Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 08:21
Behavioral task
behavioral1
Sample
2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
26 signatures
150 seconds
General
-
Target
2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe
-
Size
255KB
-
MD5
2dd31c97b7ab68472ee856e223b6b393
-
SHA1
745b9f02261092e1d10de96996e55325356aff20
-
SHA256
74f21332c7c683c24a94d62638cffad3d2dfd950002f3417439e2245d09a8ae3
-
SHA512
f127d09cc2ae3c519048d1f29617aea4f669af7028d6487843d628f3117916e69eaf1433ab680276bba954dffadcd1dfa6afef7349e57eb12a5291129968faad
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJY:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIn
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" mckwwljmek.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" mckwwljmek.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" mckwwljmek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" mckwwljmek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" mckwwljmek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" mckwwljmek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" mckwwljmek.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" mckwwljmek.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe -
Executes dropped EXE 5 IoCs
pid Process 1476 mckwwljmek.exe 1988 odrzvuphwbebbpb.exe 3148 auxcagjb.exe 936 ajskujlxrpuuw.exe 4708 auxcagjb.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" mckwwljmek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" mckwwljmek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" mckwwljmek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" mckwwljmek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" mckwwljmek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" mckwwljmek.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fgvdfhau = "mckwwljmek.exe" odrzvuphwbebbpb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qabrrorz = "odrzvuphwbebbpb.exe" odrzvuphwbebbpb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "ajskujlxrpuuw.exe" odrzvuphwbebbpb.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\k: auxcagjb.exe File opened (read-only) \??\t: auxcagjb.exe File opened (read-only) \??\z: auxcagjb.exe File opened (read-only) \??\n: auxcagjb.exe File opened (read-only) \??\p: auxcagjb.exe File opened (read-only) \??\q: auxcagjb.exe File opened (read-only) \??\v: mckwwljmek.exe File opened (read-only) \??\s: auxcagjb.exe File opened (read-only) \??\x: auxcagjb.exe File opened (read-only) \??\t: auxcagjb.exe File opened (read-only) \??\b: auxcagjb.exe File opened (read-only) \??\g: auxcagjb.exe File opened (read-only) \??\p: auxcagjb.exe File opened (read-only) \??\y: mckwwljmek.exe File opened (read-only) \??\o: auxcagjb.exe File opened (read-only) \??\r: auxcagjb.exe File opened (read-only) \??\r: mckwwljmek.exe File opened (read-only) \??\g: auxcagjb.exe File opened (read-only) \??\u: auxcagjb.exe File opened (read-only) \??\k: mckwwljmek.exe File opened (read-only) \??\m: auxcagjb.exe File opened (read-only) \??\p: mckwwljmek.exe File opened (read-only) \??\b: auxcagjb.exe File opened (read-only) \??\i: auxcagjb.exe File opened (read-only) \??\q: auxcagjb.exe File opened (read-only) \??\b: mckwwljmek.exe File opened (read-only) \??\j: mckwwljmek.exe File opened (read-only) \??\l: mckwwljmek.exe File opened (read-only) \??\l: auxcagjb.exe File opened (read-only) \??\o: auxcagjb.exe File opened (read-only) \??\w: auxcagjb.exe File opened (read-only) \??\g: mckwwljmek.exe File opened (read-only) \??\m: mckwwljmek.exe File opened (read-only) \??\x: mckwwljmek.exe File opened (read-only) \??\h: auxcagjb.exe File opened (read-only) \??\a: auxcagjb.exe File opened (read-only) \??\s: auxcagjb.exe File opened (read-only) \??\n: mckwwljmek.exe File opened (read-only) \??\o: mckwwljmek.exe File opened (read-only) \??\u: mckwwljmek.exe File opened (read-only) \??\n: auxcagjb.exe File opened (read-only) \??\u: auxcagjb.exe File opened (read-only) \??\v: auxcagjb.exe File opened (read-only) \??\x: auxcagjb.exe File opened (read-only) \??\s: mckwwljmek.exe File opened (read-only) \??\j: auxcagjb.exe File opened (read-only) \??\l: auxcagjb.exe File opened (read-only) \??\i: mckwwljmek.exe File opened (read-only) \??\y: auxcagjb.exe File opened (read-only) \??\m: auxcagjb.exe File opened (read-only) \??\q: mckwwljmek.exe File opened (read-only) \??\w: auxcagjb.exe File opened (read-only) \??\v: auxcagjb.exe File opened (read-only) \??\e: auxcagjb.exe File opened (read-only) \??\h: auxcagjb.exe File opened (read-only) \??\y: auxcagjb.exe File opened (read-only) \??\a: mckwwljmek.exe File opened (read-only) \??\h: mckwwljmek.exe File opened (read-only) \??\z: mckwwljmek.exe File opened (read-only) \??\k: auxcagjb.exe File opened (read-only) \??\t: mckwwljmek.exe File opened (read-only) \??\w: mckwwljmek.exe File opened (read-only) \??\e: auxcagjb.exe File opened (read-only) \??\a: auxcagjb.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" mckwwljmek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" mckwwljmek.exe -
AutoIT Executable 61 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1476-22-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/936-33-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1988-31-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/640-37-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1476-81-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/936-84-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1988-82-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3148-83-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1476-85-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3148-87-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1988-86-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4708-90-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4708-89-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/936-88-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1988-592-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/936-594-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4708-595-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3148-593-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1476-591-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1476-596-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/936-599-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3148-598-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1988-597-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4708-600-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1476-601-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/936-604-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3148-603-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1988-602-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4708-605-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3148-609-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4708-608-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1476-610-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1988-611-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/936-612-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1476-613-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/936-615-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1988-614-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1476-619-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1988-620-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/936-621-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1476-622-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1988-623-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/936-624-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1476-625-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1988-626-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/936-627-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1476-628-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1988-629-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/936-630-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1988-632-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1476-631-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/936-633-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1476-634-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1988-635-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/936-636-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1476-637-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1988-638-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/936-639-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1476-640-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1988-641-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/936-642-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mckwwljmek.exe 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\odrzvuphwbebbpb.exe 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe auxcagjb.exe File opened for modification C:\Windows\SysWOW64\ajskujlxrpuuw.exe 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll mckwwljmek.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe auxcagjb.exe File created C:\Windows\SysWOW64\mckwwljmek.exe 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe File created C:\Windows\SysWOW64\odrzvuphwbebbpb.exe 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe File created C:\Windows\SysWOW64\auxcagjb.exe 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\auxcagjb.exe 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe File created C:\Windows\SysWOW64\ajskujlxrpuuw.exe 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe auxcagjb.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe auxcagjb.exe -
resource yara_rule behavioral2/memory/640-0-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000d000000023a67-5.dat upx behavioral2/files/0x000f000000023a30-19.dat upx behavioral2/memory/1476-22-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000d000000023a68-24.dat upx behavioral2/files/0x000d000000023a69-27.dat upx behavioral2/memory/936-33-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3148-32-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1988-31-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/640-37-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000a000000023b80-71.dat upx behavioral2/memory/1476-81-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/936-84-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1988-82-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3148-83-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1476-85-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3148-87-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1988-86-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4708-90-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4708-89-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/936-88-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000e000000023b86-110.dat upx behavioral2/memory/1988-592-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/936-594-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4708-595-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3148-593-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1476-591-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1476-596-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/936-599-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3148-598-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1988-597-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4708-600-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1476-601-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/936-604-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3148-603-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1988-602-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4708-605-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3148-609-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4708-608-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1476-610-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1988-611-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/936-612-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1476-613-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/936-615-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1988-614-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1476-619-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1988-620-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/936-621-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1476-622-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1988-623-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/936-624-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1476-625-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1988-626-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/936-627-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1476-628-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1988-629-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/936-630-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1988-632-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1476-631-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/936-633-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1476-634-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1988-635-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/936-636-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1476-637-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe auxcagjb.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe auxcagjb.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe auxcagjb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal auxcagjb.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe auxcagjb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe auxcagjb.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe auxcagjb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe auxcagjb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal auxcagjb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe auxcagjb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe auxcagjb.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe auxcagjb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal auxcagjb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal auxcagjb.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe auxcagjb.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe auxcagjb.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe auxcagjb.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe auxcagjb.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe auxcagjb.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe auxcagjb.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe auxcagjb.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe auxcagjb.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe auxcagjb.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe auxcagjb.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe auxcagjb.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe auxcagjb.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe auxcagjb.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe auxcagjb.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe auxcagjb.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe auxcagjb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mckwwljmek.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language odrzvuphwbebbpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ajskujlxrpuuw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language auxcagjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language auxcagjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf mckwwljmek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" mckwwljmek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F76BB2FF1D21DCD209D0A68A789016" 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" mckwwljmek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg mckwwljmek.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs mckwwljmek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" mckwwljmek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "334E2C7B9C2282586D4476DC70552CAC7DF464AD" 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E89FF8D4F5A851A903DD72D7DE0BCE5E630584766426244D6EA" 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1938C60915E0DBC0B9BD7C90ECE737BC" 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat mckwwljmek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc mckwwljmek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" mckwwljmek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABAFAB0FE16F293840F3A44819B3999B388028F4314033BE1CC459908A8" 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FCAB02F44E6399A53CFBAD5329FD7C4" 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh mckwwljmek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" mckwwljmek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" mckwwljmek.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4584 WINWORD.EXE 4584 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 1476 mckwwljmek.exe 1476 mckwwljmek.exe 1476 mckwwljmek.exe 1476 mckwwljmek.exe 1476 mckwwljmek.exe 1476 mckwwljmek.exe 1476 mckwwljmek.exe 1476 mckwwljmek.exe 1476 mckwwljmek.exe 1476 mckwwljmek.exe 1988 odrzvuphwbebbpb.exe 1988 odrzvuphwbebbpb.exe 1988 odrzvuphwbebbpb.exe 1988 odrzvuphwbebbpb.exe 1988 odrzvuphwbebbpb.exe 1988 odrzvuphwbebbpb.exe 1988 odrzvuphwbebbpb.exe 1988 odrzvuphwbebbpb.exe 1988 odrzvuphwbebbpb.exe 1988 odrzvuphwbebbpb.exe 936 ajskujlxrpuuw.exe 936 ajskujlxrpuuw.exe 936 ajskujlxrpuuw.exe 936 ajskujlxrpuuw.exe 936 ajskujlxrpuuw.exe 936 ajskujlxrpuuw.exe 936 ajskujlxrpuuw.exe 936 ajskujlxrpuuw.exe 936 ajskujlxrpuuw.exe 936 ajskujlxrpuuw.exe 936 ajskujlxrpuuw.exe 936 ajskujlxrpuuw.exe 3148 auxcagjb.exe 3148 auxcagjb.exe 3148 auxcagjb.exe 3148 auxcagjb.exe 3148 auxcagjb.exe 3148 auxcagjb.exe 3148 auxcagjb.exe 3148 auxcagjb.exe 4708 auxcagjb.exe 4708 auxcagjb.exe 4708 auxcagjb.exe 4708 auxcagjb.exe 4708 auxcagjb.exe 4708 auxcagjb.exe 4708 auxcagjb.exe 4708 auxcagjb.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 1476 mckwwljmek.exe 1476 mckwwljmek.exe 1476 mckwwljmek.exe 1988 odrzvuphwbebbpb.exe 1988 odrzvuphwbebbpb.exe 1988 odrzvuphwbebbpb.exe 936 ajskujlxrpuuw.exe 936 ajskujlxrpuuw.exe 936 ajskujlxrpuuw.exe 3148 auxcagjb.exe 3148 auxcagjb.exe 3148 auxcagjb.exe 4708 auxcagjb.exe 4708 auxcagjb.exe 4708 auxcagjb.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 1476 mckwwljmek.exe 1476 mckwwljmek.exe 1476 mckwwljmek.exe 1988 odrzvuphwbebbpb.exe 1988 odrzvuphwbebbpb.exe 1988 odrzvuphwbebbpb.exe 936 ajskujlxrpuuw.exe 936 ajskujlxrpuuw.exe 936 ajskujlxrpuuw.exe 3148 auxcagjb.exe 3148 auxcagjb.exe 3148 auxcagjb.exe 4708 auxcagjb.exe 4708 auxcagjb.exe 4708 auxcagjb.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4584 WINWORD.EXE 4584 WINWORD.EXE 4584 WINWORD.EXE 4584 WINWORD.EXE 4584 WINWORD.EXE 4584 WINWORD.EXE 4584 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 640 wrote to memory of 1476 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 86 PID 640 wrote to memory of 1476 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 86 PID 640 wrote to memory of 1476 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 86 PID 640 wrote to memory of 1988 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 87 PID 640 wrote to memory of 1988 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 87 PID 640 wrote to memory of 1988 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 87 PID 640 wrote to memory of 3148 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 88 PID 640 wrote to memory of 3148 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 88 PID 640 wrote to memory of 3148 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 88 PID 640 wrote to memory of 936 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 89 PID 640 wrote to memory of 936 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 89 PID 640 wrote to memory of 936 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 89 PID 640 wrote to memory of 4584 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 90 PID 640 wrote to memory of 4584 640 2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe 90 PID 1476 wrote to memory of 4708 1476 mckwwljmek.exe 92 PID 1476 wrote to memory of 4708 1476 mckwwljmek.exe 92 PID 1476 wrote to memory of 4708 1476 mckwwljmek.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2dd31c97b7ab68472ee856e223b6b393_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\mckwwljmek.exemckwwljmek.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\auxcagjb.exeC:\Windows\system32\auxcagjb.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4708
-
-
-
C:\Windows\SysWOW64\odrzvuphwbebbpb.exeodrzvuphwbebbpb.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1988
-
-
C:\Windows\SysWOW64\auxcagjb.exeauxcagjb.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3148
-
-
C:\Windows\SysWOW64\ajskujlxrpuuw.exeajskujlxrpuuw.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:936
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4584
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD530b4ee6ad00e86399b8bbb4d362c9049
SHA13aaa3a083a12ae77442a7ec54f70dfa3e6b2833a
SHA2564fb173cf4255f889925a2de5bef69f1cdc46fbf4d4e4fff88dcff7e584765aef
SHA512f1fe5719ee60ea4f15de13b6e21dca104248ffb980772c719703b7054a97b752185b6682c771d8f3522a485ca3517a8d639deab38b659dc41c218ee0b231bf26
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
245B
MD5d905b42072960fd0806cd656a6bab995
SHA156415566a15fd1fdcc06e48784860c5c9c7acfe3
SHA2568204d249a42562880fc53a26662fa255f84517dcfdf11b7899b59f3292b0b38c
SHA512c6bd2794651700212dbda48cba11d8342ee2637ec84176895e3db70bcd9b3c6256eb541012350e3f01d446e4d5d1ff87c13727cdc3a3c268556d05faf2f21df6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize1KB
MD55768d8ec902954cf68fc1dc8a1501e05
SHA100be9d29f9ce674119c3930ead76f33fc3b72c95
SHA2569ae89cde045d7a2e57998cb261c38d308c7aa3f023d11b820612439e43931be7
SHA512e04f654371a2759d26fb7615bbaca751daa51ad64ab0042175cc13a37382f050502c59b9c6c0d625487ee8a18726e4b6eef16a58e26bf8b0957ac302a02f7ff4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize1KB
MD59419d023205b3f5a3909b2c143177e92
SHA1a5d8319103c85632a921adbf519029e048b3a9ca
SHA2562e5b9b458cb70f477460b5606e7401d8343810b46b9193bb654fadd31576b508
SHA512ddbb6c22ef1c062f89f6bd1eb2401a7fb9e116eccfc77a4d61c7d36db3000441b7bf4ea8ecd0315de2456bdd16bf556e670b1694a00c18613a49176ff2826c72
-
Filesize
255KB
MD5a92121851012782b88a300760bc9b091
SHA10a309fc174d5ee11ad89aa2be1d4620313dc5dd3
SHA2565c428a927bb044b7ab2c40bdc43c68ebba976be6ee8fb8a399c3d3494eefdd4a
SHA5126924560bf484e473732511ffe408610acd5567d34ef1fbbdafb1a9c86f16b02929577944e9f92b3059af1ffbf8daf15e12342cb63983aeaa71ed5b55ef40960e
-
Filesize
255KB
MD53d03172456922bbbe7caee23b8bd4bce
SHA1722d7df66a9280c6653856afc217d5625d063f7c
SHA256f214002874c4b262bb55d5b1fa1e5147622bc94842043fd64c3ab6460e27c1a5
SHA5125cfc5429fbc209dcf84dff3b2691da7c3fca3c11cf726aeef61c426aeb25271122b62a18ba650c31237268688e8b9771843b081c84d7eb88454a6d85bc74aef7
-
Filesize
255KB
MD553a200d612fd20e3e7ba7eea69186691
SHA17b4b1d2f392dda7fb78bf6aae8306d580bb19978
SHA2567243ee7599186def16cf12c69dea11bf1f7f2dbce06b4ea86d674cefbfebfade
SHA512750ba97ec3fd5565e2503e2436dc381d525c711f0074d6ad2dae8921e59ed8f5510ec9b1a949dd3d40ede061b342bf68ab014f0d1bc05dc039811a47bd1faf08
-
Filesize
255KB
MD5c03f3163424dc73200fb8842ed14a056
SHA10403906cc7eb7b10c9c372a3af59822b7e75a7af
SHA2565a1856842f77f9847f7b7345a9533f2e30a7969566a75f2a60b88ea09ca94263
SHA512d34c9b0a784516572e9195b43a8dce0c7084193e37c5d4e046248b7cf9a060ff020b966db1651b910f7937e14e623c2126c36d9c6cbabf4de110539837d12cde
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD52359477c6de342287a6e92c869bb64d8
SHA134da07e4ddade887d31a64967a742f7feb6f8876
SHA2564708b8e861e62afd6dee7f27e0a9d1d87b1204bf38cf9db94219f8fe21db8cea
SHA5128d55a0cb55c38128df34d2e43b5ddc2488a0de0d62de7cad1e49fcd33e40d053d82268feac9d791bede3ada31e8f891297632dad2312c91e01cfa2079606e7a6
-
Filesize
255KB
MD52bb6dccb9a23e0f624c0e8f0b7e127a4
SHA1ca9cfe9a110d53e491e8687045d63629bceb7fdb
SHA2560712cd516ec5f5f7a8029f926e5a0bad819e93e3ba5ce9141492f41a175ef1cc
SHA512660304f2dd908f37ee58a24136c6b86465bd9de8c9b5bfacb3afdf8c1adc7e97ac97a1657ddfa87742d2004293c024304f6deaedcf7bf1fe374f318abb8efa4c