Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2024, 00:03
Behavioral task
behavioral1
Sample
44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe
Resource
win7-20241010-en
windows7-x64
26 signatures
150 seconds
General
-
Target
44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe
-
Size
255KB
-
MD5
44d56ece23d45d0c57e7f6ab498ea640
-
SHA1
75f714e5f09ea679ecf9d6894093a403682b1d60
-
SHA256
ea4d1ab1cf391c2ecfcd7b4c8fd7fd79ad7b89539606ec236e4f532204818752
-
SHA512
c3c6a7a38ed848d508871dab669d543fb9461bc56d89b81d2edf79fdb8a5c8813c1d727caa638e888d396a41423e46b57a5b032621918018e7b9caadcf9a7c9a
-
SSDEEP
6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6w:Plf5j6zCNa0xeE3md
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" jzehtjdlex.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jzehtjdlex.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" jzehtjdlex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" jzehtjdlex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" jzehtjdlex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" jzehtjdlex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" jzehtjdlex.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" jzehtjdlex.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe -
Executes dropped EXE 5 IoCs
pid Process 3616 jzehtjdlex.exe 1580 fvjwuylduvwkvzg.exe 3080 deyuvbqx.exe 5016 jafwzraotxgid.exe 4072 deyuvbqx.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" jzehtjdlex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" jzehtjdlex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" jzehtjdlex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" jzehtjdlex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" jzehtjdlex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" jzehtjdlex.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iupkhbkc = "jzehtjdlex.exe" fvjwuylduvwkvzg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wsxkxcuu = "fvjwuylduvwkvzg.exe" fvjwuylduvwkvzg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "jafwzraotxgid.exe" fvjwuylduvwkvzg.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\n: deyuvbqx.exe File opened (read-only) \??\g: deyuvbqx.exe File opened (read-only) \??\b: jzehtjdlex.exe File opened (read-only) \??\j: jzehtjdlex.exe File opened (read-only) \??\o: jzehtjdlex.exe File opened (read-only) \??\u: jzehtjdlex.exe File opened (read-only) \??\q: deyuvbqx.exe File opened (read-only) \??\g: jzehtjdlex.exe File opened (read-only) \??\q: deyuvbqx.exe File opened (read-only) \??\m: deyuvbqx.exe File opened (read-only) \??\p: deyuvbqx.exe File opened (read-only) \??\r: jzehtjdlex.exe File opened (read-only) \??\y: jzehtjdlex.exe File opened (read-only) \??\i: deyuvbqx.exe File opened (read-only) \??\t: deyuvbqx.exe File opened (read-only) \??\x: jzehtjdlex.exe File opened (read-only) \??\e: deyuvbqx.exe File opened (read-only) \??\z: deyuvbqx.exe File opened (read-only) \??\v: deyuvbqx.exe File opened (read-only) \??\h: jzehtjdlex.exe File opened (read-only) \??\i: jzehtjdlex.exe File opened (read-only) \??\n: jzehtjdlex.exe File opened (read-only) \??\h: deyuvbqx.exe File opened (read-only) \??\s: jzehtjdlex.exe File opened (read-only) \??\t: jzehtjdlex.exe File opened (read-only) \??\w: jzehtjdlex.exe File opened (read-only) \??\s: deyuvbqx.exe File opened (read-only) \??\a: deyuvbqx.exe File opened (read-only) \??\k: deyuvbqx.exe File opened (read-only) \??\l: deyuvbqx.exe File opened (read-only) \??\k: jzehtjdlex.exe File opened (read-only) \??\g: deyuvbqx.exe File opened (read-only) \??\v: deyuvbqx.exe File opened (read-only) \??\y: deyuvbqx.exe File opened (read-only) \??\l: jzehtjdlex.exe File opened (read-only) \??\p: jzehtjdlex.exe File opened (read-only) \??\b: deyuvbqx.exe File opened (read-only) \??\r: deyuvbqx.exe File opened (read-only) \??\e: jzehtjdlex.exe File opened (read-only) \??\v: jzehtjdlex.exe File opened (read-only) \??\l: deyuvbqx.exe File opened (read-only) \??\u: deyuvbqx.exe File opened (read-only) \??\y: deyuvbqx.exe File opened (read-only) \??\i: deyuvbqx.exe File opened (read-only) \??\n: deyuvbqx.exe File opened (read-only) \??\q: jzehtjdlex.exe File opened (read-only) \??\m: deyuvbqx.exe File opened (read-only) \??\s: deyuvbqx.exe File opened (read-only) \??\u: deyuvbqx.exe File opened (read-only) \??\a: jzehtjdlex.exe File opened (read-only) \??\a: deyuvbqx.exe File opened (read-only) \??\t: deyuvbqx.exe File opened (read-only) \??\w: deyuvbqx.exe File opened (read-only) \??\o: deyuvbqx.exe File opened (read-only) \??\x: deyuvbqx.exe File opened (read-only) \??\z: deyuvbqx.exe File opened (read-only) \??\k: deyuvbqx.exe File opened (read-only) \??\p: deyuvbqx.exe File opened (read-only) \??\e: deyuvbqx.exe File opened (read-only) \??\j: deyuvbqx.exe File opened (read-only) \??\r: deyuvbqx.exe File opened (read-only) \??\m: jzehtjdlex.exe File opened (read-only) \??\b: deyuvbqx.exe File opened (read-only) \??\w: deyuvbqx.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" jzehtjdlex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" jzehtjdlex.exe -
AutoIT Executable 64 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3616-25-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5016-32-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3080-31-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4060-35-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4072-44-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3616-81-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1580-82-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5016-84-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3080-83-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3616-85-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3080-87-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5016-88-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1580-86-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4072-92-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4072-91-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3616-553-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5016-556-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3080-555-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1580-554-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4072-566-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3616-577-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1580-578-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3080-579-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5016-580-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4072-581-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3616-582-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1580-583-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3080-584-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5016-585-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4072-586-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3616-587-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1580-588-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5016-590-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3080-589-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4072-591-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3616-594-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5016-597-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3080-596-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1580-595-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4072-599-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4072-603-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3080-602-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1580-607-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5016-608-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3616-606-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3616-609-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5016-611-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1580-610-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1580-613-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5016-614-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3616-612-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3616-615-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5016-617-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1580-616-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3616-618-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1580-619-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5016-620-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3616-621-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1580-622-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5016-623-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3616-624-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1580-625-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5016-626-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3616-627-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\deyuvbqx.exe 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe File created C:\Windows\SysWOW64\jafwzraotxgid.exe 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\jafwzraotxgid.exe 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe deyuvbqx.exe File created C:\Windows\SysWOW64\deyuvbqx.exe 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\jzehtjdlex.exe 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe File created C:\Windows\SysWOW64\fvjwuylduvwkvzg.exe 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fvjwuylduvwkvzg.exe 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll jzehtjdlex.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe deyuvbqx.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe deyuvbqx.exe File created C:\Windows\SysWOW64\jzehtjdlex.exe 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/4060-0-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000d000000023b64-19.dat upx behavioral2/files/0x000a000000023b68-24.dat upx behavioral2/files/0x000a000000023b6a-27.dat upx behavioral2/memory/3616-25-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000a000000023b69-29.dat upx behavioral2/memory/5016-32-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3080-31-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4060-35-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4072-44-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000a000000023b78-73.dat upx behavioral2/files/0x000b000000023b5b-67.dat upx behavioral2/memory/3616-81-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1580-82-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5016-84-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3080-83-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3616-85-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3080-87-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5016-88-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1580-86-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4072-92-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4072-91-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3616-553-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5016-556-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3080-555-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1580-554-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4072-566-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x001a000000023c46-571.dat upx behavioral2/files/0x001a000000023c46-575.dat upx behavioral2/memory/3616-577-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1580-578-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3080-579-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5016-580-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4072-581-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3616-582-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1580-583-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3080-584-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5016-585-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4072-586-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3616-587-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1580-588-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5016-590-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3080-589-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4072-591-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3616-594-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5016-597-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3080-596-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1580-595-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4072-599-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4072-603-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3080-602-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1580-607-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5016-608-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3616-606-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3616-609-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5016-611-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1580-610-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1580-613-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5016-614-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3616-612-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3616-615-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5016-617-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1580-616-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3616-618-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe deyuvbqx.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe deyuvbqx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal deyuvbqx.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe deyuvbqx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe deyuvbqx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe deyuvbqx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal deyuvbqx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe deyuvbqx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe deyuvbqx.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe deyuvbqx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal deyuvbqx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal deyuvbqx.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe deyuvbqx.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe deyuvbqx.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe deyuvbqx.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe deyuvbqx.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe deyuvbqx.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe deyuvbqx.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe deyuvbqx.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe deyuvbqx.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe deyuvbqx.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe deyuvbqx.exe File opened for modification C:\Windows\mydoc.rtf 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe deyuvbqx.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe deyuvbqx.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe deyuvbqx.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe deyuvbqx.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe deyuvbqx.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe deyuvbqx.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe deyuvbqx.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe deyuvbqx.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jzehtjdlex.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jafwzraotxgid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language deyuvbqx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvjwuylduvwkvzg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language deyuvbqx.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh jzehtjdlex.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc jzehtjdlex.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs jzehtjdlex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ACAF9C9F967F2E784753A3186973995B38A038B42160332E2C845EA08D4" 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" jzehtjdlex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" jzehtjdlex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E78168B0FF1F21AAD278D0D38A0B9110" 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193EC70B1493DAB0B9CC7CE7ECE237CC" 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat jzehtjdlex.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf jzehtjdlex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" jzehtjdlex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB0B12F44E7389852C8BAD033EDD4CE" 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33302D0D9C2C83576D4176A170222CAB7DF465A8" 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFBFFF94826826F9032D65A7D94BDE2E636583067406337D790" 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" jzehtjdlex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" jzehtjdlex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" jzehtjdlex.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg jzehtjdlex.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2208 WINWORD.EXE 2208 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 3616 jzehtjdlex.exe 3616 jzehtjdlex.exe 3616 jzehtjdlex.exe 3616 jzehtjdlex.exe 3616 jzehtjdlex.exe 3616 jzehtjdlex.exe 3616 jzehtjdlex.exe 3616 jzehtjdlex.exe 3616 jzehtjdlex.exe 3616 jzehtjdlex.exe 3080 deyuvbqx.exe 3080 deyuvbqx.exe 3080 deyuvbqx.exe 3080 deyuvbqx.exe 3080 deyuvbqx.exe 3080 deyuvbqx.exe 3080 deyuvbqx.exe 3080 deyuvbqx.exe 5016 jafwzraotxgid.exe 5016 jafwzraotxgid.exe 5016 jafwzraotxgid.exe 5016 jafwzraotxgid.exe 5016 jafwzraotxgid.exe 5016 jafwzraotxgid.exe 5016 jafwzraotxgid.exe 5016 jafwzraotxgid.exe 5016 jafwzraotxgid.exe 5016 jafwzraotxgid.exe 5016 jafwzraotxgid.exe 5016 jafwzraotxgid.exe 1580 fvjwuylduvwkvzg.exe 1580 fvjwuylduvwkvzg.exe 1580 fvjwuylduvwkvzg.exe 1580 fvjwuylduvwkvzg.exe 1580 fvjwuylduvwkvzg.exe 1580 fvjwuylduvwkvzg.exe 1580 fvjwuylduvwkvzg.exe 1580 fvjwuylduvwkvzg.exe 1580 fvjwuylduvwkvzg.exe 1580 fvjwuylduvwkvzg.exe 4072 deyuvbqx.exe 4072 deyuvbqx.exe 4072 deyuvbqx.exe 4072 deyuvbqx.exe 4072 deyuvbqx.exe 4072 deyuvbqx.exe 4072 deyuvbqx.exe 4072 deyuvbqx.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 3616 jzehtjdlex.exe 3080 deyuvbqx.exe 3616 jzehtjdlex.exe 3616 jzehtjdlex.exe 3080 deyuvbqx.exe 3080 deyuvbqx.exe 5016 jafwzraotxgid.exe 5016 jafwzraotxgid.exe 5016 jafwzraotxgid.exe 1580 fvjwuylduvwkvzg.exe 1580 fvjwuylduvwkvzg.exe 1580 fvjwuylduvwkvzg.exe 4072 deyuvbqx.exe 4072 deyuvbqx.exe 4072 deyuvbqx.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 3616 jzehtjdlex.exe 3080 deyuvbqx.exe 3616 jzehtjdlex.exe 3616 jzehtjdlex.exe 3080 deyuvbqx.exe 3080 deyuvbqx.exe 5016 jafwzraotxgid.exe 5016 jafwzraotxgid.exe 5016 jafwzraotxgid.exe 1580 fvjwuylduvwkvzg.exe 1580 fvjwuylduvwkvzg.exe 1580 fvjwuylduvwkvzg.exe 4072 deyuvbqx.exe 4072 deyuvbqx.exe 4072 deyuvbqx.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2208 WINWORD.EXE 2208 WINWORD.EXE 2208 WINWORD.EXE 2208 WINWORD.EXE 2208 WINWORD.EXE 2208 WINWORD.EXE 2208 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4060 wrote to memory of 3616 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 84 PID 4060 wrote to memory of 3616 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 84 PID 4060 wrote to memory of 3616 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 84 PID 4060 wrote to memory of 1580 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 85 PID 4060 wrote to memory of 1580 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 85 PID 4060 wrote to memory of 1580 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 85 PID 4060 wrote to memory of 3080 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 86 PID 4060 wrote to memory of 3080 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 86 PID 4060 wrote to memory of 3080 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 86 PID 4060 wrote to memory of 5016 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 87 PID 4060 wrote to memory of 5016 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 87 PID 4060 wrote to memory of 5016 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 87 PID 4060 wrote to memory of 2208 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 89 PID 4060 wrote to memory of 2208 4060 44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe 89 PID 3616 wrote to memory of 4072 3616 jzehtjdlex.exe 91 PID 3616 wrote to memory of 4072 3616 jzehtjdlex.exe 91 PID 3616 wrote to memory of 4072 3616 jzehtjdlex.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\44d56ece23d45d0c57e7f6ab498ea640_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\jzehtjdlex.exejzehtjdlex.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\SysWOW64\deyuvbqx.exeC:\Windows\system32\deyuvbqx.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4072
-
-
-
C:\Windows\SysWOW64\fvjwuylduvwkvzg.exefvjwuylduvwkvzg.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1580
-
-
C:\Windows\SysWOW64\deyuvbqx.exedeyuvbqx.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3080
-
-
C:\Windows\SysWOW64\jafwzraotxgid.exejafwzraotxgid.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5016
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2208
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD592a6e49a971206cbe7b1f549423f6e03
SHA1e6e7540b8b6f99ade1de436b1f2bbabc8e9b2765
SHA25691c726cd3474701022ef0c6370ecb67e1f528cb554368e0e49e814821df58122
SHA512ef206d7fb042b6e90848cff2a757a5ae538ffdd7bbdd0b6886da8ac90923f5e560ef460500c8e886261016290b3b775be19ed260c17c4c3ea4fc382553b2a10a
-
Filesize
255KB
MD5ad2c3533f8d9629d333aed73a476cb84
SHA1e985a3f028a61b777bb47a1c127895208163f93f
SHA2568423354d0104e3f6329c4384d94286403f1d911c6f1b26f69afa48f29110eb05
SHA512fe2112cd7678c1abbd0d9b034861843e335d77225c0c7d7d72806d23328aa37677f0718338ca5f11b582c1607df2dcdc5c844ca0ff34f73da4d2e167d91ca04f
-
Filesize
344B
MD58d24315d203378f8ef7f8177284de374
SHA1d357c466b157e28b01213ff41cc2682437c6126c
SHA25651c0d07ebe114b47df7ff52aae0fd85024318a52c3cf27672ac713cd256edc99
SHA512fe6451ff809454e7834d612fd8ca246389ecdd249b955bffdeca5b8b2ceeb4e68c6823f365c1832fa27b20d0868ad19b56d378fa6f0655f4c647fa2728cf12ca
-
Filesize
16B
MD5d29962abc88624befc0135579ae485ec
SHA1e40a6458296ec6a2427bcb280572d023a9862b31
SHA256a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
SHA5124311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize1KB
MD5f58bb370cd87a045fd8679cdab4f3826
SHA1a581ca207f3584c37e86f1ef2f7b6f00d53bdfb5
SHA2564775573917a8bd7a5bc4969522d8141e4e437e36591d487b11a45ef2f8687151
SHA5122b704abeb9a852f409e31cf7e34f774018f086f7e9963a9679bbc076d6c1893d0c5bdebb819c15f93473dfd7ece6f12d294f3201269d79892d4e96bd7ec72f36
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize2KB
MD573c34dc18a92359651315f1157aa3697
SHA14ca5dbbd3b4169891bae2b38be942a657e4b9161
SHA256681c7b1be09f52834468b29d40744be83d44eaf53c8d77879902386f94cc9eec
SHA512af514f8469d28a20d9d9c3e41cf81a0a896168d593a4bcf7450eb196bef01c84103ded0606c5e26e6f08b24f64a54b8488d146a396b05dfb9162ad88f47cd409
-
Filesize
255KB
MD5b3d1cee3522d4a12c026b0eea6b4fc9f
SHA1a54d8c7e09d4ecd575cd0361e203d00e28b7881d
SHA2567bd102e23da9b5d39cac398184a9127a9bac285a2c40cbf003978549719ebeb4
SHA5129bb961239d808813b3d15651eff8994d03ecc41ca3d5224a0b4d49bcb05f36e98882e0ea9a7be39decb5e8f520ad943a1588356ad3f183f1f4ec05fa56a06ff1
-
Filesize
255KB
MD5a11b4a792d0d78adc1d8658b9ca9da9d
SHA1150c11533e17bd61fa2bd7e22bef44fdd83970ab
SHA2563405d106d5c96a6dfb588370d2e200130aa90ca6bc608f0f6fd8171a6bf6c6fb
SHA51291957fb74132b1f72eb67e7ad275a9e8bd04d9bc8d9785ff5d8a3642714204a495c7d5c1fed54155c1c7ffb2b7687096dc028071fdc72347893840d4cae8b42b
-
Filesize
255KB
MD534ef808da35c52d4a6cefff4fa065a48
SHA16b363424d75cc5b459ea9e5f8684d6e0c2d21c33
SHA2566ef0eba32c7f0226410cfbdbb7a0c5e35ad45375b3bbc029850026344f01bb8e
SHA512893c813d74f36563779249bcc424c2764eec265586220c0a66b93990d79e4d71a936eac4e0b8ff3609f08f273ac3771b1f75337b51b8bbde2b425aa62f3d0020
-
Filesize
255KB
MD58d033a6e77f193a28207f5728bb72cd9
SHA1593f373cf5a729dacf864e3fe0f2524bcf5fbd40
SHA2568e1ffa950ac563e2ec62cb929649518dab22d7e73bbd6e3af8ed45acdb7874a7
SHA512da2559fe81f3f626f298c8c8ea461dfe28b221907265c8c80cefc5f36d2557da9857b957e6d872f5d67d153c2f1a8539e5e051d57886867f0931a1c4b30b42c5
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD530f9ae1b33a3c313007c09e0a6556056
SHA1f7f5b3cdebc910e45df0d4da600d12c63a3150eb
SHA25642f94296eafce80248ec1ae77575c69e635c428f3523ff19cb592b35adc86cd1
SHA512c6b2cfa33b32b2c35d4c14cd0f9602f15bd37e199d641b0c54de361ece0f458720ade92f4e6972ac17d5669836f5194c88e269df7c2572b77e58cb61ac4dab63
-
Filesize
255KB
MD57f986a65e0a5164b83c92877e3bc0e91
SHA16af9f712fc672eed53cb323255deebb6bf9dc48b
SHA2567ca4f227a71d73c23036d96a6bd6e37f68e1d6e5e1183a43515b515a7d6aa8a1
SHA51251faaf38eb359ece861b0aa687a045cf586ea3f7667c77acaff9c54f5e3049dfea35575f877cb4e405eed3982e070572627e63763140b610e082e452ea13077d