsuv.exe 3456 meykntzpktnamtr.exe 2276 mdvycknplxxkm.exe 3456 meykntzpktnamtr.exe 2276 mdvycknplxxkm.exe 3456 meykntzpktnamtr.exe 2276 mdvycknplxxkm.exe 3100 xxxldevg.exe 3100 xxxldevg.exe 3100 xxxldevg.exe 3548 xxxldevg.exe 3548 xxxldevg.exe 3548 xxxldevg.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1448 WINWORD.EXE 1448 WINWORD.EXE 1448 WINWORD.EXE 1448 WINWORD.EXE 1448 WINWORD.EXE 1448 WINWORD.EXE 1448 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3236 wrote to memory of 3896 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 85 PID 3236 wrote to memory of 3896 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 85 PID 3236 wrote to memory of 3896 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 85 PID 3236 wrote to memory of 3456 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 86 PID 3236 wrote to memory of 3456 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 86 PID 3236 wrote to memory of 3456 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 86 PID 3236 wrote to memory of 3100 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 87 PID 3236 wrote to memory of 3100 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 87 PID 3236 wrote to memory of 3100 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 87 PID 3236 wrote to memory of 2276 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 88 PID 3236 wrote to memory of 2276 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 88 PID 3236 wrote to memory of 2276 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 88 PID 3896 wrote to memory of 3548 3896 zqdkakmsuv.exe 89 PID 3896 wrote to memory of 3548 3896 zqdkakmsuv.exe 89 PID 3896 wrote to memory of 3548 3896 zqdkakmsuv.exe 89 PID 3236 wrote to memory of 1448 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 90 PID 3236 wrote to memory of 1448 3236 8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8d858c85a16a087c0f35a90d191299c6_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\zqdkakmsuv.exezqdkakmsuv.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\xxxldevg.exeC:\Windows\system32\xxxldevg.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3548
-
-
-
C:\Windows\SysWOW64\meykntzpktnamtr.exemeykntzpktnamtr.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3456
-
-
C:\Windows\SysWOW64\xxxldevg.exexxxldevg.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3100
-
-
C:\Windows\SysWOW64\mdvycknplxxkm.exemdvycknplxxkm.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2276
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1448
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD546fa4c361e386a8a043fc21faa88edaa
SHA1959c525014233571cd66afda242e967c98ca6f35
SHA2569a29a2cb1714018cc8ccd150f5d7d37494590d02892054cb59701ef947765635
SHA51209da41aa4e37526bf57934ebb8f08d98fbbf9da0033750a5712947064cc0b4c440f8ecf9bc35c3781e23673d46fd18d345a66f933fae2c8e279b7742220a7a42
-
Filesize
255KB
MD58350e455283c4d87d8888e116ca26726
SHA11249d8ad1eecd0b1f291565375d0b5a5dc5198b7
SHA256aff74028af7be8c00693246247fe1fd7c4937a62fbd3bc799cbdc756e54a07db
SHA5124317c66ccaf1d6d50f0aff36798a2a12ac46cd0ea31446ec5acf0ec03d848fe7c166eba3199851f8701f4757476b9f3f8c5968e23d04163b094d6b7803daf406
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
235B
MD58968662306276ff1c671ca542d2f7570
SHA1e74b2e3893ba9fcd5c059e25453a16353cf6730f
SHA256c128a2780168f5b6208f5fc30d368800356ef571199ccfd67507574d98196893
SHA5121772d685c8f4f1fff01162edd16263d8c3346a3a8d27fc92971ce72f7e0055aaa09870e97483480acae93d28eda39a4664f79d6ac95e20c8bf54c1ab6fdc97c5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize1KB
MD5e4b72cb7337839927a344e8747cf1d8f
SHA13fd8c8f031a76a116cc4f321b6ef0bb999a8e2d7
SHA2563ec6902acd95e63e38eed0d16eb2874079697669f64ae1d163aff689d4eff98f
SHA5122bcec872d407c184be617599f4f65456b51fa7626f05cd71fe0b25f03ef209c76e445200e895ea25cb4d3cd8f8338045ed01d07f174cc001d3ffa3b82dbbbded
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize1KB
MD509c004f54118c322d1b2c8be554cf768
SHA1e37452b6d8dc7046f6d8ebbfb14ad8c14f92627e
SHA256fff92eade835ae0dafb75ddcabf30dafa44e9d447da511a2a54efda4d39fb9cf
SHA512f9b373a3984039f69320e29cb3b6a33bca59b0e4a878d48b177800b15571436e3376d46dcf454c6e6fedb55b86a0713b458c4d5ae85f4be7dd0f89f36ed34aea
-
Filesize
255KB
MD5ffe7a76287e4d1a44c21adb9a6a58490
SHA1d1d90b9cd32a7b82e03be764c4abfaa68e39ed84
SHA2560c32eeeca4e2a6122c5d06ff4afa7673c10bd5995f148f10a1d8a85c4a51bc71
SHA512eb526cedec9bdfc059d9d60f1682a2290b1fbb67b1d2a9b1b66638b78c9e663f03131127201aa21144fdb3b6fdd760dbd5bb9701613f212968507394445b984d
-
Filesize
255KB
MD58eb81dbf9bc854ca93802051be02a6aa
SHA106e739d789ec6220df6cadc9a1604fba514c99b8
SHA2563f2d4bfdf0e067dcb18ed7b14194efe7aa17107101871f35ace15ef34c98aec0
SHA512193cce5752782a7d69f8548465e21e4c3b86a4e9f3df5921caa230b5b49bf1a90975f55d09142a3d956c76338604e486efb9428f779f4f287e2d39a1c834ba8f
-
Filesize
255KB
MD5849a51bf605e0e10af60b64dbfbd749c
SHA1514a3f2570e130d2cec678a472c79900b74acf63
SHA256a529eb948bb010aa16360cf6f22fb3aa7aa155230f83431b8913007496f0be89
SHA5124094671ec3992c6f58c41dcb4f580a5aec3c0256bb3614beebf024ab9980230d77a186fec0f39cd033ece3c8c06e052342ee2a34d97684356039014487b1378e
-
Filesize
255KB
MD518983b40b05fd654eec40be29e1a0ef4
SHA113140b792b433863ffac058944418b045ad8bcc7
SHA2567a9d10c85e4fe0618664fdcd8c60a182d698424f9c2c3c9fddf92b99eee4b6d7
SHA512058205e4886f1de3914789d180a778549bcc63022cde600f8363f65352043e4c04769f957c640b68a6ce55b6566ad7b10692e805ecf54e748b3cb534d0a87707
-
Filesize
255KB
MD5f663288bb3b792e53eaf5fd42425bccc
SHA13f77658a54ec622c24392909fec3ad885bb8b000
SHA25630a483ca602afe9793e3e7fae3d562034ca483d36ccd59d3fe9fddf3cc253990
SHA512d621f2cbd2d714190a73ce2c1ac7d13fe959e2da9d756bf4380175122d881561710b924b6d2aaa235bf52e631b7872f53228d81a0cccdcc095a16cba81e47680
-
Filesize
255KB
MD552285a04f2f8e8c28f686529a7cc5f47
SHA16946b584e99f0bbf18757c2fb1f9e5aaba1a6050
SHA2567f3858486c4ef7fbc02ae0ae83d2311f84adb5eda27892b207adb0837d0f8396
SHA512733b895dea1ce01e682f015d25f905366a4b75d249438a9bda8c7beb4bc2f0781590e215a8e8906771eee68c0c024bb628431fc727aa3b1ed8c4361270a0730c
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD5729f4fc801ba9f11c361ea0283aa10f4
SHA193ecc6bc673e1200d2bae7a3429a0b49309ca288
SHA25674aa039bf53a6d8fd5b6d556056af09382ffbf18a66b64acf7cb3da9c2ab3de7
SHA51234b832f6466f214dceb608227fde983c6ca1e20ef12f4d13ff6d95e1fce5cf46b472ed4a1d71e30b0cd61a88488047a78804ac90804d72f080dce967d91d25d3