Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/04/2024, 03:11
Behavioral task
behavioral1
Sample
024885959930437241cd532dba529335_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
024885959930437241cd532dba529335_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
024885959930437241cd532dba529335
-
SHA1
c22e8f6b1ada57d0a391b466f55b4533f5a99496
-
SHA256
725001c5379619960cc42fb8e6ca0fd56c9ca61b24d67e8b0126a38e7d76e7cb
-
SHA512
50d218ce70d8ed900da78e2b74e1628b3db2d1fbc016477d085f7529f03b2a4af8e13d00d86fde4598206720f7fd35d34995e8f9a523fc913a96f65963952595
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZe:0UzeyQMS4DqodCnoe+iitjWwwi
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\024885959930437241cd532dba529335_JaffaCakes118.exe 024885959930437241cd532dba529335_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\024885959930437241cd532dba529335_JaffaCakes118.exe 024885959930437241cd532dba529335_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 2420 explorer.exe 2092 explorer.exe 2040 spoolsv.exe 2312 spoolsv.exe 812 spoolsv.exe 1296 spoolsv.exe 1752 spoolsv.exe 1760 spoolsv.exe 2372 spoolsv.exe 1704 spoolsv.exe 1964 spoolsv.exe 2036 spoolsv.exe 1824 spoolsv.exe 1056 spoolsv.exe 2860 spoolsv.exe 2384 spoolsv.exe 1032 spoolsv.exe 1248 spoolsv.exe 2140 spoolsv.exe 2208 spoolsv.exe 968 spoolsv.exe 2744 spoolsv.exe 2388 spoolsv.exe 1808 spoolsv.exe 2084 spoolsv.exe 1920 spoolsv.exe 476 spoolsv.exe 2200 spoolsv.exe 3012 spoolsv.exe 588 spoolsv.exe 1284 spoolsv.exe 1372 spoolsv.exe 1620 spoolsv.exe 2252 spoolsv.exe 2768 spoolsv.exe 2676 spoolsv.exe 1544 spoolsv.exe 836 spoolsv.exe 2892 spoolsv.exe 2364 spoolsv.exe 1044 spoolsv.exe 1492 spoolsv.exe 2220 spoolsv.exe 2524 spoolsv.exe 2168 spoolsv.exe 2992 spoolsv.exe 760 spoolsv.exe 2448 spoolsv.exe 1624 spoolsv.exe 1204 spoolsv.exe 756 spoolsv.exe 2080 spoolsv.exe 532 spoolsv.exe 2812 spoolsv.exe 2652 spoolsv.exe 2552 spoolsv.exe 1520 explorer.exe 2728 spoolsv.exe 652 spoolsv.exe 1200 spoolsv.exe 1576 spoolsv.exe 2096 spoolsv.exe 628 spoolsv.exe 912 spoolsv.exe -
Loads dropped DLL 64 IoCs
pid Process 2400 024885959930437241cd532dba529335_JaffaCakes118.exe 2400 024885959930437241cd532dba529335_JaffaCakes118.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 53 IoCs
description pid Process procid_target PID 2768 set thread context of 2400 2768 024885959930437241cd532dba529335_JaffaCakes118.exe 31 PID 2420 set thread context of 2092 2420 explorer.exe 33 PID 2312 set thread context of 2652 2312 spoolsv.exe 86 PID 2040 set thread context of 2552 2040 spoolsv.exe 87 PID 1296 set thread context of 2728 1296 spoolsv.exe 89 PID 812 set thread context of 652 812 spoolsv.exe 90 PID 1752 set thread context of 1576 1752 spoolsv.exe 92 PID 1760 set thread context of 2096 1760 spoolsv.exe 93 PID 2372 set thread context of 912 2372 spoolsv.exe 95 PID 1704 set thread context of 1564 1704 spoolsv.exe 96 PID 1964 set thread context of 3288 1964 spoolsv.exe 98 PID 2036 set thread context of 3460 2036 spoolsv.exe 99 PID 1824 set thread context of 3612 1824 spoolsv.exe 100 PID 1056 set thread context of 3628 1056 spoolsv.exe 101 PID 2384 set thread context of 3620 2384 spoolsv.exe 102 PID 2860 set thread context of 3784 2860 spoolsv.exe 104 PID 1248 set thread context of 3792 1248 spoolsv.exe 105 PID 1032 set thread context of 3880 1032 spoolsv.exe 106 PID 532 set thread context of 3968 532 spoolsv.exe 107 PID 2208 set thread context of 3976 2208 spoolsv.exe 108 PID 2140 set thread context of 4024 2140 spoolsv.exe 109 PID 2744 set thread context of 4080 2744 spoolsv.exe 110 PID 968 set thread context of 3080 968 spoolsv.exe 111 PID 1808 set thread context of 2712 1808 spoolsv.exe 112 PID 1920 set thread context of 944 1920 spoolsv.exe 114 PID 2084 set thread context of 3176 2084 spoolsv.exe 115 PID 2200 set thread context of 3240 2200 spoolsv.exe 116 PID 2388 set thread context of 2320 2388 spoolsv.exe 117 PID 588 set thread context of 3452 588 spoolsv.exe 118 PID 476 set thread context of 3464 476 spoolsv.exe 119 PID 1372 set thread context of 3488 1372 spoolsv.exe 120 PID 1620 set thread context of 3540 1620 spoolsv.exe 121 PID 3012 set thread context of 3584 3012 spoolsv.exe 122 PID 1284 set thread context of 3576 1284 spoolsv.exe 123 PID 2252 set thread context of 3684 2252 spoolsv.exe 124 PID 2676 set thread context of 3692 2676 spoolsv.exe 125 PID 836 set thread context of 3876 836 spoolsv.exe 126 PID 2768 set thread context of 692 2768 spoolsv.exe 127 PID 1544 set thread context of 3456 1544 spoolsv.exe 128 PID 2364 set thread context of 1812 2364 spoolsv.exe 129 PID 2892 set thread context of 324 2892 spoolsv.exe 130 PID 1492 set thread context of 2120 1492 spoolsv.exe 131 PID 2992 set thread context of 3136 2992 spoolsv.exe 132 PID 1044 set thread context of 312 1044 spoolsv.exe 133 PID 2220 set thread context of 2688 2220 spoolsv.exe 134 PID 2524 set thread context of 3172 2524 spoolsv.exe 135 PID 760 set thread context of 4020 760 spoolsv.exe 136 PID 2080 set thread context of 3292 2080 spoolsv.exe 137 PID 2448 set thread context of 3316 2448 spoolsv.exe 139 PID 1204 set thread context of 3304 1204 spoolsv.exe 138 PID 2168 set thread context of 2648 2168 spoolsv.exe 140 PID 1624 set thread context of 2856 1624 spoolsv.exe 141 PID 756 set thread context of 3564 756 spoolsv.exe 142 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 024885959930437241cd532dba529335_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 024885959930437241cd532dba529335_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2400 024885959930437241cd532dba529335_JaffaCakes118.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2092 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2400 024885959930437241cd532dba529335_JaffaCakes118.exe 2400 024885959930437241cd532dba529335_JaffaCakes118.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2092 explorer.exe 2652 spoolsv.exe 2652 spoolsv.exe 2552 spoolsv.exe 2552 spoolsv.exe 2728 spoolsv.exe 2728 spoolsv.exe 652 spoolsv.exe 652 spoolsv.exe 1576 spoolsv.exe 2096 spoolsv.exe 2096 spoolsv.exe 1576 spoolsv.exe 912 spoolsv.exe 912 spoolsv.exe 1564 spoolsv.exe 1564 spoolsv.exe 3288 spoolsv.exe 3288 spoolsv.exe 3460 spoolsv.exe 3460 spoolsv.exe 3612 spoolsv.exe 3612 spoolsv.exe 3628 spoolsv.exe 3628 spoolsv.exe 3620 spoolsv.exe 3620 spoolsv.exe 3784 spoolsv.exe 3784 spoolsv.exe 3792 spoolsv.exe 3792 spoolsv.exe 3880 spoolsv.exe 3880 spoolsv.exe 3968 spoolsv.exe 3968 spoolsv.exe 3976 spoolsv.exe 3976 spoolsv.exe 4024 spoolsv.exe 4024 spoolsv.exe 4080 spoolsv.exe 4080 spoolsv.exe 3080 spoolsv.exe 3080 spoolsv.exe 2712 spoolsv.exe 2712 spoolsv.exe 944 spoolsv.exe 944 spoolsv.exe 3176 spoolsv.exe 3176 spoolsv.exe 3240 spoolsv.exe 3240 spoolsv.exe 2320 spoolsv.exe 2320 spoolsv.exe 3452 spoolsv.exe 3452 spoolsv.exe 3464 spoolsv.exe 3464 spoolsv.exe 3488 spoolsv.exe 3488 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2768 wrote to memory of 2636 2768 024885959930437241cd532dba529335_JaffaCakes118.exe 28 PID 2768 wrote to memory of 2636 2768 024885959930437241cd532dba529335_JaffaCakes118.exe 28 PID 2768 wrote to memory of 2636 2768 024885959930437241cd532dba529335_JaffaCakes118.exe 28 PID 2768 wrote to memory of 2636 2768 024885959930437241cd532dba529335_JaffaCakes118.exe 28 PID 2768 wrote to memory of 2400 2768 024885959930437241cd532dba529335_JaffaCakes118.exe 31 PID 2768 wrote to memory of 2400 2768 024885959930437241cd532dba529335_JaffaCakes118.exe 31 PID 2768 wrote to memory of 2400 2768 024885959930437241cd532dba529335_JaffaCakes118.exe 31 PID 2768 wrote to memory of 2400 2768 024885959930437241cd532dba529335_JaffaCakes118.exe 31 PID 2768 wrote to memory of 2400 2768 024885959930437241cd532dba529335_JaffaCakes118.exe 31 PID 2768 wrote to memory of 2400 2768 024885959930437241cd532dba529335_JaffaCakes118.exe 31 PID 2400 wrote to memory of 2420 2400 024885959930437241cd532dba529335_JaffaCakes118.exe 32 PID 2400 wrote to memory of 2420 2400 024885959930437241cd532dba529335_JaffaCakes118.exe 32 PID 2400 wrote to memory of 2420 2400 024885959930437241cd532dba529335_JaffaCakes118.exe 32 PID 2400 wrote to memory of 2420 2400 024885959930437241cd532dba529335_JaffaCakes118.exe 32 PID 2420 wrote to memory of 2092 2420 explorer.exe 33 PID 2420 wrote to memory of 2092 2420 explorer.exe 33 PID 2420 wrote to memory of 2092 2420 explorer.exe 33 PID 2420 wrote to memory of 2092 2420 explorer.exe 33 PID 2420 wrote to memory of 2092 2420 explorer.exe 33 PID 2420 wrote to memory of 2092 2420 explorer.exe 33 PID 2092 wrote to memory of 2040 2092 explorer.exe 34 PID 2092 wrote to memory of 2040 2092 explorer.exe 34 PID 2092 wrote to memory of 2040 2092 explorer.exe 34 PID 2092 wrote to memory of 2040 2092 explorer.exe 34 PID 2092 wrote to memory of 2312 2092 explorer.exe 35 PID 2092 wrote to memory of 2312 2092 explorer.exe 35 PID 2092 wrote to memory of 2312 2092 explorer.exe 35 PID 2092 wrote to memory of 2312 2092 explorer.exe 35 PID 2092 wrote to memory of 812 2092 explorer.exe 36 PID 2092 wrote to memory of 812 2092 explorer.exe 36 PID 2092 wrote to memory of 812 2092 explorer.exe 36 PID 2092 wrote to memory of 812 2092 explorer.exe 36 PID 2092 wrote to memory of 1296 2092 explorer.exe 37 PID 2092 wrote to memory of 1296 2092 explorer.exe 37 PID 2092 wrote to memory of 1296 2092 explorer.exe 37 PID 2092 wrote to memory of 1296 2092 explorer.exe 37 PID 2092 wrote to memory of 1752 2092 explorer.exe 38 PID 2092 wrote to memory of 1752 2092 explorer.exe 38 PID 2092 wrote to memory of 1752 2092 explorer.exe 38 PID 2092 wrote to memory of 1752 2092 explorer.exe 38 PID 2092 wrote to memory of 1760 2092 explorer.exe 39 PID 2092 wrote to memory of 1760 2092 explorer.exe 39 PID 2092 wrote to memory of 1760 2092 explorer.exe 39 PID 2092 wrote to memory of 1760 2092 explorer.exe 39 PID 2092 wrote to memory of 2372 2092 explorer.exe 40 PID 2092 wrote to memory of 2372 2092 explorer.exe 40 PID 2092 wrote to memory of 2372 2092 explorer.exe 40 PID 2092 wrote to memory of 2372 2092 explorer.exe 40 PID 2092 wrote to memory of 1704 2092 explorer.exe 41 PID 2092 wrote to memory of 1704 2092 explorer.exe 41 PID 2092 wrote to memory of 1704 2092 explorer.exe 41 PID 2092 wrote to memory of 1704 2092 explorer.exe 41 PID 2092 wrote to memory of 1964 2092 explorer.exe 42 PID 2092 wrote to memory of 1964 2092 explorer.exe 42 PID 2092 wrote to memory of 1964 2092 explorer.exe 42 PID 2092 wrote to memory of 1964 2092 explorer.exe 42 PID 2092 wrote to memory of 2036 2092 explorer.exe 43 PID 2092 wrote to memory of 2036 2092 explorer.exe 43 PID 2092 wrote to memory of 2036 2092 explorer.exe 43 PID 2092 wrote to memory of 2036 2092 explorer.exe 43 PID 2092 wrote to memory of 1824 2092 explorer.exe 44 PID 2092 wrote to memory of 1824 2092 explorer.exe 44 PID 2092 wrote to memory of 1824 2092 explorer.exe 44 PID 2092 wrote to memory of 1824 2092 explorer.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\024885959930437241cd532dba529335_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\024885959930437241cd532dba529335_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2636
-
-
C:\Users\Admin\AppData\Local\Temp\024885959930437241cd532dba529335_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\024885959930437241cd532dba529335_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2552
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2312 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2652 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1520
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:812 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:652
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1296 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2728
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1752 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1576
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1760 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2096
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2372 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:912 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2832
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1704 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1564
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1964 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3288
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2036 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3460
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1824 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3612
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1056 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3628
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2860 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3784
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2384 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3620
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1032 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3880
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1248 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3792
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2140 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4024
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3976
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:968 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3080
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2744 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4080
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2388 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2320
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1808 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2712
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2084 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3176
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1920 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:944
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:476 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3464
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2200 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3240
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3012 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3584
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:588 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3452
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1284 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3576
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1372 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3488
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1620 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3540
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2252 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3684
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2768 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:692
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2676 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3692
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1544 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3456
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:836 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3876
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2892 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:324
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2364 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1812
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1044 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:312
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1492 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2120
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2220 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2688
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2524 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3172
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2168 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2648
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2992 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3136
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:760 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4020
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2448 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3316
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1624 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2856
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1204 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3304
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:756 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3564
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2080 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3292
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:532 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3968
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2812
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1200
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:628
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3700
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1660
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1828
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3480
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:608
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1924
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3788
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1572
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1968
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2972
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3708
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2984
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4016
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2820
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:440
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2696
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
56KB
MD5bd72dcf1083b6e22ccbfa0e8e27fb1e0
SHA13fd23d4f14da768da7b8364d74c54932d704e74e
SHA25690f44f69950a796ab46ff09181585ac9dabf21271f16ebb9ea385c957e5955c1
SHA51272360ab4078ad5e0152324f9a856b3396e2d0247f7f95ac8a5a53a25126ac3cff567cc523849e28d92a99730ee8ffb30366f09c428258f93a5cca6d0c5905562
-
Filesize
2.2MB
MD59a5dc29010612a0bd3b6d157145ce808
SHA1017bdeb6241cf7b3f55f058df701de6011b05c1f
SHA25602cef7c9eb2ed2c03ae6297634ce53f6556d5bf7eba02c8e749854b20547d337
SHA512db40220fbf97a08170799edfd7aa6177381c15cab0e6d274effd8a8bbe0c0e8aa4c571968f693b54fa6f14d03f5a4c5512749e1ff6179cc64237a62fe00de336
-
Filesize
2.2MB
MD5f06931528e438d70d5fbe37885371d11
SHA19f8c74718e43a8fd25fa8325befefb74ea1f53b5
SHA2560f7708424123dd05846c05f543bcbc846986995054b73a7b7eb7dc54ab1815b1
SHA5127a6cd6a0fd98041e1506aad79049b19651a64ab220242b55d2dc4b072618ac7d3ca3bd9115b1ac65cf8ec586d4197d6c07d3d2065d7f376332815b086fbf400e