Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 05:42
Behavioral task
behavioral1
Sample
3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
28 signatures
150 seconds
General
-
Target
3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe
-
Size
255KB
-
MD5
3383d302b05d28bc170a5b64a81549d2
-
SHA1
efe9207b79095f0dfba98c3a8b9f74c1cfbe42db
-
SHA256
763f21e8ee3f12d5b44df48d69cb6b8834806f04cdc8c051cb04ada437cb7299
-
SHA512
54f0e9dc5c35166c1dc2087f4826f28e405a92c00f3ba04558f1c47b4c7eacbbe56e511a36e86b4430af34c6b026a48340612a45b0b479fbc88af2c7505afa12
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJe:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIr
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" fpnkubbzxt.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fpnkubbzxt.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fpnkubbzxt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" fpnkubbzxt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fpnkubbzxt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" fpnkubbzxt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" fpnkubbzxt.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" fpnkubbzxt.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe -
Executes dropped EXE 5 IoCs
pid Process 3656 fpnkubbzxt.exe 4820 ykkvorzoewvshvw.exe 3356 petqayhk.exe 1792 yilckcyjdmyde.exe 116 petqayhk.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1440-0-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x00080000000234cb-9.dat upx behavioral2/files/0x00090000000234bb-22.dat upx behavioral2/memory/3356-27-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3656-24-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0009000000023470-19.dat upx behavioral2/files/0x00070000000234cc-31.dat upx behavioral2/memory/1792-32-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1440-35-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/116-37-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x00080000000234b6-63.dat upx behavioral2/files/0x00070000000234d9-69.dat upx behavioral2/files/0x0008000000023311-75.dat upx behavioral2/files/0x00080000000234dc-81.dat upx behavioral2/memory/3656-95-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/116-102-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1792-101-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3356-100-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4820-99-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3656-103-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4820-104-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x00080000000234dd-108.dat upx behavioral2/memory/3656-112-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1792-115-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3356-114-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4820-113-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3356-117-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/116-116-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x00080000000234dd-118.dat upx behavioral2/memory/116-122-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3656-123-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/116-127-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1792-126-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3356-125-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4820-124-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3656-128-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1792-131-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/116-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3356-130-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4820-129-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3656-133-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/116-137-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1792-136-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3356-135-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4820-134-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3656-139-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4820-142-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1792-144-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3356-143-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/116-145-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/116-148-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3356-149-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3656-150-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1792-152-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4820-151-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3656-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4820-154-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1792-155-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3656-156-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4820-157-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1792-158-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3656-180-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1792-182-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4820-181-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fpnkubbzxt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" fpnkubbzxt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fpnkubbzxt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" fpnkubbzxt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" fpnkubbzxt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" fpnkubbzxt.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kxdoyvbc = "fpnkubbzxt.exe" ykkvorzoewvshvw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tbdlktvd = "ykkvorzoewvshvw.exe" ykkvorzoewvshvw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "yilckcyjdmyde.exe" ykkvorzoewvshvw.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\j: fpnkubbzxt.exe File opened (read-only) \??\v: fpnkubbzxt.exe File opened (read-only) \??\k: petqayhk.exe File opened (read-only) \??\m: petqayhk.exe File opened (read-only) \??\q: petqayhk.exe File opened (read-only) \??\x: petqayhk.exe File opened (read-only) \??\v: petqayhk.exe File opened (read-only) \??\o: fpnkubbzxt.exe File opened (read-only) \??\q: fpnkubbzxt.exe File opened (read-only) \??\u: fpnkubbzxt.exe File opened (read-only) \??\x: fpnkubbzxt.exe File opened (read-only) \??\l: petqayhk.exe File opened (read-only) \??\s: petqayhk.exe File opened (read-only) \??\u: petqayhk.exe File opened (read-only) \??\p: fpnkubbzxt.exe File opened (read-only) \??\o: petqayhk.exe File opened (read-only) \??\r: petqayhk.exe File opened (read-only) \??\k: petqayhk.exe File opened (read-only) \??\a: fpnkubbzxt.exe File opened (read-only) \??\g: fpnkubbzxt.exe File opened (read-only) \??\i: petqayhk.exe File opened (read-only) \??\u: petqayhk.exe File opened (read-only) \??\w: petqayhk.exe File opened (read-only) \??\n: petqayhk.exe File opened (read-only) \??\w: petqayhk.exe File opened (read-only) \??\b: fpnkubbzxt.exe File opened (read-only) \??\e: fpnkubbzxt.exe File opened (read-only) \??\p: petqayhk.exe File opened (read-only) \??\x: petqayhk.exe File opened (read-only) \??\y: petqayhk.exe File opened (read-only) \??\i: fpnkubbzxt.exe File opened (read-only) \??\j: petqayhk.exe File opened (read-only) \??\h: petqayhk.exe File opened (read-only) \??\g: petqayhk.exe File opened (read-only) \??\n: fpnkubbzxt.exe File opened (read-only) \??\r: fpnkubbzxt.exe File opened (read-only) \??\y: fpnkubbzxt.exe File opened (read-only) \??\e: petqayhk.exe File opened (read-only) \??\h: petqayhk.exe File opened (read-only) \??\t: petqayhk.exe File opened (read-only) \??\e: petqayhk.exe File opened (read-only) \??\i: petqayhk.exe File opened (read-only) \??\m: petqayhk.exe File opened (read-only) \??\a: petqayhk.exe File opened (read-only) \??\g: petqayhk.exe File opened (read-only) \??\k: fpnkubbzxt.exe File opened (read-only) \??\z: petqayhk.exe File opened (read-only) \??\o: petqayhk.exe File opened (read-only) \??\n: petqayhk.exe File opened (read-only) \??\q: petqayhk.exe File opened (read-only) \??\v: petqayhk.exe File opened (read-only) \??\a: petqayhk.exe File opened (read-only) \??\t: petqayhk.exe File opened (read-only) \??\y: petqayhk.exe File opened (read-only) \??\z: fpnkubbzxt.exe File opened (read-only) \??\b: petqayhk.exe File opened (read-only) \??\b: petqayhk.exe File opened (read-only) \??\z: petqayhk.exe File opened (read-only) \??\s: petqayhk.exe File opened (read-only) \??\w: fpnkubbzxt.exe File opened (read-only) \??\l: petqayhk.exe File opened (read-only) \??\j: petqayhk.exe File opened (read-only) \??\p: petqayhk.exe File opened (read-only) \??\r: petqayhk.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" fpnkubbzxt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" fpnkubbzxt.exe -
AutoIT Executable 59 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3656-24-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1792-32-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1440-35-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/116-37-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3656-95-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/116-102-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1792-101-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3356-100-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4820-99-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3656-103-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4820-104-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3656-112-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1792-115-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3356-114-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4820-113-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3356-117-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/116-116-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/116-122-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3656-123-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/116-127-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1792-126-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3356-125-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4820-124-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3656-128-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1792-131-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/116-132-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3356-130-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4820-129-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3656-133-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/116-137-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1792-136-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3356-135-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4820-134-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3656-139-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4820-142-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1792-144-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3356-143-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/116-145-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/116-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3356-149-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3656-150-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1792-152-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4820-151-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3656-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4820-154-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1792-155-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3656-156-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4820-157-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1792-158-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3656-180-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1792-182-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4820-181-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3656-183-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1792-185-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4820-184-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3656-186-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4820-187-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1792-188-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3656-189-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\fpnkubbzxt.exe 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fpnkubbzxt.exe 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\ykkvorzoewvshvw.exe 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe petqayhk.exe File opened for modification C:\Windows\SysWOW64\ykkvorzoewvshvw.exe 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe petqayhk.exe File created C:\Windows\SysWOW64\petqayhk.exe 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\petqayhk.exe 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll fpnkubbzxt.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe petqayhk.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe petqayhk.exe File created C:\Windows\SysWOW64\yilckcyjdmyde.exe 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\yilckcyjdmyde.exe 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe petqayhk.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe petqayhk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal petqayhk.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe petqayhk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe petqayhk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal petqayhk.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe petqayhk.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe petqayhk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe petqayhk.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe petqayhk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal petqayhk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal petqayhk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe petqayhk.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe petqayhk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe petqayhk.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe petqayhk.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe petqayhk.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe petqayhk.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe petqayhk.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe petqayhk.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe petqayhk.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe petqayhk.exe File opened for modification C:\Windows\mydoc.rtf 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe petqayhk.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe petqayhk.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe petqayhk.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe petqayhk.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe petqayhk.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe petqayhk.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe petqayhk.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe petqayhk.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe petqayhk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33452D789C2783546D4276D270242DAD7C8665DD" 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2ECBB12F449538E353CFB9A2329DD7CD" 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF8FF8E482C85129133D75D7E9CBDE7E136594A664E6343D791" 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh fpnkubbzxt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" fpnkubbzxt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf fpnkubbzxt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" fpnkubbzxt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBCFABFF966F2E4837F3A4381EA39E5B08A03884215023AE1BD45E609D4" 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E78368C4FE1B21AED179D1A88A7B9110" 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat fpnkubbzxt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" fpnkubbzxt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs fpnkubbzxt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" fpnkubbzxt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" fpnkubbzxt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc fpnkubbzxt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" fpnkubbzxt.exe Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1944C60815E6DAB7B8CF7FE0ECE334CD" 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg fpnkubbzxt.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2656 WINWORD.EXE 2656 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 3656 fpnkubbzxt.exe 3656 fpnkubbzxt.exe 3656 fpnkubbzxt.exe 3656 fpnkubbzxt.exe 3656 fpnkubbzxt.exe 3656 fpnkubbzxt.exe 3656 fpnkubbzxt.exe 3656 fpnkubbzxt.exe 3656 fpnkubbzxt.exe 3656 fpnkubbzxt.exe 3356 petqayhk.exe 3356 petqayhk.exe 3356 petqayhk.exe 3356 petqayhk.exe 3356 petqayhk.exe 3356 petqayhk.exe 3356 petqayhk.exe 3356 petqayhk.exe 1792 yilckcyjdmyde.exe 1792 yilckcyjdmyde.exe 1792 yilckcyjdmyde.exe 1792 yilckcyjdmyde.exe 1792 yilckcyjdmyde.exe 1792 yilckcyjdmyde.exe 1792 yilckcyjdmyde.exe 1792 yilckcyjdmyde.exe 1792 yilckcyjdmyde.exe 1792 yilckcyjdmyde.exe 1792 yilckcyjdmyde.exe 1792 yilckcyjdmyde.exe 4820 ykkvorzoewvshvw.exe 4820 ykkvorzoewvshvw.exe 4820 ykkvorzoewvshvw.exe 4820 ykkvorzoewvshvw.exe 4820 ykkvorzoewvshvw.exe 4820 ykkvorzoewvshvw.exe 4820 ykkvorzoewvshvw.exe 4820 ykkvorzoewvshvw.exe 4820 ykkvorzoewvshvw.exe 4820 ykkvorzoewvshvw.exe 1792 yilckcyjdmyde.exe 1792 yilckcyjdmyde.exe 1792 yilckcyjdmyde.exe 1792 yilckcyjdmyde.exe 4820 ykkvorzoewvshvw.exe 4820 ykkvorzoewvshvw.exe 116 petqayhk.exe 116 petqayhk.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 3656 fpnkubbzxt.exe 3656 fpnkubbzxt.exe 3656 fpnkubbzxt.exe 3356 petqayhk.exe 4820 ykkvorzoewvshvw.exe 1792 yilckcyjdmyde.exe 3356 petqayhk.exe 4820 ykkvorzoewvshvw.exe 1792 yilckcyjdmyde.exe 3356 petqayhk.exe 4820 ykkvorzoewvshvw.exe 1792 yilckcyjdmyde.exe 116 petqayhk.exe 116 petqayhk.exe 116 petqayhk.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 3656 fpnkubbzxt.exe 3656 fpnkubbzxt.exe 3656 fpnkubbzxt.exe 3356 petqayhk.exe 4820 ykkvorzoewvshvw.exe 1792 yilckcyjdmyde.exe 3356 petqayhk.exe 4820 ykkvorzoewvshvw.exe 1792 yilckcyjdmyde.exe 3356 petqayhk.exe 4820 ykkvorzoewvshvw.exe 1792 yilckcyjdmyde.exe 116 petqayhk.exe 116 petqayhk.exe 116 petqayhk.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2656 WINWORD.EXE 2656 WINWORD.EXE 2656 WINWORD.EXE 2656 WINWORD.EXE 2656 WINWORD.EXE 2656 WINWORD.EXE 2656 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1440 wrote to memory of 3656 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 84 PID 1440 wrote to memory of 3656 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 84 PID 1440 wrote to memory of 3656 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 84 PID 1440 wrote to memory of 4820 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 85 PID 1440 wrote to memory of 4820 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 85 PID 1440 wrote to memory of 4820 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 85 PID 1440 wrote to memory of 3356 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 86 PID 1440 wrote to memory of 3356 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 86 PID 1440 wrote to memory of 3356 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 86 PID 1440 wrote to memory of 1792 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 87 PID 1440 wrote to memory of 1792 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 87 PID 1440 wrote to memory of 1792 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 87 PID 1440 wrote to memory of 2656 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 88 PID 1440 wrote to memory of 2656 1440 3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe 88 PID 3656 wrote to memory of 116 3656 fpnkubbzxt.exe 90 PID 3656 wrote to memory of 116 3656 fpnkubbzxt.exe 90 PID 3656 wrote to memory of 116 3656 fpnkubbzxt.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3383d302b05d28bc170a5b64a81549d2_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\fpnkubbzxt.exefpnkubbzxt.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\petqayhk.exeC:\Windows\system32\petqayhk.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:116
-
-
-
C:\Windows\SysWOW64\ykkvorzoewvshvw.exeykkvorzoewvshvw.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4820
-
-
C:\Windows\SysWOW64\petqayhk.exepetqayhk.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3356
-
-
C:\Windows\SysWOW64\yilckcyjdmyde.exeyilckcyjdmyde.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1792
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2656
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5e03fc96b31a876d9697b179ccc132c4b
SHA1bab32f2b136133f20321fbace2572c8b5dfdee86
SHA256a7ba44cadf64256c350e963f33baf16b08cf9dea6afb0d934858d79ae39e47ef
SHA512308deec541501bff60ef62ea8cdf76b69d74efcccb6cc9380342ed7a1f7a7e43824ca6d66f51c52a1cc79299e4d69615578cf2383d2518e1d971deb3b4bce22a
-
Filesize
356B
MD5b57a8cb2799bf8ff62bc0b5a301a98bd
SHA17d000ed3256494ac82f5d1a3ea4aa63a987f9eda
SHA2564c991def6749884e94a0fb516a1b74df885efd3849b40082215c28c02f4db1e3
SHA512c5b14413ae9ba24c7be67120b3e9791e034c984a389dc25a5516e69de68aacdc3be2c0a04dfb187d23f21aa2f29c974ef65e9a313118f0ef1bfc52b6cd0d1766
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize2KB
MD5a6ed7d840333ba262b26ead0a3eaafc0
SHA13d3b3f650de9e3929908e5329592192bab734540
SHA25642574de2f3fc2c3960982fbea764a3daee42179d3947982a3ff759385066e91f
SHA5127fcf61322281e2100bd8d8f6cd0bba3df85be585f8560cb9a208ef67b4209ebebc36c45dc04e88177e6e5f6be6f31f9916e4460f60a8f14299e314374ffd30eb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD5ce0dd2d77b16aa7da06cedac18739c79
SHA1861015c80939c8b90ee255629e646b51bdd03bd3
SHA2568b6311975006d44d5e99187718e170d7707324798cd8a9ea4ab318c8edf8265a
SHA512224f9da7afc335f699e2c254ce1ec39bc0ac948d6867e65666d05bfc99fa4e0071e242dc3308b7056c95aecf91fcdb7867b8af67b8005fba1df54242ee505f08
-
Filesize
255KB
MD5ca713d577aa5fa81d1b12c9294ce0b9d
SHA111d40ec0cbe2873bd4b5bfd50a385a2728c04e68
SHA2569177f3e00b0028f8866e1537fbb3475c3f54fc8867c7c9a383b44dcbd478f02f
SHA512c8302b38698a414387963185ea057395ad890655b40578b888a676e57945d258543162007e896f7d260ecc6bbf82f2feac56c03ea70aacd5d928a7f28cc51d3f
-
Filesize
255KB
MD5326a69192b0e8d32ace3cb14f2b546a1
SHA185c1e2259a02ece579c4d8de1964244f330e422b
SHA256c0746f3783da8e9834fe35bfb503d76cfab9e48e27f9759116d3beb7f3d409da
SHA5124ccf401cc41dbd1ac3947e9c579f754fff9cc058c1e04f46262ee702a5ab87ab6a1201efceeee8268672e84c406a106b56a06bc57f96b1d334c9ccdc48283d7a
-
Filesize
255KB
MD503d240373f548674d48661a890fafad1
SHA15584aefa270fcd018cae009b882c6994d24299f2
SHA256c6a913ded5fb2444a190d95e1e34066ef873a0b3cca81029004a24cff5b2bd5b
SHA51294459f42ebdeca76a2e93dac661705431ccf40821bf57c314c0451a23d69b64771ec45828c01a6513fbb6c7d14a7af85fff500e1d21f35e07d6abf290650edb8
-
Filesize
255KB
MD59b0166a3fd1dbc63d0f02fc0f966ec91
SHA1dfe4f436e886ac74458ece2a9650fb451309f6b2
SHA25610fe576df11659c857160e6131374bd69e78fa1ab75a423ff29625d1a1976015
SHA512fd50e5957d53b7304d8af6eeb0068062373c34b86c0aa657676a9ef40610334d29636cc42e7c6a3397a53d2d8156f8c4f67d379ad4e28defe2270ef433b03269
-
Filesize
255KB
MD513612ea053908ea4f14296d45684de83
SHA1bb339ee838b9465e0cc0d7f8e275aebed5480328
SHA25627c9ffe4c9f81f10e1125462801c644d9ce6ce8b7789aebdc685458cea68a3cf
SHA51231ea777956390cf5499199b82fab1b52e04e86bcc366ab72ef4f9d1001deaa7fefdbb8fe3249c86f939f6ae06ff009513e6ca88be5d5f2629096bc81d8840ad8
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD56a0bbecc07a086228c7a2d4f1563649b
SHA1f0754c40c5f434b1312dc943a1ab1db9a8c3128f
SHA256aa2cc10405a9c037e3a65fb5c6cb8e02db09f572578aefcfab80018b931f885f
SHA512567284cb5f20d277a882a73fb25b161dc95fbdfe55d26894087afb53b1c610cd7a8184d359ebddb09e29ef2345d2a6ae816306b039d78b58299606e93ec5ad5c
-
Filesize
255KB
MD59e7b02500ad57d8601438c88471dc82f
SHA1ff848a7f36b17e8714d197aabd52608f87c71ac1
SHA256d8b791104923d45819e6b77ece79b7aa640c805a06853091a3d5028b2597d8a3
SHA51267c37e613f8db7309a12f7689c1da09cfc82a48d60d1fa54f2c05c7bcc9b3970a66adc7f65d7810024c28cf7f7f866989cf9420519f165bebbe2474c92c230fd
-
Filesize
255KB
MD581e48c4389f5ab379fdd7b737e08553d
SHA15e56e5037d235649ee079119929e5411c44d9527
SHA256482fd74f6d66f54c80b2ffb565c0323bd292bc4dc0baa7cf231b108689f5058c
SHA512980da9b270015a70e551e1a52934a8adb748ce06a9a9dafa201149161998ac45a9ce89d2c0237c066dfb3a62d3145073400913dd677e4aa6299ba27cf533bd4f
-
Filesize
255KB
MD5522d8a781eb05eb63e5beb583babd1a3
SHA197843762a0935f36fc28346f4e88836af6272fe2
SHA256b13d39d83861f5e1ee96f6d6716c9a81fac767aff0438f0dded99e03441db3fa
SHA512db5371fd603bb7eb60feb2c66b8a3fbdf04694e22b233b86f003c990c7899d01750d3841e48eb9c76a01430004b92ef2a4892c93775a767a2a4c2e8d6284bc70