Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-05-2024 19:27
Static task
static1
Behavioral task
behavioral1
Sample
3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe
-
Size
203KB
-
MD5
3bb359fae8694fdd6a75614aabd1516d
-
SHA1
ada8813519de455b58f6bab4541073d65cc53eac
-
SHA256
06c1363d352171272258a27cd7fbea8f1fb6841f8e74185230885311b35acb55
-
SHA512
fe1a6f851e89487289d4284888070a8fd5b2477da2030f5bd8d3a8a66dfb7671785cb79913a4a60998717ed367a4d0487384256a0c1a27a709ea812b4406e75e
-
SSDEEP
6144:wyAge9R9JXEZIXDcTSMQ8KQ1zP0CmATGWP:OJXEmXDcuMQ8KQ1zP1mAT7
Malware Config
Extracted
C:\Recovery\WindowsRE\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.dk59jg.win/3D6F-765A-97A2-006D-F42A
http://cerberhhyed5frqa.kipfgs65s.com/3D6F-765A-97A2-006D-F42A
http://cerberhhyed5frqa.wewiso.win/3D6F-765A-97A2-006D-F42A
http://cerberhhyed5frqa.we34re.win/3D6F-765A-97A2-006D-F42A
http://cerberhhyed5frqa.as13fd.win/3D6F-765A-97A2-006D-F42A
http://cerberhhyed5frqa.onion/3D6F-765A-97A2-006D-F42A
Extracted
C:\Recovery\WindowsRE\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16397) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
ByteCodeGenerator.exe3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{5B76921C-F710-0C00-7C90-036FED3C4413}\\ByteCodeGenerator.exe\"" ByteCodeGenerator.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{5B76921C-F710-0C00-7C90-036FED3C4413}\\ByteCodeGenerator.exe\"" 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ByteCodeGenerator.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation ByteCodeGenerator.exe -
Drops startup file 2 IoCs
Processes:
3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exeByteCodeGenerator.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ByteCodeGenerator.lnk 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ByteCodeGenerator.lnk ByteCodeGenerator.exe -
Executes dropped EXE 6 IoCs
Processes:
ByteCodeGenerator.exeByteCodeGenerator.exeByteCodeGenerator.exeByteCodeGenerator.exeByteCodeGenerator.exeByteCodeGenerator.exepid process 3732 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4736 ByteCodeGenerator.exe 1472 ByteCodeGenerator.exe 4616 ByteCodeGenerator.exe 2624 ByteCodeGenerator.exe -
Loads dropped DLL 12 IoCs
Processes:
3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exeByteCodeGenerator.exeByteCodeGenerator.exeByteCodeGenerator.exepid process 3576 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe 3576 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe 3576 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe 3732 ByteCodeGenerator.exe 3732 ByteCodeGenerator.exe 3732 ByteCodeGenerator.exe 4736 ByteCodeGenerator.exe 4736 ByteCodeGenerator.exe 4736 ByteCodeGenerator.exe 4616 ByteCodeGenerator.exe 4616 ByteCodeGenerator.exe 4616 ByteCodeGenerator.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exeByteCodeGenerator.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ByteCodeGenerator = "\"C:\\Users\\Admin\\AppData\\Roaming\\{5B76921C-F710-0C00-7C90-036FED3C4413}\\ByteCodeGenerator.exe\"" 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ByteCodeGenerator = "\"C:\\Users\\Admin\\AppData\\Roaming\\{5B76921C-F710-0C00-7C90-036FED3C4413}\\ByteCodeGenerator.exe\"" 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ByteCodeGenerator = "\"C:\\Users\\Admin\\AppData\\Roaming\\{5B76921C-F710-0C00-7C90-036FED3C4413}\\ByteCodeGenerator.exe\"" ByteCodeGenerator.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ByteCodeGenerator = "\"C:\\Users\\Admin\\AppData\\Roaming\\{5B76921C-F710-0C00-7C90-036FED3C4413}\\ByteCodeGenerator.exe\"" ByteCodeGenerator.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 13 ipinfo.io -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
ByteCodeGenerator.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp3D2E.bmp" ByteCodeGenerator.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exeByteCodeGenerator.exeByteCodeGenerator.exeByteCodeGenerator.exedescription pid process target process PID 3576 set thread context of 2184 3576 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe PID 3732 set thread context of 4480 3732 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 4736 set thread context of 1472 4736 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 4616 set thread context of 2624 4616 ByteCodeGenerator.exe ByteCodeGenerator.exe -
Drops file in Windows directory 4 IoCs
Processes:
3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exeByteCodeGenerator.exeByteCodeGenerator.exeByteCodeGenerator.exedescription ioc process File opened for modification C:\Windows\ 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe File opened for modification C:\Windows\ ByteCodeGenerator.exe File opened for modification C:\Windows\ ByteCodeGenerator.exe File opened for modification C:\Windows\ ByteCodeGenerator.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\{5B76921C-F710-0C00-7C90-036FED3C4413}\ByteCodeGenerator.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\{5B76921C-F710-0C00-7C90-036FED3C4413}\ByteCodeGenerator.exe nsis_installer_2 -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 1032 taskkill.exe 4708 taskkill.exe -
Modifies Control Panel 4 IoCs
Processes:
3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exeByteCodeGenerator.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{5B76921C-F710-0C00-7C90-036FED3C4413}\\ByteCodeGenerator.exe\"" 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop ByteCodeGenerator.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{5B76921C-F710-0C00-7C90-036FED3C4413}\\ByteCodeGenerator.exe\"" ByteCodeGenerator.exe -
Modifies registry class 1 IoCs
Processes:
ByteCodeGenerator.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings ByteCodeGenerator.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ByteCodeGenerator.exepid process 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe 4480 ByteCodeGenerator.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
Processes:
msedge.exepid process 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exetaskkill.exeByteCodeGenerator.exeByteCodeGenerator.exeAUDIODG.EXEByteCodeGenerator.exetaskkill.exedescription pid process Token: SeDebugPrivilege 2184 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe Token: SeDebugPrivilege 1032 taskkill.exe Token: SeDebugPrivilege 4480 ByteCodeGenerator.exe Token: SeDebugPrivilege 1472 ByteCodeGenerator.exe Token: 33 1944 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1944 AUDIODG.EXE Token: SeDebugPrivilege 2624 ByteCodeGenerator.exe Token: SeDebugPrivilege 4708 taskkill.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.execmd.exeByteCodeGenerator.exeByteCodeGenerator.exeByteCodeGenerator.exeByteCodeGenerator.exemsedge.exedescription pid process target process PID 3576 wrote to memory of 2184 3576 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe PID 3576 wrote to memory of 2184 3576 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe PID 3576 wrote to memory of 2184 3576 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe PID 3576 wrote to memory of 2184 3576 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe PID 3576 wrote to memory of 2184 3576 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe PID 3576 wrote to memory of 2184 3576 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe PID 3576 wrote to memory of 2184 3576 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe PID 3576 wrote to memory of 2184 3576 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe PID 3576 wrote to memory of 2184 3576 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe PID 2184 wrote to memory of 3732 2184 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe ByteCodeGenerator.exe PID 2184 wrote to memory of 3732 2184 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe ByteCodeGenerator.exe PID 2184 wrote to memory of 3732 2184 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe ByteCodeGenerator.exe PID 2184 wrote to memory of 212 2184 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe cmd.exe PID 2184 wrote to memory of 212 2184 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe cmd.exe PID 2184 wrote to memory of 212 2184 3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe cmd.exe PID 212 wrote to memory of 1032 212 cmd.exe taskkill.exe PID 212 wrote to memory of 1032 212 cmd.exe taskkill.exe PID 212 wrote to memory of 1032 212 cmd.exe taskkill.exe PID 212 wrote to memory of 1832 212 cmd.exe PING.EXE PID 212 wrote to memory of 1832 212 cmd.exe PING.EXE PID 212 wrote to memory of 1832 212 cmd.exe PING.EXE PID 3732 wrote to memory of 4480 3732 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 3732 wrote to memory of 4480 3732 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 3732 wrote to memory of 4480 3732 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 3732 wrote to memory of 4480 3732 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 3732 wrote to memory of 4480 3732 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 3732 wrote to memory of 4480 3732 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 3732 wrote to memory of 4480 3732 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 3732 wrote to memory of 4480 3732 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 3732 wrote to memory of 4480 3732 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 4736 wrote to memory of 1472 4736 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 4736 wrote to memory of 1472 4736 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 4736 wrote to memory of 1472 4736 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 4736 wrote to memory of 1472 4736 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 4736 wrote to memory of 1472 4736 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 4736 wrote to memory of 1472 4736 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 4736 wrote to memory of 1472 4736 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 4736 wrote to memory of 1472 4736 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 4736 wrote to memory of 1472 4736 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 4616 wrote to memory of 2624 4616 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 4616 wrote to memory of 2624 4616 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 4616 wrote to memory of 2624 4616 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 4616 wrote to memory of 2624 4616 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 4616 wrote to memory of 2624 4616 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 4616 wrote to memory of 2624 4616 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 4616 wrote to memory of 2624 4616 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 4616 wrote to memory of 2624 4616 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 4616 wrote to memory of 2624 4616 ByteCodeGenerator.exe ByteCodeGenerator.exe PID 4480 wrote to memory of 1680 4480 ByteCodeGenerator.exe msedge.exe PID 4480 wrote to memory of 1680 4480 ByteCodeGenerator.exe msedge.exe PID 1680 wrote to memory of 1260 1680 msedge.exe msedge.exe PID 1680 wrote to memory of 1260 1680 msedge.exe msedge.exe PID 4480 wrote to memory of 4140 4480 ByteCodeGenerator.exe NOTEPAD.EXE PID 4480 wrote to memory of 4140 4480 ByteCodeGenerator.exe NOTEPAD.EXE PID 1680 wrote to memory of 452 1680 msedge.exe msedge.exe PID 1680 wrote to memory of 452 1680 msedge.exe msedge.exe PID 1680 wrote to memory of 452 1680 msedge.exe msedge.exe PID 1680 wrote to memory of 452 1680 msedge.exe msedge.exe PID 1680 wrote to memory of 452 1680 msedge.exe msedge.exe PID 1680 wrote to memory of 452 1680 msedge.exe msedge.exe PID 1680 wrote to memory of 452 1680 msedge.exe msedge.exe PID 1680 wrote to memory of 452 1680 msedge.exe msedge.exe PID 1680 wrote to memory of 452 1680 msedge.exe msedge.exe PID 1680 wrote to memory of 452 1680 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Roaming\{5B76921C-F710-0C00-7C90-036FED3C4413}\ByteCodeGenerator.exe"C:\Users\Admin\AppData\Roaming\{5B76921C-F710-0C00-7C90-036FED3C4413}\ByteCodeGenerator.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Roaming\{5B76921C-F710-0C00-7C90-036FED3C4413}\ByteCodeGenerator.exe"C:\Users\Admin\AppData\Roaming\{5B76921C-F710-0C00-7C90-036FED3C4413}\ByteCodeGenerator.exe"4⤵
- Adds policy Run key to start application
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html5⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fd0746f8,0x7ff8fd074708,0x7ff8fd0747186⤵PID:1260
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,10047112697166586299,11997426050685067833,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:26⤵PID:452
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,10047112697166586299,11997426050685067833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:36⤵PID:1216
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,10047112697166586299,11997426050685067833,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2476 /prefetch:86⤵PID:2944
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10047112697166586299,11997426050685067833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:16⤵PID:3200
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10047112697166586299,11997426050685067833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:16⤵PID:2292
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10047112697166586299,11997426050685067833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:16⤵PID:3364
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10047112697166586299,11997426050685067833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:16⤵PID:1052
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10047112697166586299,11997426050685067833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:16⤵PID:3940
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,10047112697166586299,11997426050685067833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:86⤵PID:4172
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,10047112697166586299,11997426050685067833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:86⤵PID:2216
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10047112697166586299,11997426050685067833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:16⤵PID:3232
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10047112697166586299,11997426050685067833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:16⤵PID:4668
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10047112697166586299,11997426050685067833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:16⤵PID:3204
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10047112697166586299,11997426050685067833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:16⤵PID:4672
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt5⤵PID:4140
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cerberhhyed5frqa.dk59jg.win/3D6F-765A-97A2-006D-F42A5⤵PID:1908
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fd0746f8,0x7ff8fd074708,0x7ff8fd0747186⤵PID:2212
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"5⤵PID:5032
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "ByteCodeGenerator.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{5B76921C-F710-0C00-7C90-036FED3C4413}\ByteCodeGenerator.exe" > NUL5⤵PID:3576
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "ByteCodeGenerator.exe"6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4708 -
C:\Windows\system32\PING.EXEping -n 1 127.0.0.16⤵
- Runs ping.exe
PID:1792 -
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "3bb359fae8694fdd6a75614aabd1516d_JaffaCakes118.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1032 -
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
PID:1832
-
C:\Users\Admin\AppData\Roaming\{5B76921C-F710-0C00-7C90-036FED3C4413}\ByteCodeGenerator.exeC:\Users\Admin\AppData\Roaming\{5B76921C-F710-0C00-7C90-036FED3C4413}\ByteCodeGenerator.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Roaming\{5B76921C-F710-0C00-7C90-036FED3C4413}\ByteCodeGenerator.exeC:\Users\Admin\AppData\Roaming\{5B76921C-F710-0C00-7C90-036FED3C4413}\ByteCodeGenerator.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1472
-
C:\Users\Admin\AppData\Roaming\{5B76921C-F710-0C00-7C90-036FED3C4413}\ByteCodeGenerator.exeC:\Users\Admin\AppData\Roaming\{5B76921C-F710-0C00-7C90-036FED3C4413}\ByteCodeGenerator.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Roaming\{5B76921C-F710-0C00-7C90-036FED3C4413}\ByteCodeGenerator.exeC:\Users\Admin\AppData\Roaming\{5B76921C-F710-0C00-7C90-036FED3C4413}\ByteCodeGenerator.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1656
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2856
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x33c 0x4741⤵
- Suspicious use of AdjustPrivilegeToken
PID:1944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5c700322a5092b34b9df91205ef7b9885
SHA1a6492ed7bdaa57608e4463780cb4ac84bf69601a
SHA25682fe04605b82edf2cafac09a6e31bdcdef9bf6d2461ed2b1ce76a7c9c70ebadf
SHA5123ff85af9b7eae3b5e770ab9d7cf073d5eb9f3249b69722c3db90f3b1b35c79723d9f9de0449bf64108f26b84af082e4b6f40b86b9cef61852d732a8c75f63c1d
-
Filesize
10KB
MD502e29e5328f23509f209ac5d04ee8596
SHA152b4751aece32b5fac7b6d4e8582b20e026b532c
SHA256483129b4ee58aeb614750a7c7f4fa4fcc46ffbf66ca474025f10e9980898fbb3
SHA512af95dbced40debc2b0a9174d663ca1acc0ceaefaae666596140e8e4f6ff28d5b6ed3f972a1b3355412767c974cdfe1605e1a7fdc7047d373b69feae9c0ad3e56
-
Filesize
85B
MD5b0e688957167b2fb55f21040906ab4c1
SHA13db3ba2372df8a61a686b360ab7b7d097bb8ddb3
SHA25687f844861cd2edce3d2d811dfd284bce5488d9c7dfa414eb26d67d9cb6fd9e9c
SHA51242a173549f0d928161dc9eb97aad1fc9ac1a6af5efcc2ebe67fde72e148fc3e7fea0d616dc365a010853fb5616990db7616138900373ec17160c420891173a43
-
Filesize
231B
MD59d8c4bfbd009c4d6001e2125abaa8b02
SHA1cd040558172b5fca5b200447a281843956243741
SHA256a652297987f14317100f8c5f7eb26d1bc67eb8a64f0b39b72b5fd5046a9f29b0
SHA512c4c84f43642b805a105acce9ebc9f01aa0e6ef553ea32be3f8b890fc7440f0b7d3ddf99b9336bce20ce7a3d9b9f6434a704651a8af425ffc8407ba39d5de735f
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
6KB
MD5cb784c3369dd0adaafe494acecd38afe
SHA1634ff667cf544fb6f0673d39f3b835984e10d6ec
SHA256d444af6beb05160020e5fd4affaf5b4a0702766cf263f92e2801c1d5940301e5
SHA51243f9cfe2950abeb95d78b4db1db5a65ca60bd67b77121b565e42b9c3c2cf2ee63f792969f29f59bf6700f0ddeb961bc999f3dbdc4b061df0b634a75fcaa5d700
-
Filesize
6KB
MD53b84307435c5cef28ececa261daa4cfc
SHA127404fdc7a1daaba8144073983aadf05d7e5a6ac
SHA256f3de56fbe3297dfa066f4f786cb1459eb9102ce47e41cee997132b631067f11b
SHA512333b31afc70df7dc2a3e68baed08c0cf882cf798845ad7bcac53849a72e27fe58f36f15eeffc759e0b50ec46dc663067605e62efc99fe0ffb335e69bd5df6b6c
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5986053a78da947af124c9e5f7fe7df44
SHA12cede0f82e5d92ba2bef46b77e298a5071d04484
SHA25677110f60bac4d87c15824ae87dbedcba17bb7581d1cfc14aa2b725c9dddc798f
SHA512935720c9ab55658f10afcd200e4e38e6b34ed223a2a05442c412644c079f9f06c12339ecbdac29285de89da70b3bc79298731fc6f5e3879627958d651fd0cb01
-
Filesize
11KB
MD56f5257c0b8c0ef4d440f4f4fce85fb1b
SHA1b6ac111dfb0d1fc75ad09c56bde7830232395785
SHA256b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1
SHA512a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8
-
Filesize
906B
MD5821b4b1bfebd42f747465153006eef8f
SHA10283713c0f75aeb9ff524268cecbccea3c76a735
SHA256d1fae5d438c33909d34190ce684e1f646420c7cafd402008a6b251e1b0910e76
SHA512e18008e287b2f8ad6465836439d526710586a6bf0e1f77f5363d38f5fdf3115d41aa48bc49ed6de3ae279c256f8407414e6028ff6ea4b0532079dc411f4b834c
-
Filesize
210B
MD523af64900b778de945301e160052d5ee
SHA19fc8829c7b36d8d9fae1db17af27a91d4fc4cf0f
SHA256929c07c9b3f3ec1d4aac25bbc8f7d38b3fe507b2433e7d76bd7cdae12e01f0d8
SHA512179c24773e6e9de0cea15b30e9c19a2acbafa3a04b8b9f7d5dace99a63aed8dd53d5b4008ee2e2ec423e4c5effa4763a853bcf6f7f76a830d1b84aaf6f9cc449
-
Filesize
524B
MD5c1499bab3b267f3cae9da5c2bb1d0852
SHA1b3d22f0f91ab2f48797fa87729b1ea62739251c8
SHA2565b0f22c90efa9627d7e16179e0ca713cf596aac5850d776a9c619ae6cc6baaa2
SHA51210bef0c4bdfafc2bf98c6cacea3a3bdc652e028df268111caf42961ac1f89b78c958b6f781d8cd8063e4bf90a231d0efacb2f5ffc2859e71101991d1c23211d9
-
Filesize
1KB
MD5c6c33cfde9f637e1d2b8cad9353df6dc
SHA175cfd127ec1fe9a140c78bc84164bd35214ced1f
SHA256c28770c5d1ec815ce63a33cfec8aabadd21aed84d60f000ebaa2d13e2bcbb0ac
SHA51266bf5248914ce0e6371a8e0cb12f9a3cc573928488f67dc714d5a6605ad61d01aa5b308f13ab7f3ecaec0ae502a4c279e1bbf1280d4dd41874ad2614e132080c
-
Filesize
1KB
MD5b15a2a53249dd89c355042688fca2f0a
SHA17fb9ee35b128ec49babc26929e5706318fb5b961
SHA256c79b8c6820105329bb3d20695aa040cfcf413ac3e4ddc3186cc915f4c67fd6b9
SHA512690e92d7a9ef378172fd092ae320642bbd51e76007ae20e364765527fbd69b27b7fc7e6c3783fa276f5f6343281559051a96766ca8001aab24208910d2a1268c
-
Filesize
1KB
MD52203e77327cb6c191bd29f71baa4da3b
SHA1cde0311412aefaddf3af73dd3f3c5381c4aec486
SHA256f8ce38607487942c77eed8afc691fa1ac7b2e408ee275f401830346d22ab1336
SHA5126430b5ffc8b2ce3eab83f4513d5f41a7ea46cbe12724e6510a62d08cb281bfdf390e5c5a0d35fbe464791be835d8ca8d38ccf67e3a162f09ab7d000f43e17504
-
Filesize
1KB
MD5c7df00e9e0609d4216bb7404dd9c12ee
SHA13aac5a61dc12fcf9fd23280d8fc6361ef734c524
SHA2569fa88627e300794f3f5f657aed1a58a447d4cd5ce6989d49d62dca9507c3d9de
SHA51287427aca49cf20aa8d36541f589940b23e42d60eda72965f75ebdbb8342a19198c8625b8d4f9c71b4444d14ca99816d314991ff1e870da3437cbc15453d8e47f
-
Filesize
1KB
MD51c7d2b2fddd34b82883053f74613a7f1
SHA15ded4a3340c5baa2f7875a09234200662a5fb6c5
SHA256f42aa8b08eac61b29a5cddc51819a28a692b69480948f7d003485c0dbddedd8b
SHA5122d54662a2a3f852d88e27232a93e5807bfa84be55460f4d9c9d2082d22e7818a337d75edb3fcdbf2fd5e6e34721722df16ada243576ace9598701a51797f50db
-
Filesize
1KB
MD581fa79dfd944fc960b1a93e7e242d13b
SHA15e1534edda93c74c30e2bd1b07adcd992f70b1b1
SHA256d52f3713b6bb99d5a124f352654ea06e6856d521b354b75b8662babf4f2bae9b
SHA51236b3752c5526dd38f933cd5d430493ebe60779c1dd39076e5fd137d82dd750be95a4e0a01d2bb318df174cb710ed5e8694274330052d11fc638d149844612836
-
Filesize
65B
MD537c07111b62abe453738fa8012de67f0
SHA173f433e6f448686ac56d53de706959265a0cd75e
SHA2565ac00f4bda4d4894507262207ff8ef4ccb5371457b4c6c6f12ad8048f2856b70
SHA512604952277f0a54fcc5307f78f255ef4bca6d6f0c1f1aea2c70be845760e5f2ab92e997021905b04e6f71e0ddefa320c78a5857bc9d644b199a1556e9fbb1fd18
-
Filesize
3KB
MD503016d6b79313a63773d97792ee13889
SHA153817df4ead0586b47b12ec3bb8af2e130f3c360
SHA25638896b1f0903a9a577d129e2dfd3d4c2cdc174031c79c7fca943870a1538280e
SHA5127bc24ec4b4d28a3eb260d636652e72884ca9c2022ad0d04cef08e7907828396c71ccafc8d7c3605c6b7a67784db6837209e48e498ea491aad1b149a2d6c73e15
-
Filesize
1KB
MD588dbc6c76db7bfcbe320624f0a10fd8f
SHA1f2499cd551b11f788a07c5e96aadd49fd298aa88
SHA256a2142a3b7003bf9292edb1285f75455425b7f118d7edef631b127c2fed8e50d8
SHA51273662a02ec312e348e6dabe7705a2b68d53d5c55b48c4e3ad70ab8b0a7b5c4914024b23cb8a0679b1d846130615dcbb60fae683524d95106ce9994cbfe0e8160
-
Filesize
524B
MD58219a136a0e9eacd2fa9691cc4bf19b3
SHA17fc56e6b38a06db751c70b94d595347a9e2b8f57
SHA2569975e2a9c729b708744650d688b3c6222bf3c8c824bae9ab7f1337d8447b7bbe
SHA51237f10b63d14d9870a02b290f735ff893adf03d775d8c9aaf2e5a5412ee611ea6255536ac5d58938699f07dd18bd52d50b302378b1522e2b9bd9b210fd5e59e69
-
Filesize
1KB
MD5000f1aa3dde140d63ffb7c3a0bb9c3fa
SHA18897e631ed08248fbde270c7ce87cc2d2d078766
SHA25627a661ab3534b748e9725a567628e8341c26f8fa1eb157eb9027c68a40c3146c
SHA512a7bf610832e4412e65116eeebf279008834add76df92491c7aaed63669a465421e26d36febc3f3b846cd047b125550b3e70c5e6a9737a2eaa0e0347a1dd9ac62
-
Filesize
2KB
MD568ba9ca1e541c73104daf446938e5583
SHA19d863f17dfbe0e7ac172fddbcc5fde8e636d49ef
SHA256d6a643978fd39cf31494da165c80d655de92565c834af7457cd2828fe7548a09
SHA512023cad6108ad3d505f8d9ca340f004bee44f74817a43cc94a6c316fdbc1346b3af9a16c887af55cb6942370e84df4ebdeadd8fa8b4e335a2365f41cd4c1ed525
-
Filesize
27B
MD537e9ac1310a963cd36e478a2b59160f8
SHA11406eaa01d4eea3b26054871f7d738e4630500e9
SHA25604c9e4b0f69a155074b9ff26351265f78090c7ea2f23c5593b7130b4eb1e5e32
SHA5120ccc4e958bd34c2a28dca7b9fc3e9ca018ffc6c54d0f24e3db40e86f0bfc5a232228288cce38350bf8140b98c74658d2616e2ef15b2a085a590711cf975982e1
-
Filesize
77B
MD5a1593e9a0d43137ed13bc8019793ba78
SHA15f84bbc68a7eb289c2a8bb28ac3cb1d99368dec3
SHA256a7be0b24e37b0c550a6ab178184064039d200f483f4272fed94c327bd54cd00c
SHA512723f6ffc3972b8c5f349dd54d8368b157198faafbc9e04318488c277039dc4a9fb337839e39623f55900c4f8de342a07d9a346545658906e90c863302f1cdee3
-
Filesize
65B
MD51a0cd67849ba6838a932d4262ff46d74
SHA199788865aa999c0323499962d046d75e03328add
SHA2563412ba05ce0600fc8ef25d34835c39a067c1512c8895956e87d3c396360044f1
SHA512b1f431c3e24b585c0c3e7487b4fb1505dadcc27a3c8e02987fc78146f5722977a7e6593422f9ee93f2b6befe9262378dbff47451e74198068ec4ff9e43dbf4c6
-
Filesize
73B
MD55f63c2c6386a437d45f29cbefb77e5a8
SHA13d36822bf661b3bfbf4b109795240d656fdde839
SHA25656397e82ad82822d7f90bcbaf470cf740ff525ee7a67058d61296c54ea130c40
SHA512c5b71737bb7ab5fb9aad49bd9da91fa397a2f7ff7e3f8b977a27a34f1313f169fa9689bd2e2e9c7eacc4c69cda460a7f153f6cda91ada00d2bada20e9e86c8f6
-
Filesize
1KB
MD50b8717be9826ff70ed75c74131f1a776
SHA1471eb762c3dafc031ac6a790c7e9201a4f644d60
SHA2560759787339284a189592ad2a6b8aea00b7c3cf37354ffea6bd9979348d14387b
SHA512710ebe69e5fef8e57903b588ec453daf6507072f2b539e14c7eb284de96092b573cd2d9e4701ed4cf9773ad6bea77de5fa26cd402d74f54f0ce6733924e4f4f7
-
Filesize
509B
MD5e48f88be96ebc26dbb0ffcc604997483
SHA199f857985e9eeb3e78b1d07ecf93701349a1772a
SHA25671b97cc87cc10a413bd1ad45e5c131d99acd5053d7a326bbbc8e041b0b1c4926
SHA51286221e10d4626779cda787e3b83e4d5f042660b6e5ea31f43c448fc831b0c6a26ea749699bb9676362984c6e798df1e6bd4a45b6897599e5e17d0efda8949ced
-
Filesize
1KB
MD5b37db354d10a73ba88288164bb13182c
SHA13649f45a56cf71a0cb551315372546700cd96a0d
SHA2569840c3e72436433614eab701e18e61f0ce0ab924a9491629463c949186dace4b
SHA5128afe3071ba61ed20c2034c7501d8953a5a7d313bf4acc1a69f50f369296ad4e34df895c039eadf97afd543b4c4dc27e2d0532705121158ceb2a186725ba76bca
-
Filesize
27B
MD5834630bcae89f566789c6e3abb9cde0a
SHA11937e7784e79fd9a6adbc2b4a227a6bf9455dc86
SHA2565d9e7b18a4cf92f1d47164f438ed6515657d4ff8f3d2c8bb5a1f7b605d79cd61
SHA512835b29bd2acb63abd813ded66df8f9d895c83cce8e38cec1f21c266a6d6992965efb6fbec8e87bb74f24e3321588ac94d16be5fe0eacdf9dc80e6ca26dbf0061
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
4KB
MD5d1d39acfafe6f1ddcc384a8ba0783cc1
SHA16f3c7e7ea8e5bee766a96eec9d01ae4befb7c397
SHA25617dd35b38be655f27270cf4d7f435d1234f829d7b9cedb3b8bf6cd695462de1d
SHA512db4fd5c9b31cdf01f4625240d017a0a365645ec24b014e42160dee14bbe4b1c65d9cc99b424ea41e5d44aa60c825beaec51dfa70b5408515b0baaa4a5bb92973
-
Filesize
28KB
MD52253b404214169a1825ee9d9a7bf6887
SHA1cd3368fc8ae4a4e31e74a20d8af65da6f0afeeed
SHA256a8acb6997a668157ec4a4ca08c4a95f6be32e84a5ab14484ea2d1e078ceadbab
SHA5120ee2b98fc8973bf02d7f1e59743bc095bd5201c4eb2d22b87ff7ef550bb9189f191912ed8899bd6f552b35eb4e89c373462c7f5b52e4c129ecaaac7fef7fc091
-
Filesize
1KB
MD58b18b407f67a186baae050cc10519ef4
SHA10ec2e5c5119b161abd4baf1563d7c9d813f5a78b
SHA2569880264c5f0daf42d71d6d126db7600cdd271ad90dffcd97ec35ada209e88812
SHA5120db28413f722d1d7f2576c6415b90b21e04afb7c03ac2d90f95d067e1c7fc233c45d864ca7f4fb994c601b491bf24f173a03c46bcfc63c847015ba874d7d5ad0
-
Filesize
125KB
MD5a022b6fd48f1bb728a238b3926847883
SHA16bd680e90456fd47cb27241a2b4b218eff8db955
SHA256bba14249bb7dc24fe72d5b0e59f8892b1cc900764203a84779c3c8f65c62b692
SHA5129738ddf73df9523ac063c73286d277c6dcc3cbf96f10c613909bfc1bd6651f49c815c9ca186b9bf01d6b150f92e1753ba4caec90d92c7b836fd0ef707bbc93a6
-
Filesize
1KB
MD538727b1f8ac211fe5ecea748c5945e2b
SHA17f3a0bb1997c8f6409270bf6ac6240c2b341327a
SHA256caaf6e3e0b865203fe5391f9892f60530f5ea675b57c1d78db94aff9c0fa6b0d
SHA512395458ffcd004f4bdb91d8260a05a3b33df029b1df8cc0db91deb30b87fcd2055cc6b2c70f38ef337f1faf5fea3d8392dd5a01970ab9341ac58d00be6843d586
-
Filesize
4KB
MD5ea8786a9e8c53d4136b57da721d3a530
SHA1ee83b68c4c9f40b3d3eb4a04f61d9952d7513a0e
SHA25685835a7c2f33dd24fd15d48f288ef0a8e07745611a08bfe6dcb9b8f547321f2c
SHA512b7e4095ed87a7dd922a6a5afbb02acd7e4761c03645819a6c8690b56296f8839db2e355a1bb83d243a42fad4e5400a6f873f8d6caf9a1eee9c6fd86951511016
-
Filesize
1KB
MD54190e588c160ac5b36f115af7444523f
SHA1f688118564de21f505c00d6aa7a4d33d8f6c748c
SHA25608ee68e1658706664de60264f8d5ed5e589a47fa98c6f672ec221be7a22edb58
SHA512a99cdf25224abb8002f1fb9b649d608d54003fe2570fda5c3139291839fe0f9f4f57043e81face78f66d26bdc84534604c9255d4c8de1f23e3f8c8b51ccf008d
-
Filesize
4KB
MD56c72db1b45988d2ab3ec789f26965c0f
SHA12aa66e42673f62528ceca11b87b33f442b2efe51
SHA256559e9975be454facd6b59812348eb410d46243f844316b8d4b28b1ede450fdbd
SHA512e6913cb2b991e92617b142b78191b2447e326bf3c29372e38b6bde650f273af3cf3626e431831729a7d51ee7582bb6f9b7ef1dc0460b543293ed91c54a9cc7f6
-
Filesize
2KB
MD52706a9691f646f678220600f5a3da66d
SHA118aca6b122fb4eeb132ff80378a3ebc5c7e76acb
SHA2565709aef07360ffe1cc827e1f77d0c23d5eb97d5f328ac8293911aa888dcf4ba0
SHA5128263f29d2dc33e2060c8c4b5ca34abff26a3c79c08e019f9b3eb3d8cc6504f26786a65ea20ae968ae5f42dda9c6a446a4394ca0886003c50bfc068b9009609b6
-
Filesize
2KB
MD52f52e36cf52975276c291c58097de746
SHA1cb53160cb419c7b8b2c5476c239d7c225dc70d13
SHA256fbea1df97ded8b7e80be42913632daf93c053ac27b2ead40e3fb2b05fb68c270
SHA51243bf11ebef9418d53b8b8d5e91a92bb0bb4fde7e873eb17b0377ebad4680ebdde39493caceafb4a1b0405241ca2243de01347b006038ab05c321edb91a565bf1
-
Filesize
2KB
MD5ee1ea399056a74f3e90996b198b23533
SHA11bf06bc18cd19e769a23fb1c7dde3ac82d1dc05e
SHA2560d5620c426c14276135373978f381b53dc5d0fd0b9c3ec0d07e597eb53f8c3ae
SHA512497222110bb4698ef6034b166577c53c9c06b48c26bcbe2dfcb97299fee0aed7268e3733c171a019ddafe92cbea10795cf3ae2995bfed94e2127a9e83c09a0e4
-
Filesize
1KB
MD5ec19d87bf31be0f9022d069803f67073
SHA1fd8fbc60713955a4a895904da7970f13f815acd7
SHA256e7b4fea1f0f74e66664301e1a34e4a6017fcb04aa6d249a38b901f8dd8fb3732
SHA512df5bc4aefaa26ef5d47d2902c494242d1167cdbbb34e661894af0ca0b76192e00c27bdeb7d2d5dab01b3452e109c11824ae8715a0c5113dbef124829e9574b3d
-
Filesize
528B
MD534e2a72a9cb9e873db413b020d7f1845
SHA133138bd1581d3179e66eb921e1f65b7e8766cb63
SHA256d26464766b63c4c361821355ca7a36ef288ef72fd6bad23421c695e1dd527743
SHA5128d9e5fec081bf5ac6e4a174afa13f3ee108d7a3e917151c6fa2e02d313d01c54f5c33693ae6e8113e51a192b9323ef469fe0fca5b4e149b2f736132eb73b73a1
-
Filesize
2KB
MD5d3fd7121b844308f5e0d98218b25f7a1
SHA157eda098a5ac50befbbaed81c9358542508d2025
SHA2563f19660f2ffcb1b75ce092e05a9d02128025f89a378cfa302a3fe406c065139b
SHA5120512e3887235754102c623ba704421c745f43d5300a8dd31cc79d1d70a537158dd5a2a25e8e0eab69dfd8cfa234a437ebfa89abafb5c31dcaf28f745a17feca5
-
Filesize
972B
MD5ac8e0414bc16801e3e58d6029e47534b
SHA177001314a185248b7402a84cc6aa0b87073e9698
SHA2568b4167909f78b9239adb70a5791808fb8ef85a94eb5f3594c423274297fa5b73
SHA512286540b92a050f4c56f8e06115dd70a1aef480291584a82c8a868e5eaafdaece5808ead382a24e9817a25a1ac339cbee39f9cdf22efce3f2c997790456e00eef
-
Filesize
3KB
MD563c3fbdaea6269b62a8a84af11570d19
SHA107c6fd132f11a9b13b3ade80a9c4cee7c3b194ac
SHA25609b825bbbe494f6c4658facc9af64608e851f8ebcab93ba3543dd3f001c32361
SHA512a80950ec91bf6926cc21f66f79cb8e1b46c7da484849abb00f08e1baa041257b16be34e60f37fd0b1988b5767c6a441ba16ecd8e48ed1dff3ce2c29743740018
-
Filesize
4KB
MD557bfb2528a26d008681d0ccea8b393f1
SHA1fae2882346b4e11f50ada12d3d4ce8cef9213a2c
SHA2569837b4662b61ecb91ffa3556394f2df67a87a7afe03fdde237fd1bfc42de1ede
SHA512c46949dd9272d0ae92d402ad9dbc9919f662c54123fb61718b92c3564b7188d61e69c9a11f71fe0d3033e809665944cc008b0a72fd853dcdf42045d1be422139
-
Filesize
3KB
MD5b802b4cf189092a532bbbd9967a9e5d4
SHA189a6028b6f8e411a15c7485069a4e140581bf3f1
SHA2566e84653150f3ce4f0ea92706dd21449fb8bda9ac23f6e57baada92b640c44c48
SHA5125ee2e8da5aa21d13a4ae8b06925fbd433ba00ffe71e806d1f99d0decd78ba6950934dea82d9b446283cfdc53c19123858548fe7750a7dc976c6fb03e6c0b744f
-
Filesize
46B
MD5af3bc9f93007146857ec5a55e32702c6
SHA142cc41386c2709a53b8ffa4552790e164e4db59f
SHA256c552f73678b4e4d8a9c28600a4a3a3a611e2badc2c9f91ce23ba734e6f7a4858
SHA51219f2908f53b74778ae8fbf2b25efb9a05871e114382601cc6092335eb9b0fa90da10cff4384bca946297f4334c26e421b176dbda7ba0c6fd0ff3e81851701fe7
-
Filesize
2KB
MD59c9a95e738765fc608d7c4e76b2f35cb
SHA19dc240f7154d9aaf682906a987f141b3dd4be7e0
SHA2563c33893b88336ee1a3b8371c05ce32b51010b5ec73f67af002d53ca66174534c
SHA512aab54fde37e68017852729846f7fd77db36bd38ba20ad2991ae95c534fa85c518e1d837c308db87c88412877eb5742555f512053b537b16d032d291cc3cc01d1
-
Filesize
1KB
MD55df70341229c64119f1ccfecd521afe4
SHA12a1459e2e46a40d4219b103f899db74595ef91af
SHA256f58413b52a5e58096496a0be07a26c0515b18b6bc07d7568ab97a04d326ea4ff
SHA512797ecf22c01f4fa98ab8da266620d2eb8e5087e1944dfd9c115bcd8b437299516daae0192c9f539da3dc655f3722e7e64139b83dbe7b070cb7d2e6daf7269690
-
Filesize
1KB
MD5b9c8db5dd26818a63fb9e031739f8fab
SHA10237909e0b39d6826bada9b63a811925719ddf51
SHA25698cf791cd08a24c5ca85b59be971caf7776af6d31ac812e3bb949a20f7332ef8
SHA512c02cb2275c8e0dba6e997fd04405d84aaeb65a3ea3be89d2632cf0a979fe888fee8d85f0068b807b017b1a52eeadd2dba6dc8fec36f95ee3078d5a2c1a8a3fe6
-
Filesize
524B
MD58bcac734d9e8c2752796785aa44f5cc3
SHA1b30a40b93536b9d89bb5eed3ff141af48dd1cc98
SHA256b354357c228c1a5fe6689a59286d56665c1a85c4dd23df860539e868f0311b78
SHA512a89d288e5e9ea1c9381f1bcf074c67611ddd8fe798cb54c6291110259e5d37a9fec993bf3c7acdf549ed8eb4b233f84493b0ddbb4e59e5f4c482923fc5495101
-
Filesize
203KB
MD53bb359fae8694fdd6a75614aabd1516d
SHA1ada8813519de455b58f6bab4541073d65cc53eac
SHA25606c1363d352171272258a27cd7fbea8f1fb6841f8e74185230885311b35acb55
SHA512fe1a6f851e89487289d4284888070a8fd5b2477da2030f5bd8d3a8a66dfb7671785cb79913a4a60998717ed367a4d0487384256a0c1a27a709ea812b4406e75e