Overview
overview
7Static
static
3ea531aaff6...18.exe
windows7-x64
7ea531aaff6...18.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$SYSDIR/$S...4_.exe
windows7-x64
7$SYSDIR/$S...4_.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMP/$_8_.dll
windows7-x64
6$TEMP/$_8_.dll
windows10-2004-x64
6Analysis
- max time kernel
147s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240319-en - resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system - submitted
09/04/2024, 15:37
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe
Resource
win10v2004-20240319-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$SYSDIR/$SYSDIR/$_14_.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
$SYSDIR/$SYSDIR/$_14_.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
$TEMP/$_8_.dll
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral12
Sample
$TEMP/$_8_.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe
- Size 194KB
- Sample240409-s2zclaee3t
- SHA256 7bfa96ea7e2f70c3fdee3ce490a283b82a02e8e2f4ca724fc98cf70f90d8b92f
- MD5 ea531aaff6bd48a85fd2487979af5d6b
- SHA1 d9f39bbdbbfbcf0f2b677d142adde921b42861ce
- SHA512 b622d4258c96ea855cb7773d0d703c74836a1223fce85f7711acb898e5cd67bb0c912c31cc65496c949bb8d5680905529fb458de2d67e9da2ab540f1c1caff8e
- SSDEEP 6144:HwRidvldbA6T+Xn8cTAGFD5tfQoF9pACA6A5Jgqsms:M2ldbQXzdrfQa8Cbggqe
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 6 IoCs
pid Process 2932 ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe 2932 ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe 2932 ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe 2932 ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe 2932 ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe 3036 regsvr32.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pxspkjsklwo = "C:\\Windows\\System32\\regsvr32.exe /s \"C:\\Users\\Admin\\AppData\\Local\\Temp\\oolalcfmmwlgugdlc.DLL\"" ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pxspkjsklwo = "C:\\Windows\\System32\\regsvr32.exe /s \"C:\\Windows\\system32\\oolalcfmmwlgugdlc.dll\"" regsvr32.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{09BF5B3F-8E6E-9546-B8C5-B279CBE065EA} ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{09BF5B3F-8E6E-9546-B8C5-B279CBE065EA}\NoExplorer = "1" ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{09BF5B3F-8E6E-9546-B8C5-B279CBE065EA} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{09BF5B3F-8E6E-9546-B8C5-B279CBE065EA}\NoExplorer = "1" regsvr32.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\gzjzyunxut.exe ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4274807967" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31099539" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d77b00948ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000516244317b44ad49b8c99564e34e94d3000000000200000000001066000000010000200000007a5d0891eafac50114413a0e6dad8389456edc59903193c6f58a173e21d3381b000000000e8000000002000020000000776199192492af895c112992a4d915162cbbdb71a361650f7b6e5cb89d31c1b62000000005b2f5d2745c0e78a9ccf0e31b91052346b71b313c35dfb0e76af499b3a7eb22400000006ec0d0c369b9502277100418603299d00c069f5f84d66c0489cc3f34249e1ad591c4f21558485a83b8aecee280cb7b2c0185c32dc4471eb5c071fef03510c1fa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419442064" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000516244317b44ad49b8c99564e34e94d3000000000200000000001066000000010000200000000a8e58a7f3c91822fe56cd53927b9c72430a02f65ea34cbd5f1f07f397151081000000000e8000000002000020000000db2e86bf9946a0e00416f6e92289ccce8a5831995fce9cbe105fc255e9c29adb20000000b6e937ff65b4e36a18834bd497782b93fbb9a9d9f4b60a7016a801571447c15640000000820c6a9b58146d8e7acee604b264977cd24487f75dafa2371f05efc94b43084648070ab64c9b6ad3f299c985740865ea2b2f5eee1aedee170308c564bd0a19e3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 000a6400948ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2A43D72E-F687-11EE-BC8C-FE6E3BEDC3EA} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4274807967" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31099539" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4281058422" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31099539" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe - Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09BF5B3F-8E6E-9546-B8C5-B279CBE065EA}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09BF5B3F-8E6E-9546-B8C5-B279CBE065EA}\InProcServer32\ = "C:\\Windows\\SysWow64\\oolalcfmmwlgugdlc.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09BF5B3F-8E6E-9546-B8C5-B279CBE065EA} ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09BF5B3F-8E6E-9546-B8C5-B279CBE065EA}\ = "du-little browser enhancer" ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09BF5B3F-8E6E-9546-B8C5-B279CBE065EA} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09BF5B3F-8E6E-9546-B8C5-B279CBE065EA}\ = "du-little browser enhancer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09BF5B3F-8E6E-9546-B8C5-B279CBE065EA}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09BF5B3F-8E6E-9546-B8C5-B279CBE065EA}\InProcServer32 ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09BF5B3F-8E6E-9546-B8C5-B279CBE065EA}\InProcServer32\ThreadingModel = "Apartment" ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09BF5B3F-8E6E-9546-B8C5-B279CBE065EA}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oolalcfmmwlgugdlc.DLL" ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4596 iexplore.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4596 iexplore.exe 4596 iexplore.exe 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2932 wrote to memory of 3036 2932 ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe 97 PID 2932 wrote to memory of 3036 2932 ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe 97 PID 2932 wrote to memory of 3036 2932 ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe 97 PID 4596 wrote to memory of 2856 4596 iexplore.exe 100 PID 4596 wrote to memory of 2856 4596 iexplore.exe 100 PID 4596 wrote to memory of 2856 4596 iexplore.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\oolalcfmmwlgugdlc.dll"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:3036
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:1400
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4596 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1412 --field-trial-handle=2256,i,16750283575152780128,2524258836761969159,262144 --variations-seed-version /prefetch:81⤵PID:4124
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2GELVT35\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsp7939.tmp\System.dll
- Size 10KB
- SHA256 91c47a9a54a3a8c359e89a8b4e133e6b7296586748ed3e8f4fe566abd6c81ddd
- MD5 7e3c808299aa2c405dffa864471ddb7f
- SHA1 b5de7804dd35ed7afd0c3b59d866f1a0749495e0
- SHA512 599f61d5270227a68e5c4b8db41b5aa7bc17a4bbe91dd7336b410516fa6107f4f5bf0bbb3f6cc4b2e15b16bf9495fdc70832bab6262046cb136ad18f0c9b3738
- SSDEEP 192:LO6dJA/ruAFEiUdWWE6hsD4YUdJfbub1awgMO:SKAFERdlxhTYUzqZaw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\oolalcfmmwlgugdlc.dll
- Size 381KB
- SHA256 13e04a3fc70b4215feb1c4d01d74a1084d2248caa6196ff4ba91d196095c90c1
- MD5 b194d282bb6b81ecfdea7a44f9cd0d8d
- SHA1 372fa3b4f01fe7979472db8ba59e2ece7053fdb8
- SHA512 1fd0ce9bb35e0a9b28be04d86120cf87f9de436835b0f98409dde5e1dd104ca575fc3da5744209cbadf0be75451571241ead5d1e79e2daf2a43b4a2163e57062
- SSDEEP 6144:rgxECaD3NFLzhrvhayIvR+z8SndYFN1y2antUIYucX5ZLKI4j:rgxxaDn3hrpayIvR+A+dYFN1y2aCIYug
- MD5 SHA1 SHA512 SSDEEP