Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/09/2024, 12:41
Behavioral task
behavioral1
Sample
ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
29 signatures
150 seconds
General
-
Target
ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe
-
Size
255KB
-
MD5
ed9c0c1b20b1873ca8c8fbf5be3036f6
-
SHA1
f5420e40802e6fa199fa043ccfa7df15474fc388
-
SHA256
e522e926aba732c8b053396afccc6c04dfea051945569d1b89b00a092278e82d
-
SHA512
6b4d88df854ab398200584e0cd1b376067022780b1d8603c242da52320de9a736aab4fed3323772206c8070454297d2239c8fc1ab69d84ca4848aef273dea5dd
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJN:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIu
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" rcpvkjqars.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rcpvkjqars.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rcpvkjqars.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rcpvkjqars.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" rcpvkjqars.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rcpvkjqars.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rcpvkjqars.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" rcpvkjqars.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe -
Executes dropped EXE 5 IoCs
pid Process 3476 rcpvkjqars.exe 1736 nbqzkqtehmovvfe.exe 2472 dosvsmjh.exe 2424 lnwagfrovnfnj.exe 772 dosvsmjh.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1564-0-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0008000000023466-5.dat upx behavioral2/files/0x0008000000023460-18.dat upx behavioral2/files/0x0007000000023467-29.dat upx behavioral2/memory/2424-30-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0007000000023468-28.dat upx behavioral2/memory/1564-34-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0007000000023473-64.dat upx behavioral2/files/0x0007000000023472-55.dat upx behavioral2/memory/3476-75-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1736-76-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0008000000023479-81.dat upx behavioral2/files/0x000700000002347a-88.dat upx behavioral2/memory/2472-90-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2424-91-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3476-92-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2472-94-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/772-96-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/772-97-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2424-95-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1736-93-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0007000000023481-115.dat upx behavioral2/files/0x0007000000023481-407.dat upx behavioral2/files/0x0007000000023481-409.dat upx behavioral2/memory/2424-585-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/772-586-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2472-584-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1736-583-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3476-582-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1736-606-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2472-607-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/772-609-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2424-608-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3476-605-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3476-610-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1736-611-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2472-612-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2424-613-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/772-614-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/772-617-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2472-618-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3476-619-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1736-620-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2424-621-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3476-622-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2424-624-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1736-623-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3476-630-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1736-631-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2424-632-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3476-633-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2424-635-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1736-634-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3476-636-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2424-638-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1736-637-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3476-652-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1736-653-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2424-654-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3476-663-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2424-665-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1736-664-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3476-666-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1736-667-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rcpvkjqars.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" rcpvkjqars.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rcpvkjqars.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rcpvkjqars.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rcpvkjqars.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" rcpvkjqars.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xwjrkubi = "rcpvkjqars.exe" nbqzkqtehmovvfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pzkdqpee = "nbqzkqtehmovvfe.exe" nbqzkqtehmovvfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "lnwagfrovnfnj.exe" nbqzkqtehmovvfe.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\v: dosvsmjh.exe File opened (read-only) \??\t: rcpvkjqars.exe File opened (read-only) \??\h: dosvsmjh.exe File opened (read-only) \??\i: dosvsmjh.exe File opened (read-only) \??\q: dosvsmjh.exe File opened (read-only) \??\y: dosvsmjh.exe File opened (read-only) \??\a: dosvsmjh.exe File opened (read-only) \??\u: dosvsmjh.exe File opened (read-only) \??\h: rcpvkjqars.exe File opened (read-only) \??\j: rcpvkjqars.exe File opened (read-only) \??\x: rcpvkjqars.exe File opened (read-only) \??\z: rcpvkjqars.exe File opened (read-only) \??\w: dosvsmjh.exe File opened (read-only) \??\e: dosvsmjh.exe File opened (read-only) \??\g: rcpvkjqars.exe File opened (read-only) \??\k: rcpvkjqars.exe File opened (read-only) \??\b: dosvsmjh.exe File opened (read-only) \??\g: dosvsmjh.exe File opened (read-only) \??\r: rcpvkjqars.exe File opened (read-only) \??\j: dosvsmjh.exe File opened (read-only) \??\t: dosvsmjh.exe File opened (read-only) \??\r: dosvsmjh.exe File opened (read-only) \??\b: rcpvkjqars.exe File opened (read-only) \??\v: rcpvkjqars.exe File opened (read-only) \??\k: dosvsmjh.exe File opened (read-only) \??\o: dosvsmjh.exe File opened (read-only) \??\l: dosvsmjh.exe File opened (read-only) \??\e: rcpvkjqars.exe File opened (read-only) \??\i: dosvsmjh.exe File opened (read-only) \??\m: dosvsmjh.exe File opened (read-only) \??\t: dosvsmjh.exe File opened (read-only) \??\m: dosvsmjh.exe File opened (read-only) \??\x: dosvsmjh.exe File opened (read-only) \??\w: rcpvkjqars.exe File opened (read-only) \??\n: dosvsmjh.exe File opened (read-only) \??\x: dosvsmjh.exe File opened (read-only) \??\b: dosvsmjh.exe File opened (read-only) \??\e: dosvsmjh.exe File opened (read-only) \??\k: dosvsmjh.exe File opened (read-only) \??\z: dosvsmjh.exe File opened (read-only) \??\n: rcpvkjqars.exe File opened (read-only) \??\u: rcpvkjqars.exe File opened (read-only) \??\s: dosvsmjh.exe File opened (read-only) \??\y: dosvsmjh.exe File opened (read-only) \??\y: rcpvkjqars.exe File opened (read-only) \??\h: dosvsmjh.exe File opened (read-only) \??\p: rcpvkjqars.exe File opened (read-only) \??\u: dosvsmjh.exe File opened (read-only) \??\a: rcpvkjqars.exe File opened (read-only) \??\s: rcpvkjqars.exe File opened (read-only) \??\n: dosvsmjh.exe File opened (read-only) \??\p: dosvsmjh.exe File opened (read-only) \??\z: dosvsmjh.exe File opened (read-only) \??\i: rcpvkjqars.exe File opened (read-only) \??\a: dosvsmjh.exe File opened (read-only) \??\q: dosvsmjh.exe File opened (read-only) \??\s: dosvsmjh.exe File opened (read-only) \??\g: dosvsmjh.exe File opened (read-only) \??\q: rcpvkjqars.exe File opened (read-only) \??\l: dosvsmjh.exe File opened (read-only) \??\r: dosvsmjh.exe File opened (read-only) \??\v: dosvsmjh.exe File opened (read-only) \??\m: rcpvkjqars.exe File opened (read-only) \??\o: dosvsmjh.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" rcpvkjqars.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" rcpvkjqars.exe -
AutoIT Executable 58 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2424-30-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1564-34-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3476-75-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1736-76-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2472-90-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2424-91-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3476-92-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2472-94-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/772-96-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/772-97-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2424-95-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1736-93-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2424-585-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/772-586-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2472-584-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1736-583-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3476-582-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1736-606-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2472-607-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/772-609-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2424-608-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3476-605-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3476-610-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1736-611-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2472-612-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2424-613-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/772-614-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/772-617-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2472-618-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3476-619-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1736-620-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2424-621-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3476-622-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2424-624-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1736-623-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3476-630-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1736-631-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2424-632-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3476-633-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2424-635-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1736-634-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3476-636-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2424-638-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1736-637-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3476-652-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1736-653-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2424-654-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3476-663-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2424-665-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1736-664-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3476-666-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1736-667-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2424-668-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3476-669-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1736-670-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2424-671-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3476-672-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1736-673-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msvbvm60.dll rcpvkjqars.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe dosvsmjh.exe File opened for modification C:\Windows\SysWOW64\nbqzkqtehmovvfe.exe ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe File created C:\Windows\SysWOW64\lnwagfrovnfnj.exe ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe File created C:\Windows\SysWOW64\nbqzkqtehmovvfe.exe ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe File created C:\Windows\SysWOW64\dosvsmjh.exe ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dosvsmjh.exe ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\lnwagfrovnfnj.exe ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe dosvsmjh.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe dosvsmjh.exe File created C:\Windows\SysWOW64\rcpvkjqars.exe ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rcpvkjqars.exe ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal dosvsmjh.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe dosvsmjh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe dosvsmjh.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe dosvsmjh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal dosvsmjh.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe dosvsmjh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe dosvsmjh.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe dosvsmjh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal dosvsmjh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe dosvsmjh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe dosvsmjh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal dosvsmjh.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe dosvsmjh.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe dosvsmjh.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe dosvsmjh.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe dosvsmjh.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe dosvsmjh.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe dosvsmjh.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe dosvsmjh.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe dosvsmjh.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe dosvsmjh.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe dosvsmjh.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe dosvsmjh.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe dosvsmjh.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe dosvsmjh.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe dosvsmjh.exe File opened for modification C:\Windows\mydoc.rtf ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe dosvsmjh.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe dosvsmjh.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe dosvsmjh.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe dosvsmjh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rcpvkjqars.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbqzkqtehmovvfe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnwagfrovnfnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dosvsmjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dosvsmjh.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32412C7B9D5082596A3776A177272CDF7CF565DA" ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFDFF894F2785699146D7217E97BDE2E634593267416330D79E" ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E08668B2FE6E22DAD27BD1D28A7B9163" ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat rcpvkjqars.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" rcpvkjqars.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc rcpvkjqars.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABBFACDFE17F293837B3A40819F3994B0FE02F94367023FE2C842E608D6" ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh rcpvkjqars.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB0B15A4494389D52CDBAA6329FD7CE" ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193FC77B1596DABFB9BC7FE4EDE234CC" ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" rcpvkjqars.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs rcpvkjqars.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" rcpvkjqars.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg rcpvkjqars.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" rcpvkjqars.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" rcpvkjqars.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf rcpvkjqars.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" rcpvkjqars.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4268 WINWORD.EXE 4268 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 3476 rcpvkjqars.exe 3476 rcpvkjqars.exe 3476 rcpvkjqars.exe 3476 rcpvkjqars.exe 3476 rcpvkjqars.exe 3476 rcpvkjqars.exe 3476 rcpvkjqars.exe 3476 rcpvkjqars.exe 3476 rcpvkjqars.exe 3476 rcpvkjqars.exe 1736 nbqzkqtehmovvfe.exe 1736 nbqzkqtehmovvfe.exe 1736 nbqzkqtehmovvfe.exe 1736 nbqzkqtehmovvfe.exe 1736 nbqzkqtehmovvfe.exe 1736 nbqzkqtehmovvfe.exe 1736 nbqzkqtehmovvfe.exe 1736 nbqzkqtehmovvfe.exe 2472 dosvsmjh.exe 2472 dosvsmjh.exe 2472 dosvsmjh.exe 2472 dosvsmjh.exe 2472 dosvsmjh.exe 2472 dosvsmjh.exe 2472 dosvsmjh.exe 2472 dosvsmjh.exe 2424 lnwagfrovnfnj.exe 2424 lnwagfrovnfnj.exe 2424 lnwagfrovnfnj.exe 2424 lnwagfrovnfnj.exe 2424 lnwagfrovnfnj.exe 2424 lnwagfrovnfnj.exe 2424 lnwagfrovnfnj.exe 2424 lnwagfrovnfnj.exe 2424 lnwagfrovnfnj.exe 2424 lnwagfrovnfnj.exe 2424 lnwagfrovnfnj.exe 2424 lnwagfrovnfnj.exe 1736 nbqzkqtehmovvfe.exe 1736 nbqzkqtehmovvfe.exe 772 dosvsmjh.exe 772 dosvsmjh.exe 772 dosvsmjh.exe 772 dosvsmjh.exe 772 dosvsmjh.exe 772 dosvsmjh.exe 772 dosvsmjh.exe 772 dosvsmjh.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 3476 rcpvkjqars.exe 3476 rcpvkjqars.exe 3476 rcpvkjqars.exe 2424 lnwagfrovnfnj.exe 2424 lnwagfrovnfnj.exe 2424 lnwagfrovnfnj.exe 1736 nbqzkqtehmovvfe.exe 2472 dosvsmjh.exe 1736 nbqzkqtehmovvfe.exe 2472 dosvsmjh.exe 1736 nbqzkqtehmovvfe.exe 2472 dosvsmjh.exe 772 dosvsmjh.exe 772 dosvsmjh.exe 772 dosvsmjh.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 3476 rcpvkjqars.exe 3476 rcpvkjqars.exe 3476 rcpvkjqars.exe 2424 lnwagfrovnfnj.exe 2424 lnwagfrovnfnj.exe 2424 lnwagfrovnfnj.exe 1736 nbqzkqtehmovvfe.exe 2472 dosvsmjh.exe 1736 nbqzkqtehmovvfe.exe 2472 dosvsmjh.exe 1736 nbqzkqtehmovvfe.exe 2472 dosvsmjh.exe 772 dosvsmjh.exe 772 dosvsmjh.exe 772 dosvsmjh.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4268 WINWORD.EXE 4268 WINWORD.EXE 4268 WINWORD.EXE 4268 WINWORD.EXE 4268 WINWORD.EXE 4268 WINWORD.EXE 4268 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1564 wrote to memory of 3476 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 84 PID 1564 wrote to memory of 3476 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 84 PID 1564 wrote to memory of 3476 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 84 PID 1564 wrote to memory of 1736 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 85 PID 1564 wrote to memory of 1736 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 85 PID 1564 wrote to memory of 1736 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 85 PID 1564 wrote to memory of 2472 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 86 PID 1564 wrote to memory of 2472 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 86 PID 1564 wrote to memory of 2472 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 86 PID 1564 wrote to memory of 2424 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 87 PID 1564 wrote to memory of 2424 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 87 PID 1564 wrote to memory of 2424 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 87 PID 3476 wrote to memory of 772 3476 rcpvkjqars.exe 88 PID 3476 wrote to memory of 772 3476 rcpvkjqars.exe 88 PID 3476 wrote to memory of 772 3476 rcpvkjqars.exe 88 PID 1564 wrote to memory of 4268 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 89 PID 1564 wrote to memory of 4268 1564 ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ed9c0c1b20b1873ca8c8fbf5be3036f6_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\rcpvkjqars.exercpvkjqars.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\dosvsmjh.exeC:\Windows\system32\dosvsmjh.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:772
-
-
-
C:\Windows\SysWOW64\nbqzkqtehmovvfe.exenbqzkqtehmovvfe.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1736
-
-
C:\Windows\SysWOW64\dosvsmjh.exedosvsmjh.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2472
-
-
C:\Windows\SysWOW64\lnwagfrovnfnj.exelnwagfrovnfnj.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2424
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4268
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5fbbf32dfdc203727b32e4cf3fbfd1c62
SHA1daf025fa85ae565dfb442a765269e299dd3ed3a8
SHA25684c8e784b64b1489fd1fdb5c7d94a3fefef27b9f84719644a643c092089cc7db
SHA5126fb099f72c9b9ecd0da31b99f14ea951d2282848d9232f7353fcb2323f56a49b2316c5aae8edb83fb56f637ddfd89e6e1402c08cbb31401ec84a92f4dbaa5b60
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
322B
MD583e913f640abd4502ad1cd41a98b2a95
SHA1ed52317041ed81bd3fc23f0c8677270ec81be1bf
SHA256674e5011a83eeb36cd1e51fa9fd5723cca32b6e3c1bdafcb9dda130527f0b275
SHA51263ecbb07e63d014c38ddc878b1d176e8a8816101ae8acb524160306491398481bc1c58a7596545b307a79bc0c50a6a712cf44ac641ca443d4094532318f6f2b7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize2KB
MD53cdd9ebff4182c440dd52c4e38a9b2aa
SHA18551079f56606ea6cebf1a1d2a2fc632ef920a24
SHA2564d970f6abe3d002677cbe5ef3f683c265a5781c538322fd45278842c79a9ca44
SHA512872096792edbd99d4f3d4a03e7aaafaa0229bd8ee2a337252eefd7915f7343c14655be42a607a057d2d72d68e63af592783d18973580f1a7d4862a8b49e13c8d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD5aa4e8a56888adc33889b25af319f8b12
SHA1c9787cfe02587e7ef598429f4292cf1e9c556b3c
SHA256e2ddb608717db07a21d1d277adb77922c075f2143dd003be55877471ce2de0c8
SHA5126478ccc8a9aa14b331c8e510134893301e78ea2e4bae78c1f0cbafb04fea3193cf46015b3cd9cc39038c522b956a41d5095bf0764e17f3718cb6d5d6e1714e23
-
Filesize
255KB
MD560cd4eb7f1eacd93b6417b00881cd051
SHA13487695b04470933a38ee06f4c1e385b814bc77a
SHA25691458b0160a9a23b7f4e40a72dabe9d299acbd035f47af28d59fa460a1a4f87e
SHA51243351abad18373d8165a6e250714203a971939c755bbbc68fb89e6bd04756a6cdee79fcf020ce997e63b2caac884fac59db1783d8c5a999cdee2a4d93aae5076
-
Filesize
255KB
MD556bd14a739634d53e0f03c858dec1d3b
SHA1b186bd9cad96a34c553e2ed733d713706a0b82ab
SHA256aebb88483c484bfea2c0904cc3ef05ca6ff425ca2e5d94b5e41f5ed390068b74
SHA5123a05143b7cb82ce36b4ff27a62302cb51a6c61d1c1854852eb20a3fb0ab8a22c389cf3565a791fe110edda9103197d7d3b6518fbd97369cf287e45506e82dfd4
-
Filesize
255KB
MD533162cdaa4845c85685c5868510826ac
SHA10890d9af0114b28f4f12e30b9fcf431627cb8c7b
SHA256592536cb3c7c28dc1c051ee64cf23d73628e071005e67d8554ecd91177d66452
SHA512bce9d6af680a7b6cb8fa2c3d5572e56b08814c15be5aa8bcbe55b8e664411953f22a7452472a1939f77069708c06e15ebfb5c6a60c737a8c3db4e0406e062992
-
Filesize
255KB
MD547fc5250613626e3c222f6f5b927813a
SHA144c7c029e83c360563a81fa256c8aa323a587e7c
SHA25695f39d7ffd1a0a666abe61f4e16ff463b9550afb0f28f1ff1d9ef8b5c75e8e2b
SHA51288297318da96577430e3540363093f023f4b5eb88de308ba4447f1ed4cf5b046b6b72f8f57fa2b47b2cfe15312b6c4533070702db1b2ba7ad02475671fc3bc90
-
Filesize
255KB
MD5c2bb81e5886426fcf92dcda2a14ea193
SHA16b10513a5f2cbf96ee3b138b2d15b9a014c58d28
SHA2563f10630b913aac1ce7c66172b598d0fcb332221112b2ddb149635332089620b0
SHA5125908a8410c4ab3717b2f5255978fafa6079ab5ecbed8f088e56c8577bdc29e993529b7be499b1b290ee61119563bfb5ab7945f19df9714e97549de8f12c8b28f
-
Filesize
255KB
MD516305880033a9fa0ebcc288bee1d4533
SHA11b6dfaef4adfdd4c0ad5d7019f339eaacea9d9b4
SHA2568c14226d79b4d3937a7737cc009152508aa14d4e6cc0dd0ae995d91d9e6b8734
SHA5128f5321351bff2296d7ece9869ba10f33d87286b0dd108763de49125b7be3dcfdfb40c04d406e107f031d7ee5738ea020fdccf9e9499a8d17a1123a63fa0687c7
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD59f2d7da229088995ed87846bc1d62fb0
SHA1355a116bf7ffabbea4328bcdf00ace48ef9f730b
SHA2564463e6e81c90a29b01cc2d466ca30afef759ea2dd49b6354ca94e85cb189c498
SHA512b7d14ee6d1ba6e794579cc9c540629e595a01eb4b933e60563217b1c5ffeb01d1eac7676e05a70138671b595d425a5507d4fd6c6637bf0bd28eba4de65d82820
-
Filesize
255KB
MD53c36a94b4f6a310b901616851c77becc
SHA1229f63532535e383d34a21bd163ca615f19466eb
SHA256b7c540d033417f0162e9c3ef01e784b045a8acd4724556d5846a2b3052fa21a0
SHA512e020f429aabaddcadd409907d2fde4b41ac1b900795778d03d663997ff753575fc31e754e3ee977ea90e8ae11aa5b36491afdc34df72fda2e18c52e2bde9597b
-
Filesize
255KB
MD53e270eaf82719eb99a5ac6170f22d40e
SHA1d7888d638720dd54d432a26a236faf8271547cce
SHA256ac3b1efbf9dcdb08b292955e6aea837ae94fbb471870cf6f2c9feec2a63cccd3
SHA51239a3a11555e2628e367bf8f5e182fb17b688cadbe496d78eab4d5d0db3b8edbe4c0558c0d29259bde85b927f52ce6abb8b55eb7e7295e615292c63abf47b259f
-
Filesize
255KB
MD527bb11f52853902786885467cecf5c39
SHA11905ef2a2792a1f9ee13212475e93197469bda03
SHA2567618c7fb9a3e36030fc78cf5ffb2cfdb44211f3fd3fe7b8beaac6303081f15d2
SHA5122e05ae63bb50123d09eba7fb714bc6226cf20b03edb9b0c3de0301eaa0db67d6c669250ded05175c42f80c9dcdf84f5a2b81c92a60b9c8469f5b9a61d7131e2f