Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3f1d4115609...18.exe
windows7-x64
7f1d4115609...18.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows7-x64
1$PLUGINSDI...sh.dll
windows10-2004-x64
1$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$TEMP/~nsi...86.dll
windows7-x64
1$TEMP/~nsi...86.dll
windows10-2004-x64
3Cloud-Web_2_86.dll
windows7-x64
6Cloud-Web_2_86.dll
windows10-2004-x64
6Cloud-Web_2_86.dll
windows7-x64
6Cloud-Web_2_86.dll
windows10-2004-x64
6Cloud-Web_...86.dll
windows7-x64
1Cloud-Web_...86.dll
windows10-2004-x64
1Cloud-Web_...86.dll
windows7-x64
1Cloud-Web_...86.dll
windows10-2004-x64
1Cloud-Web_...86.dll
windows7-x64
1Cloud-Web_...86.dll
windows10-2004-x64
3Cloud-Web_...86.dll
windows7-x64
1Cloud-Web_...86.dll
windows10-2004-x64
3Cloud-Web_run.exe
windows7-x64
6Cloud-Web_run.exe
windows10-2004-x64
6Cloud-Web_run.exe
windows7-x64
6Cloud-Web_run.exe
windows10-2004-x64
6Cloud-Web_tb_2_86.dll
windows7-x64
1Cloud-Web_tb_2_86.dll
windows10-2004-x64
1Cloud-Web_tb_2_86.dll
windows7-x64
1Cloud-Web_tb_2_86.dll
windows10-2004-x64
1cloudidsvc.exe
windows7-x64
1cloudidsvc.exe
windows10-2004-x64
1Analysis
-
max time kernel
128s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
15/04/2024, 20:11
Static task
static1
Behavioral task
behavioral1
Sample
f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe
Resource
win7-20240319-en
windows7-x64
Behavioral task
behavioral2
Sample
f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$TEMP/~nsis/Cloud-Web_nad_2_86.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
$TEMP/~nsis/Cloud-Web_nad_2_86.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Cloud-Web_2_86.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
Cloud-Web_2_86.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Cloud-Web_2_86.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
Cloud-Web_2_86.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Cloud-Web_mime_2_86.dll
Resource
win7-20240319-en
windows7-x64
Behavioral task
behavioral16
Sample
Cloud-Web_mime_2_86.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Cloud-Web_mime_2_86.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
Cloud-Web_mime_2_86.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Cloud-Web_nad_2_86.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
Cloud-Web_nad_2_86.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Cloud-Web_nad_2_86.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
Cloud-Web_nad_2_86.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Cloud-Web_run.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
Cloud-Web_run.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Cloud-Web_run.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
Cloud-Web_run.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Cloud-Web_tb_2_86.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral28
Sample
Cloud-Web_tb_2_86.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Cloud-Web_tb_2_86.dll
Resource
win7-20240319-en
windows7-x64
Behavioral task
behavioral30
Sample
Cloud-Web_tb_2_86.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
cloudidsvc.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral32
Sample
cloudidsvc.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
General
-
Target
f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe
-
Size
587KB
-
MD5
f1d4115609ebdba98586dbcadd5cfd27
-
SHA1
f3900de98053c1cd44e6df41867fda507814daba
-
SHA256
7886e911d79668ca934c87d8612f3722fe9be00efa23785940f836d4f37b5373
-
SHA512
f9c137ca7455b20558d350c73d2633e89e40c45c9b07d52fff531f67d47efa8ea95d5810a545437e7473e8a907262b8dc15e38340702b91035152c8974b79af0
-
SSDEEP
12288:JMTbLIlQhBaUFP9QVKjHtzp7F2tpeOEnNsViTeyJgu:eXLe4zFPzBl7F2P6N4iv
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 2716 cloudidsvc.ex_ 2724 cloudidsvc.ex_ 2564 cloudidsvc.exe 2328 cloudidsvc.exe 2900 cloudidsvc.exe -
Loads dropped DLL 32 IoCs
pid Process 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 2564 cloudidsvc.exe 2564 cloudidsvc.exe 2564 cloudidsvc.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 2328 cloudidsvc.exe 2328 cloudidsvc.exe 2328 cloudidsvc.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 2900 cloudidsvc.exe 2900 cloudidsvc.exe 2900 cloudidsvc.exe 2900 cloudidsvc.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{346C2134-C5AC-B5f9-6F8F-B8F4035EFFFE} f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{346C2134-C5AC-B5f9-6F8F-B8F4035EFFFE}\ = "CloudExs40004APIClass Helper" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat cloudidsvc.exe -
Drops file in Program Files directory 16 IoCs
description ioc Process File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_nad_2_86.dl_ f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\cloudidsvc.ex_ f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_run.ex_ f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Cloud-Web\Log\cloudweb_up_20240415.txt cloudidsvc.ex_ File created C:\Program Files (x86)\Cloud-Web\cloudidsvc.exe f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\uninst.exe f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_2_86.dl_ f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_nad_2_86.dll f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_mime_2_86.dll f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_2_86.dll f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_run.exe f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Cloud-Web\Log\cloudweb_up_20240415.txt cloudidsvc.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_tb_2_86.dl_ f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_mime_2_86.dl_ f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\Cloud-Web_tb_2_86.dll f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe File created C:\Program Files (x86)\Cloud-Web\cloud_uins.dat f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\ClsidExtension = "{053202B5-4539-4c5a-B531-42C754ABBD41}" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\ButtonText = "Ŭ¶ó¿ìµåÀ¥ ¼³Á¤ ½ÇÇà" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D} f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\Icon = "C:\\Program Files (x86)\\Cloud-Web\\Cloud-Web_tb_2_86.dll,201" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\HotIcon = "C:\\Program Files (x86)\\Cloud-Web\\Cloud-Web_tb_2_86.dll,202" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\Default Visible = "Yes" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\SOFTWARE\Microsoft\Internet Explorer\Main f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe -
Modifies data under HKEY_USERS 28 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5EF6ADD2-A342-4CF0-B6B4-B1DCA0084E91} cloudidsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" cloudidsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" cloudidsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" cloudidsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5EF6ADD2-A342-4CF0-B6B4-B1DCA0084E91}\WpadDecision = "0" cloudidsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-5b-7f-a7-cd-66\WpadDetectedUrl cloudidsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f000b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 cloudidsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-5b-7f-a7-cd-66\WpadDecision = "0" cloudidsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad cloudidsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-5b-7f-a7-cd-66\WpadDecisionTime = 00946858718fda01 cloudidsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5EF6ADD2-A342-4CF0-B6B4-B1DCA0084E91}\WpadDecisionTime = 20ce7f32718fda01 cloudidsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5EF6ADD2-A342-4CF0-B6B4-B1DCA0084E91}\WpadNetworkName = "Network 3" cloudidsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-5b-7f-a7-cd-66 cloudidsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-5b-7f-a7-cd-66\WpadDecisionReason = "1" cloudidsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections cloudidsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 cloudidsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" cloudidsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 cloudidsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5EF6ADD2-A342-4CF0-B6B4-B1DCA0084E91}\WpadDecisionTime = 00946858718fda01 cloudidsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings cloudidsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5EF6ADD2-A342-4CF0-B6B4-B1DCA0084E91}\WpadDecisionReason = "1" cloudidsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-5b-7f-a7-cd-66\WpadDecisionTime = 20ce7f32718fda01 cloudidsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f000b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 cloudidsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix cloudidsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings cloudidsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5EF6ADD2-A342-4CF0-B6B4-B1DCA0084E91}\4e-5b-7f-a7-cd-66 cloudidsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ cloudidsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" cloudidsvc.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ID_MimeHTML\CurVer f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{36E4825B-2C2F-4EC9-99F0-6EA492D7CC30}\TypeLib\Version = "1.0" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{346C2134-C5AC-B5f9-6F8F-B8F4035EFFFE}\ = "CloudWeb Web3.0" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CloudToolBar.CloudToolbarObject.1\ = "CloudToolbarObject Class" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CloudToolBar.CloudToolbarObject\CLSID f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{053202B5-4539-4c5a-B531-42C754ABBD41}\InprocServer32\ = "C:\\Program Files (x86)\\Cloud-Web\\Cloud-Web_tb_2_86.dll" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{053202B5-4539-4c5a-B531-42C754ABBD41}\TypeLib\ = "{B4DDB057-9EDC-45B5-89A3-8CAD9F265F1E}" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ID_MimeHTML.1\CLSID f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22D0BA1C-4BEB-476E-AA5A-18FDE2E9D064}\ProgID\ = "ID_MimeHTML.1" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36E4825B-2C2F-4EC9-99F0-6EA492D7CC30}\TypeLib\Version = "1.0" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{346C2134-C5AC-B5f9-6F8F-B8F4035EFFFE}\VersionIndependentProgID\ = "CloudExs40004BHO.CloudExs40004APIClass" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{346C2134-C5AC-B5f9-6F8F-B8F4035EFFFE}\Programmable f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{053202B5-4539-4c5a-B531-42C754ABBD41}\ProgID f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{053202B5-4539-4c5a-B531-42C754ABBD41}\VersionIndependentProgID f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{246C2134-C5AC-B5F9-6F8F-B8F4035EFFFE}\1.0\ = "CloudExs40004APIClass 1.0 Type Library" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{146C2134-C5AC-B5F9-6F8F-B8F4035EFFFE}\TypeLib\Version = "1.0" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D89080BE-5019-4399-96E1-2A0E32AEF599}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{346C2134-C5AC-B5f9-6F8F-B8F4035EFFFE}\TypeLib f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{246C2134-C5AC-B5F9-6F8F-B8F4035EFFFE}\1.0\0 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA3B666E-8A3C-4099-B499-E0A277279117}\1.0\FLAGS f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22D0BA1C-4BEB-476E-AA5A-18FDE2E9D064}\InprocServer32\ThreadingModel = "Apartment" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{36E4825B-2C2F-4EC9-99F0-6EA492D7CC30}\TypeLib f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36E4825B-2C2F-4EC9-99F0-6EA492D7CC30}\ = "IMimeHTML" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36E4825B-2C2F-4EC9-99F0-6EA492D7CC30}\TypeLib\ = "{EA3B666E-8A3C-4099-B499-E0A277279117}" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ID_MimeHTML.1\ = "MimeHTML Class" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ID_MimeHTML\CurVer\ = "ID_MimeHTML.1" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22D0BA1C-4BEB-476E-AA5A-18FDE2E9D064} f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22D0BA1C-4BEB-476E-AA5A-18FDE2E9D064}\ = "MimeHTML Class" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{246C2134-C5AC-B5F9-6F8F-B8F4035EFFFE}\1.0 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CloudToolBar.CloudToolbarObject.1\CLSID f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D89080BE-5019-4399-96E1-2A0E32AEF599}\ProxyStubClsid32 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36E4825B-2C2F-4EC9-99F0-6EA492D7CC30}\TypeLib f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{053202B5-4539-4c5a-B531-42C754ABBD41} f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{053202B5-4539-4c5a-B531-42C754ABBD41}\ = "CloudToolbarObject Class" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D89080BE-5019-4399-96E1-2A0E32AEF599}\TypeLib f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{053202B5-4539-4c5a-B531-42C754ABBD41}\TypeLib f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4DDB057-9EDC-45B5-89A3-8CAD9F265F1E}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Cloud-Web\\" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22D0BA1C-4BEB-476E-AA5A-18FDE2E9D064}\Version\ = "1.0" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CloudExs40004BHO.CloudExs40004APIClass\ = "CloudExs40004APIClass Class" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{246C2134-C5AC-B5F9-6F8F-B8F4035EFFFE} f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{146C2134-C5AC-B5F9-6F8F-B8F4035EFFFE}\TypeLib\ = "{246C2134-C5AC-B5F9-6F8F-B8F4035EFFFE}" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{146C2134-C5AC-B5F9-6F8F-B8F4035EFFFE}\ = "ICloudExs40004API" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36E4825B-2C2F-4EC9-99F0-6EA492D7CC30}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CloudExs40004BHO.CloudExs40004APIClass.1 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CloudToolBar.CloudToolbarObject\ = "CloudToolbarObject Class" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CloudToolBar.CloudToolbarObject\CurVer f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{053202B5-4539-4c5a-B531-42C754ABBD41}\ProgID\ = "CloudToolBar.CloudToolbarObject.1" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D89080BE-5019-4399-96E1-2A0E32AEF599} f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{346C2134-C5AC-B5f9-6F8F-B8F4035EFFFE}\ProgID f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{346C2134-C5AC-B5f9-6F8F-B8F4035EFFFE}\InprocServer32\ = "C:\\Program Files (x86)\\Cloud-Web\\Cloud-Web_2_86.dll" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{146C2134-C5AC-B5F9-6F8F-B8F4035EFFFE}\TypeLib\ = "{246C2134-C5AC-B5F9-6F8F-B8F4035EFFFE}" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D89080BE-5019-4399-96E1-2A0E32AEF599} f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{36E4825B-2C2F-4EC9-99F0-6EA492D7CC30}\TypeLib\ = "{EA3B666E-8A3C-4099-B499-E0A277279117}" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{246C2134-C5AC-B5F9-6F8F-B8F4035EFFFE}\1.0\HELPDIR f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ID_MimeHTML f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22D0BA1C-4BEB-476E-AA5A-18FDE2E9D064}\TypeLib\ = "{EA3B666E-8A3C-4099-B499-E0A277279117}" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA3B666E-8A3C-4099-B499-E0A277279117}\1.0 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D89080BE-5019-4399-96E1-2A0E32AEF599}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22D0BA1C-4BEB-476E-AA5A-18FDE2E9D064}\TypeLib f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA3B666E-8A3C-4099-B499-E0A277279117} f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA3B666E-8A3C-4099-B499-E0A277279117}\1.0\HELPDIR f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CloudExs40004BHO.CloudExs40004APIClass\CLSID\ = "{346C2134-C5AC-B5f9-6F8F-B8F4035EFFFE}" f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{146C2134-C5AC-B5F9-6F8F-B8F4035EFFFE}\TypeLib f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4DDB057-9EDC-45B5-89A3-8CAD9F265F1E}\1.0 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe Token: SeBackupPrivilege 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1192 wrote to memory of 2716 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 28 PID 1192 wrote to memory of 2716 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 28 PID 1192 wrote to memory of 2716 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 28 PID 1192 wrote to memory of 2716 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 28 PID 1192 wrote to memory of 2716 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 28 PID 1192 wrote to memory of 2716 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 28 PID 1192 wrote to memory of 2716 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 28 PID 1192 wrote to memory of 2724 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 29 PID 1192 wrote to memory of 2724 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 29 PID 1192 wrote to memory of 2724 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 29 PID 1192 wrote to memory of 2724 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 29 PID 1192 wrote to memory of 2724 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 29 PID 1192 wrote to memory of 2724 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 29 PID 1192 wrote to memory of 2724 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 29 PID 1192 wrote to memory of 2564 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 30 PID 1192 wrote to memory of 2564 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 30 PID 1192 wrote to memory of 2564 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 30 PID 1192 wrote to memory of 2564 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 30 PID 1192 wrote to memory of 2564 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 30 PID 1192 wrote to memory of 2564 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 30 PID 1192 wrote to memory of 2564 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 30 PID 1192 wrote to memory of 2328 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 32 PID 1192 wrote to memory of 2328 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 32 PID 1192 wrote to memory of 2328 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 32 PID 1192 wrote to memory of 2328 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 32 PID 1192 wrote to memory of 2328 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 32 PID 1192 wrote to memory of 2328 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 32 PID 1192 wrote to memory of 2328 1192 f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f1d4115609ebdba98586dbcadd5cfd27_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Program Files (x86)\Cloud-Web\cloudidsvc.ex_"C:\Program Files (x86)\Cloud-Web\cloudidsvc.ex_" /stop2⤵
- Executes dropped EXE
PID:2716
-
-
C:\Program Files (x86)\Cloud-Web\cloudidsvc.ex_"C:\Program Files (x86)\Cloud-Web\cloudidsvc.ex_" /u2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2724
-
-
C:\Program Files (x86)\Cloud-Web\cloudidsvc.exe"C:\Program Files (x86)\Cloud-Web\cloudidsvc.exe" /i2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:2564
-
-
C:\Program Files (x86)\Cloud-Web\cloudidsvc.exe"C:\Program Files (x86)\Cloud-Web\cloudidsvc.exe" /start2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328
-
-
C:\Program Files (x86)\Cloud-Web\cloudidsvc.exe"C:\Program Files (x86)\Cloud-Web\cloudidsvc.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
127KB
MD5f58b43fe184e6e6617b543d6e328db4b
SHA15c3c21cbcfe750102766d4e3a0d2023080900948
SHA256fa1d28539f809a9333959b0ce12625e0b1282f8eab2effb9743f907f4a9cdd2b
SHA51220ee54ea0e4a6473aa3171eff5f18141fca5145c562cf7b72283ceacf3f796352d07b9cb22f7ad46268df0cc1916a4b02a3dce862c58e4cfab87e16c36bf1059
-
Filesize
305B
MD50027a6d2f9ea1222f5f9a7390efa60ed
SHA1d1c76c93bdf7fa462fe797d72bfd5a995415c1f3
SHA256b3228bf1f06e53b487eca0e4c262dff68539a0ab19791275905a860d60618cd9
SHA512efd96af39cfb94ac24dac80d24cbcf543af7065be356822c3aef3e0c747d13deeadeeb0b0e96725a026571799c2fe2f062f57242dac5a60e5a3b65619006f79c
-
Filesize
631B
MD5d68e763c825dc0e388929ae1b375ce18
SHA17951a43bbfb08fd742224ada280913d1897b89ab
SHA25625cf0f0ce42f8acd9ea6facc223f54105c7fd0cce63fb7bb5d83e6600100acbd
SHA5121e146e2631a4f3bd091905ccc10ed1054700349648cd52aad24eaeeedff0fac4b44b6212284a6d0855942ff16308c66402ecb895e68ef1c66dcd496973043cdb
-
Filesize
123KB
MD5f5e11bef483ed3b0c2436099a61b090b
SHA1fbf8fb0a380d69ab83365a0f9dfb9d6aa89ca0c8
SHA25602ff072273315997902c1aaa97d111d99e75bc4624e9b2a3f801d469d9a6bf3f
SHA5129d7ebcc4e7a6cc3049b90a30d9ab1c7dc23307c4050b79b4de7cb407130424a49222e9ceefd09016f74e7306b87f164c6d91b8adb9367b01eefe91005b24f5f9
-
Filesize
210KB
MD5e03152320af546785839f21cefd28ce1
SHA17264e5753bb5313b9ceb69d05c15e000ed938559
SHA2566807aee8007988c5409a947a526c187c66e349886399541454800ce2a99c2442
SHA51293681775e96cb80b8cc4b89c788902f5070497c5a0120c0ba965c14e651ab3726387bc0d3f8feeaf315ae45bd7bf40bf37f1e2fd379b89bc812c9dd2fdfefb5e
-
Filesize
127KB
MD5fba59862b8e2d049b64c10af254f93a9
SHA1712e432e17c744063995d45195b4a918c72f4790
SHA256a1685530939b91cd4ab1d34a72bada8d41ef708754d829a1c24e6ab4b0e4b530
SHA512cda0082126615957c1572142502a278fe5e80fed8bdc2bf674011039dbfa07066e7768355c8dcbeba316f917ce081ba7c2923f7534c2ab99ea606cdd61781086
-
Filesize
107KB
MD5a839f8672617d05b4c2937b99e925ee7
SHA1fd47813200d810ae7751f1e18e09bc162fc7b3fb
SHA256799bc692e8eeb52f466aa52e3207be5dff2ad83e761402b8877227bbfad6cc15
SHA512d1f4a23eab71a87cbf079e3d5b4eb9bc2cea94a2f40ce40ee5dd4097873ff32b598d315d3426ad6a755b9d6a7c6d6bc430b8f173d84535ead8776479c4f6f727
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
8KB
MD57ee14dff57fb6e6c644b318d16768f4c
SHA19a5d5b31ab56ab01e9b0bd76c51b8b4605a8ccce
SHA25653377d0710f551182edbab4150935425948535d11b92bf08a1c2dcf989723bd7
SHA5120565ff2bdbdf044c5f90bd45475d478b48cdbd5e19569976291b1bdd703e61355410c65f29f2c9213faf56251beb16d342c8625288dad6afc670717b9636d51f
-
Filesize
4KB
MD58f4ac52cb2f7143f29f114add12452ad
SHA129dc25f5d69bf129d608b83821c8ec8ab8c8edb3
SHA256b214d73aea95191f7363ad93cdc12b6fbd50a3a54b0aa891b3d45bc4b7b2aa04
SHA5122f9e2c7450557c2b88a12d3a3b4ab999c9f2a4df0d39dcd795b307b89855387bc96fc6d4fb51de8f33de0780e08a3b15fdad43daeaf7373cca71b01d7afdaf0c
-
Filesize
551KB
MD5ed69beb49380916ea57113b0a0c924fc
SHA12ab7472804ef54e168b31614c25a45e322eb43e7
SHA256b5de4af37fdb5723161b48306857e1bf4b95df7b46403499012c35c86cf0170d
SHA512bb3b5cce79d7576917e039e4476f7a75fe8ec64681e3c9267f1aa295e6888a92852ca45318a2fec8b350fbc962f766dddaa75c13b6e0c6bf760a3bc479a1fbdb
