Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/04/2024, 10:55
Static task
static1
Behavioral task
behavioral1
Sample
ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe
-
Size
512KB
-
MD5
ed41a69b8fbfbdee0148eba63b9c6e01
-
SHA1
f67434b508c5eed439f835407e228e8502585786
-
SHA256
cc3e5058ac37e5db39fa7e4ea00e44ec20f06400a3ea2e4930da4cadf77b2546
-
SHA512
15ec8b4857834c9bff2eb44eec9e7791c8811f5568862ed0f263b54681e65c9f40c33bc33d62d3e98337e5466e29ebdea04a3a5b6c62f81c0410608c109edbca
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6k:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5t
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" mmdgzjrqgy.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" mmdgzjrqgy.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" mmdgzjrqgy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" mmdgzjrqgy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" mmdgzjrqgy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" mmdgzjrqgy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" mmdgzjrqgy.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" mmdgzjrqgy.exe -
Executes dropped EXE 5 IoCs
pid Process 2980 mmdgzjrqgy.exe 2556 uwzofzunhzowazi.exe 2636 gqzdfbkj.exe 2100 kktrzmsmvyjju.exe 2736 gqzdfbkj.exe -
Loads dropped DLL 5 IoCs
pid Process 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 2980 mmdgzjrqgy.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" mmdgzjrqgy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" mmdgzjrqgy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" mmdgzjrqgy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" mmdgzjrqgy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" mmdgzjrqgy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" mmdgzjrqgy.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tpkooiaz = "mmdgzjrqgy.exe" uwzofzunhzowazi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bklgtnar = "uwzofzunhzowazi.exe" uwzofzunhzowazi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "kktrzmsmvyjju.exe" uwzofzunhzowazi.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\a: gqzdfbkj.exe File opened (read-only) \??\e: gqzdfbkj.exe File opened (read-only) \??\g: gqzdfbkj.exe File opened (read-only) \??\l: gqzdfbkj.exe File opened (read-only) \??\g: mmdgzjrqgy.exe File opened (read-only) \??\r: mmdgzjrqgy.exe File opened (read-only) \??\s: gqzdfbkj.exe File opened (read-only) \??\u: gqzdfbkj.exe File opened (read-only) \??\v: mmdgzjrqgy.exe File opened (read-only) \??\x: mmdgzjrqgy.exe File opened (read-only) \??\l: gqzdfbkj.exe File opened (read-only) \??\n: gqzdfbkj.exe File opened (read-only) \??\r: gqzdfbkj.exe File opened (read-only) \??\w: gqzdfbkj.exe File opened (read-only) \??\q: mmdgzjrqgy.exe File opened (read-only) \??\k: gqzdfbkj.exe File opened (read-only) \??\q: gqzdfbkj.exe File opened (read-only) \??\j: gqzdfbkj.exe File opened (read-only) \??\q: gqzdfbkj.exe File opened (read-only) \??\l: mmdgzjrqgy.exe File opened (read-only) \??\b: gqzdfbkj.exe File opened (read-only) \??\v: gqzdfbkj.exe File opened (read-only) \??\i: gqzdfbkj.exe File opened (read-only) \??\x: gqzdfbkj.exe File opened (read-only) \??\t: mmdgzjrqgy.exe File opened (read-only) \??\o: gqzdfbkj.exe File opened (read-only) \??\p: gqzdfbkj.exe File opened (read-only) \??\z: gqzdfbkj.exe File opened (read-only) \??\y: gqzdfbkj.exe File opened (read-only) \??\b: mmdgzjrqgy.exe File opened (read-only) \??\e: mmdgzjrqgy.exe File opened (read-only) \??\z: mmdgzjrqgy.exe File opened (read-only) \??\x: gqzdfbkj.exe File opened (read-only) \??\b: gqzdfbkj.exe File opened (read-only) \??\s: mmdgzjrqgy.exe File opened (read-only) \??\p: gqzdfbkj.exe File opened (read-only) \??\u: mmdgzjrqgy.exe File opened (read-only) \??\m: gqzdfbkj.exe File opened (read-only) \??\t: gqzdfbkj.exe File opened (read-only) \??\w: gqzdfbkj.exe File opened (read-only) \??\o: gqzdfbkj.exe File opened (read-only) \??\t: gqzdfbkj.exe File opened (read-only) \??\u: gqzdfbkj.exe File opened (read-only) \??\a: mmdgzjrqgy.exe File opened (read-only) \??\k: mmdgzjrqgy.exe File opened (read-only) \??\k: gqzdfbkj.exe File opened (read-only) \??\h: mmdgzjrqgy.exe File opened (read-only) \??\o: mmdgzjrqgy.exe File opened (read-only) \??\i: mmdgzjrqgy.exe File opened (read-only) \??\h: gqzdfbkj.exe File opened (read-only) \??\h: gqzdfbkj.exe File opened (read-only) \??\z: gqzdfbkj.exe File opened (read-only) \??\w: mmdgzjrqgy.exe File opened (read-only) \??\e: gqzdfbkj.exe File opened (read-only) \??\y: gqzdfbkj.exe File opened (read-only) \??\m: mmdgzjrqgy.exe File opened (read-only) \??\j: gqzdfbkj.exe File opened (read-only) \??\a: gqzdfbkj.exe File opened (read-only) \??\m: gqzdfbkj.exe File opened (read-only) \??\r: gqzdfbkj.exe File opened (read-only) \??\s: gqzdfbkj.exe File opened (read-only) \??\v: gqzdfbkj.exe File opened (read-only) \??\n: gqzdfbkj.exe File opened (read-only) \??\y: mmdgzjrqgy.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" mmdgzjrqgy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" mmdgzjrqgy.exe -
AutoIT Executable 8 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1924-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x0037000000016c26-9.dat autoit_exe behavioral1/files/0x0010000000012248-17.dat autoit_exe behavioral1/files/0x000b000000014319-21.dat autoit_exe behavioral1/files/0x0007000000016ced-37.dat autoit_exe behavioral1/files/0x0006000000018ffa-67.dat autoit_exe behavioral1/files/0x000500000001922d-73.dat autoit_exe behavioral1/files/0x0005000000019250-79.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\kktrzmsmvyjju.exe ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\kktrzmsmvyjju.exe ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mmdgzjrqgy.exe ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe File created C:\Windows\SysWOW64\uwzofzunhzowazi.exe ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe File created C:\Windows\SysWOW64\gqzdfbkj.exe ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\gqzdfbkj.exe ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe File created C:\Windows\SysWOW64\mmdgzjrqgy.exe ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\uwzofzunhzowazi.exe ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll mmdgzjrqgy.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe gqzdfbkj.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe gqzdfbkj.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe gqzdfbkj.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal gqzdfbkj.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal gqzdfbkj.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe gqzdfbkj.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe gqzdfbkj.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe gqzdfbkj.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe gqzdfbkj.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe gqzdfbkj.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal gqzdfbkj.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe gqzdfbkj.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe gqzdfbkj.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe gqzdfbkj.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal gqzdfbkj.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB5B02B44E4399F53C8BAD0329ED7CC" ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh mmdgzjrqgy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" mmdgzjrqgy.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs mmdgzjrqgy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" mmdgzjrqgy.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" mmdgzjrqgy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2464 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 2980 mmdgzjrqgy.exe 2980 mmdgzjrqgy.exe 2980 mmdgzjrqgy.exe 2980 mmdgzjrqgy.exe 2980 mmdgzjrqgy.exe 2556 uwzofzunhzowazi.exe 2556 uwzofzunhzowazi.exe 2556 uwzofzunhzowazi.exe 2556 uwzofzunhzowazi.exe 2556 uwzofzunhzowazi.exe 2100 kktrzmsmvyjju.exe 2100 kktrzmsmvyjju.exe 2100 kktrzmsmvyjju.exe 2100 kktrzmsmvyjju.exe 2100 kktrzmsmvyjju.exe 2100 kktrzmsmvyjju.exe 2636 gqzdfbkj.exe 2636 gqzdfbkj.exe 2636 gqzdfbkj.exe 2636 gqzdfbkj.exe 2736 gqzdfbkj.exe 2736 gqzdfbkj.exe 2736 gqzdfbkj.exe 2736 gqzdfbkj.exe 2556 uwzofzunhzowazi.exe 2100 kktrzmsmvyjju.exe 2100 kktrzmsmvyjju.exe 2556 uwzofzunhzowazi.exe 2556 uwzofzunhzowazi.exe 2100 kktrzmsmvyjju.exe 2100 kktrzmsmvyjju.exe 2556 uwzofzunhzowazi.exe 2100 kktrzmsmvyjju.exe 2100 kktrzmsmvyjju.exe 2556 uwzofzunhzowazi.exe 2100 kktrzmsmvyjju.exe 2100 kktrzmsmvyjju.exe 2556 uwzofzunhzowazi.exe 2100 kktrzmsmvyjju.exe 2100 kktrzmsmvyjju.exe 2556 uwzofzunhzowazi.exe 2100 kktrzmsmvyjju.exe 2100 kktrzmsmvyjju.exe 2556 uwzofzunhzowazi.exe 2100 kktrzmsmvyjju.exe 2100 kktrzmsmvyjju.exe 2556 uwzofzunhzowazi.exe 2100 kktrzmsmvyjju.exe 2100 kktrzmsmvyjju.exe 2556 uwzofzunhzowazi.exe 2100 kktrzmsmvyjju.exe 2100 kktrzmsmvyjju.exe 2556 uwzofzunhzowazi.exe 2100 kktrzmsmvyjju.exe 2100 kktrzmsmvyjju.exe 2556 uwzofzunhzowazi.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 2980 mmdgzjrqgy.exe 2980 mmdgzjrqgy.exe 2980 mmdgzjrqgy.exe 2556 uwzofzunhzowazi.exe 2556 uwzofzunhzowazi.exe 2556 uwzofzunhzowazi.exe 2100 kktrzmsmvyjju.exe 2100 kktrzmsmvyjju.exe 2100 kktrzmsmvyjju.exe 2636 gqzdfbkj.exe 2636 gqzdfbkj.exe 2636 gqzdfbkj.exe 2736 gqzdfbkj.exe 2736 gqzdfbkj.exe 2736 gqzdfbkj.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 2980 mmdgzjrqgy.exe 2980 mmdgzjrqgy.exe 2980 mmdgzjrqgy.exe 2556 uwzofzunhzowazi.exe 2556 uwzofzunhzowazi.exe 2556 uwzofzunhzowazi.exe 2100 kktrzmsmvyjju.exe 2100 kktrzmsmvyjju.exe 2100 kktrzmsmvyjju.exe 2636 gqzdfbkj.exe 2636 gqzdfbkj.exe 2636 gqzdfbkj.exe 2736 gqzdfbkj.exe 2736 gqzdfbkj.exe 2736 gqzdfbkj.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2464 WINWORD.EXE 2464 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2980 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 28 PID 1924 wrote to memory of 2980 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 28 PID 1924 wrote to memory of 2980 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 28 PID 1924 wrote to memory of 2980 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 28 PID 1924 wrote to memory of 2556 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 29 PID 1924 wrote to memory of 2556 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 29 PID 1924 wrote to memory of 2556 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 29 PID 1924 wrote to memory of 2556 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 29 PID 1924 wrote to memory of 2636 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 30 PID 1924 wrote to memory of 2636 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 30 PID 1924 wrote to memory of 2636 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 30 PID 1924 wrote to memory of 2636 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 30 PID 1924 wrote to memory of 2100 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 31 PID 1924 wrote to memory of 2100 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 31 PID 1924 wrote to memory of 2100 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 31 PID 1924 wrote to memory of 2100 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 31 PID 2980 wrote to memory of 2736 2980 mmdgzjrqgy.exe 32 PID 2980 wrote to memory of 2736 2980 mmdgzjrqgy.exe 32 PID 2980 wrote to memory of 2736 2980 mmdgzjrqgy.exe 32 PID 2980 wrote to memory of 2736 2980 mmdgzjrqgy.exe 32 PID 1924 wrote to memory of 2464 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 33 PID 1924 wrote to memory of 2464 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 33 PID 1924 wrote to memory of 2464 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 33 PID 1924 wrote to memory of 2464 1924 ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe 33 PID 2464 wrote to memory of 1052 2464 WINWORD.EXE 36 PID 2464 wrote to memory of 1052 2464 WINWORD.EXE 36 PID 2464 wrote to memory of 1052 2464 WINWORD.EXE 36 PID 2464 wrote to memory of 1052 2464 WINWORD.EXE 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ed41a69b8fbfbdee0148eba63b9c6e01_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\mmdgzjrqgy.exemmdgzjrqgy.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\gqzdfbkj.exeC:\Windows\system32\gqzdfbkj.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2736
-
-
-
C:\Windows\SysWOW64\uwzofzunhzowazi.exeuwzofzunhzowazi.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2556
-
-
C:\Windows\SysWOW64\gqzdfbkj.exegqzdfbkj.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2636
-
-
C:\Windows\SysWOW64\kktrzmsmvyjju.exekktrzmsmvyjju.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2100
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:1052
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5673f07cd4ad5f1a632a0b7930f2c37eb
SHA176bd8f84beb7be475ba686c3bfb4961c8b68d7f9
SHA25630bd943f867a35f3081fd32ab63869d95c323b20000c12ff396f51c0685f9d8e
SHA512e74c816ce290769b7effef461df5a57917ba47c50d6b1b1182fadf2b8ce64acd537b6bf7882e9fe431b85281db646796c5262a4fdb327ad7e3380b609cad4c47
-
Filesize
512KB
MD5e6af3028968e85b68f8e302c45da6e8a
SHA18344763f899a594f339f88dc6bbda8538026f185
SHA256c2c3dfc4d07865bbd22a3e20e15e224e923b5d579ceb545c29fcbaeb48efced9
SHA512886540c9fb228c8faddf5efb95c3a51e05c59d96da347a0ab9838b091a2a244de7763f9b50e8f6604b5d03947df547e0c35a6a1d1633e2b71bfca06c9b0b54e4
-
Filesize
20KB
MD5481125461422b32ddc2d285bad1481b6
SHA17d0c98af385de2cca0a999cf61886ee8bf85b90d
SHA256248e192be1f1949d0e3f18200b05d9722eafd6931d529b06bdd5e5247efa0af0
SHA5121c52249953e5a689cd4bbfa98ad6131156e0a02acd6b84bc54a1ee96b9be1f211b9be394c546a47b815ccf815fee5184100b045f7e8d4a7fbc12c955cde0afa9
-
Filesize
512KB
MD59d1711529ff30f2d8394a90acc0a36d0
SHA177fe935dd4c004671b48188c84c9256bc9d1f055
SHA2561f352fd22c4a9e9700230a8466415192c74786a4a0faf57d2156cff3770b8a48
SHA51214abf44fde5c0126444c0abe269893bbcdab8e2b4cda3c71772eb8eb7dc089effdb2512d5bac15353bce3cb95c03e2dbda184aa1d46a63f8dc4863bd51a80ef5
-
Filesize
512KB
MD5d14267dd82f30389a0662d194d9be656
SHA133fb5219c65471de401f41608752efd339428b7f
SHA2567fe8fe608a1c5863ca1255aecd2142a433a9d40dee9e74ec60eb005aae55579b
SHA5129ccf3d91f0bd031500c0e6278cb2070909c7730a692307ee370666a55e14e172de854e7b5af24839320f941a7b8d2d49a4cbf5e863c5f062def69525f6225f15
-
Filesize
512KB
MD5cd94f7d057cdfdabf13de22782d908b9
SHA110066804459e389a63474457daffd739e0ea2963
SHA256dfb4203e945a871cb3044a3bad5594e68ccf53c3928780527fdd0de0c5c767b4
SHA512bbe77da9bdce19fc938c15075b05cd111e3845ce0c795abec039a38db754823ce5793e1c78014e9118c246cea9d850ed712527b9bb60e7b0fc8857d2521158db
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD552ae64ecb470130e4074f0e0a1221935
SHA132a79c662d0e1ede7fb3591976757760a986d443
SHA2566b0a76e123916e7b2028f9594c21157bd8755e4b6ff8b2fc79167c6f064b66a5
SHA5124ce53bd76a3b2f1e1c92ebd17390b2046d73a2707ecda44cbd586d7061f485982c51944c3d7b06de81f9aa3d83ba7cdb569dc3e7b947f6411b5f7edfce0b08e4
-
Filesize
512KB
MD53ecca3a470df050d5b6d54af41e5818e
SHA164ff9f8aab38e51ffb1ba23567fe499afc668768
SHA25607d95e5ed5cd7ef74fa1dbc6fecb30f76dae1c0ec767bab5126033839a6b853e
SHA5124eb8ebd90a9f0d8f012d7ccf27bed686261b6c2ac1bd2d903542f3fdb2951a3b3703083eff590298f2b4c7608d387baab0d90761b8008a764d8d0217d471008c