Analysis
-
max time kernel
20s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
18-07-2024 11:14
Behavioral task
behavioral1
Sample
571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe
-
Size
777KB
-
MD5
571fd53c9573642e3397c1bc7913be59
-
SHA1
09e4a0d7d252a82ab449873ef14e64abd9c3e5c4
-
SHA256
143cf25d7afbe29915bb43fd9cdfe4ffe90054ad29ecd646a8770b612ea30ade
-
SHA512
9c2f181d6ad80ad1c9b7337ea23c20b1ab21eeef618ed32919590fe989cb47d5b0fac4507489f8e950236534f70aea71ad9074768e536213306f5245930f895e
-
SSDEEP
24576:WqeOs7C840n9lpG1Rtb938KZtf/1ZkHhWv:WqeOhL0nDEXxt9
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Ammyy Admin
Remote admin tool with various capabilities.
-
AmmyyAdmin payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1912-0-0x0000000000400000-0x00000000004C8000-memory.dmp family_ammyyadmin behavioral1/memory/344-53-0x0000000000400000-0x00000000004C8000-memory.dmp family_ammyyadmin behavioral1/memory/2852-35-0x0000000000400000-0x00000000004C8000-memory.dmp family_ammyyadmin behavioral1/memory/1912-74-0x0000000000400000-0x00000000004C8000-memory.dmp family_ammyyadmin behavioral1/memory/2852-71-0x0000000000400000-0x00000000004C8000-memory.dmp family_ammyyadmin -
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
-
Modifies firewall policy service 3 TTPs 9 IoCs
Processes:
571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe -
Processes:
571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe -
Processes:
571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Control Panel\International\Geo\Nation 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral1/memory/1912-8-0x00000000024D0000-0x000000000355E000-memory.dmp upx behavioral1/memory/1912-7-0x00000000024D0000-0x000000000355E000-memory.dmp upx behavioral1/memory/1912-6-0x00000000024D0000-0x000000000355E000-memory.dmp upx behavioral1/memory/1912-9-0x00000000024D0000-0x000000000355E000-memory.dmp upx behavioral1/memory/1912-5-0x00000000024D0000-0x000000000355E000-memory.dmp upx behavioral1/memory/1912-4-0x00000000024D0000-0x000000000355E000-memory.dmp upx behavioral1/memory/1912-30-0x00000000024D0000-0x000000000355E000-memory.dmp upx behavioral1/memory/2852-51-0x00000000011E0000-0x000000000226E000-memory.dmp upx behavioral1/memory/2852-49-0x00000000011E0000-0x000000000226E000-memory.dmp upx behavioral1/memory/2852-50-0x00000000011E0000-0x000000000226E000-memory.dmp upx behavioral1/memory/2852-48-0x00000000011E0000-0x000000000226E000-memory.dmp upx behavioral1/memory/2852-36-0x00000000011E0000-0x000000000226E000-memory.dmp upx behavioral1/memory/2852-37-0x00000000011E0000-0x000000000226E000-memory.dmp upx behavioral1/memory/2852-33-0x00000000011E0000-0x000000000226E000-memory.dmp upx behavioral1/memory/2852-32-0x00000000011E0000-0x000000000226E000-memory.dmp upx behavioral1/memory/2852-29-0x00000000011E0000-0x000000000226E000-memory.dmp upx behavioral1/memory/2852-38-0x00000000011E0000-0x000000000226E000-memory.dmp upx behavioral1/memory/1912-28-0x00000000024D0000-0x000000000355E000-memory.dmp upx behavioral1/memory/1912-27-0x00000000024D0000-0x000000000355E000-memory.dmp upx behavioral1/memory/1912-76-0x00000000024D0000-0x000000000355E000-memory.dmp upx behavioral1/memory/344-83-0x0000000003D80000-0x0000000004E0E000-memory.dmp upx behavioral1/memory/344-82-0x0000000003D80000-0x0000000004E0E000-memory.dmp upx behavioral1/memory/344-81-0x0000000003D80000-0x0000000004E0E000-memory.dmp upx behavioral1/memory/344-85-0x0000000003D80000-0x0000000004E0E000-memory.dmp upx -
Processes:
571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe -
Processes:
571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exedescription ioc process File opened (read-only) \??\E: 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe File opened (read-only) \??\G: 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe File opened (read-only) \??\H: 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe File opened (read-only) \??\I: 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
Processes:
571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S1_182 = "1149359029" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_311 = "1900118997" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S3_618 = "2419509367" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_619 = "3850959793" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_846 = "2876321866" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_84 = "2874756924" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S3_216 = "659567649" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_454 = "2345691442" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S1_693 = "429798547" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_560 = "1985176976" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_587 = "1528680785" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S3_102 = "2553740603" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S1_128 = "2813178684" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S2_149 = "344122728" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_296 = "2153727992" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S1_582 = "1814592713" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S1_70 = "4153582018" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S1_302 = "4188829619" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S2_893 = "650021002" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S1_688 = "3297455433" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S3_967 = "2278884012" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_283 = "941866689" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S3_456 = "896823793" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_532 = "1026924668" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S3_632 = "751300289" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S2_226 = "1905575601" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S1_229 = "704069740" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S2_248 = "2965282199" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_430 = "2751465834" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S3_670 = "3005263123" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S3_580 = "232065573" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S1_704 = "3454065941" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_787 = "1010539049" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S2_880 = "3733132971" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S3_72 = "3060954481" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S2_912 = "1760440266" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_318 = "3213423898" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_424 = "2852909432" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S2_736 = "1872811615" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S3_957 = "983007598" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S3_937 = "2752682722" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S1_699 = "3939435293" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S1_0 = "3298346065" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_201 = "896606763" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S2_491 = "3151786268" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S2_635 = "717141290" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_396 = "1894657124" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S2_82 = "45234043" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S3_927 = "1490229668" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S3_460 = "2227694349" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S1_498 = "1430646728" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_750 = "204452138" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_813 = "3434261655" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_170 = "4284043550" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_717 = "762391927" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S1_900 = "1608163989" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_274 = "1094032086" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S3_638 = "649852659" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S2_130 = "3528673245" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S1_765 = "191637443" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S1_768 = "1195544918" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S2_825 = "3231368000" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S2_55 = "501754448" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_200 = "3776825560" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exepid process 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe 2852 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe 344 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 2852 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Token: SeDebugPrivilege 344 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exepid process 344 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exepid process 344 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exedescription pid process target process PID 1912 wrote to memory of 1108 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe taskhost.exe PID 1912 wrote to memory of 1220 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Dwm.exe PID 1912 wrote to memory of 1252 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Explorer.EXE PID 1912 wrote to memory of 1600 1912 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe DllHost.exe PID 2852 wrote to memory of 1108 2852 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe taskhost.exe PID 2852 wrote to memory of 1220 2852 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Dwm.exe PID 2852 wrote to memory of 1252 2852 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Explorer.EXE PID 2852 wrote to memory of 1600 2852 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe DllHost.exe PID 2852 wrote to memory of 1912 2852 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe PID 2852 wrote to memory of 344 2852 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe PID 2852 wrote to memory of 344 2852 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe PID 2852 wrote to memory of 344 2852 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe PID 2852 wrote to memory of 344 2852 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe PID 344 wrote to memory of 1108 344 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe taskhost.exe PID 344 wrote to memory of 1220 344 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Dwm.exe PID 344 wrote to memory of 1252 344 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Explorer.EXE PID 344 wrote to memory of 1600 344 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe DllHost.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1220
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1912
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe" -service -lunch1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:344
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22B
MD51d16f9933a7474e80cfcf64d12cac36f
SHA1b5f444032fb62160742c8afb224214f90e5ee6a1
SHA256ce04f504d8d50a43f64189dc45bcf68e2bf341dfffeba7d41f715f57dec43061
SHA5127f8ba2a26dc9e3b2acfa56dfe3f875e9c1d2a354deb522fb490cb07d72050501aad49974556aee21fbdd3ed91ddeb2a4f5d60f0b5acee76cbefde998a1c6f785
-
Filesize
68B
MD506e22dfaf08340dd9041468df2e6c82f
SHA1f8873af4446e8e3a9d8070463916e2d1676c36dd
SHA256188d2e98f93b952ac78f1c91ae927b515dc3e658eec7371b40731be53bd5584e
SHA51273d9b9a3acc791559310db62c3301a8e02e8f9d3b57a701260863279db370d584232fd4d5dc64f10b5c46d179452d107cbae815bf20ab17a2e6cebf1abd6a742
-
Filesize
269B
MD5097a18ed7b31114c7ef39ef06eff02f0
SHA1276bb5fc8ab72ed3a447dd57be668ace8f75a7c1
SHA256985b458559939244b777d09d71d6192a13f693b88b046ca904012603a5582812
SHA512168ef05ddb434dd4003748c7cd6ea9ed5c8280506de4473c3b193fffc314b469e85e2474f919f189c9b7ffb16aa741d75900341a9802dae175ad185e1fea3e96
-
Filesize
257B
MD56d70bceab8e6ef50dbbc8087790592f4
SHA1dd0775c6567b5707a636c0095e50b6074720723e
SHA256d47f7ae0be875cb7c184ef6a2a49da6d7db7fefb7adece7ba6e87d9ea3348748
SHA512b5ccfc98f086d97053f5f471f389c70569264b1f47b4a25aae09b044139d9034972708f2890f73bcbcc0bf6dfdbc90112a8be8c25f54535dbe9824a56d61ad64
-
Filesize
100KB
MD54482a58da374fdf669635f1d6e0add57
SHA172fbb1782d591fda7c9af477e4b86fc8c2a3b08d
SHA2560350eccb766d8475aa38048582c72b1a495d1d01da481b15cd7a62ab570b31d8
SHA512b49795679d0d8715250dc277a84bc8f4b165f971d8001b7b994b58cb19757e28f3061516cd2ced4230b84cb5f6dc6a2425025ca38d9fe9497d5eb5ed434474dc