Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 23:23
Static task
static1
1 signatures
General
-
Target
65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe
-
Size
625KB
-
MD5
65385d169aeb282f21c367cefbc24994
-
SHA1
621b56959c3cfaa00eba761f9deab5b5b8b1cb1d
-
SHA256
226581b00075c5f5c16f673b473479ced88884909990896e75feb6f82f353943
-
SHA512
287315ad3f6a56b8e65b244b0beca9699cf3eb0706606863bed6f66aaae45dae4bb786893f96cd9a713d9b181af68b6d309b6a5631df335bb91177c34075c42b
-
SSDEEP
12288:IVt+w8wyv/G66WoJMWNuRajX13DguGpyeBpsmOix:2t+w5yWDJF4q138uGz7snu
Malware Config
Signatures
-
Expiro payload 5 IoCs
resource yara_rule behavioral1/memory/1640-0-0x00000000004BC000-0x000000000054F000-memory.dmp family_expiro1 behavioral1/memory/1640-1-0x0000000000400000-0x000000000054F000-memory.dmp family_expiro1 behavioral1/memory/1640-3-0x0000000000400000-0x000000000054F000-memory.dmp family_expiro1 behavioral1/memory/1640-164-0x00000000004BC000-0x000000000054F000-memory.dmp family_expiro1 behavioral1/memory/1640-180-0x0000000000400000-0x000000000054F000-memory.dmp family_expiro1 -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 8 IoCs
pid Process 3448 alg.exe 4640 DiagnosticsHub.StandardCollector.Service.exe 4516 fxssvc.exe 4552 elevation_service.exe 2976 elevation_service.exe 5016 msdtc.exe 2640 msiexec.exe 2464 SearchIndexer.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1403246978-718555486-3105247137-1000 alg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1403246978-718555486-3105247137-1000\EnableNotifications = "0" alg.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 42 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened (read-only) \??\R: 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened (read-only) \??\S: alg.exe File opened (read-only) \??\T: alg.exe File opened (read-only) \??\V: 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened (read-only) \??\W: 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened (read-only) \??\K: alg.exe File opened (read-only) \??\G: 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened (read-only) \??\R: alg.exe File opened (read-only) \??\Y: alg.exe File opened (read-only) \??\J: 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened (read-only) \??\T: 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened (read-only) \??\U: 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened (read-only) \??\L: alg.exe File opened (read-only) \??\P: alg.exe File opened (read-only) \??\Z: alg.exe File opened (read-only) \??\Q: 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened (read-only) \??\Y: 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened (read-only) \??\Z: 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened (read-only) \??\U: alg.exe File opened (read-only) \??\W: alg.exe File opened (read-only) \??\S: 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened (read-only) \??\X: alg.exe File opened (read-only) \??\H: 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened (read-only) \??\N: 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened (read-only) \??\X: 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened (read-only) \??\E: alg.exe File opened (read-only) \??\J: alg.exe File opened (read-only) \??\Q: alg.exe File opened (read-only) \??\I: 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened (read-only) \??\O: 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened (read-only) \??\P: 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened (read-only) \??\M: alg.exe File opened (read-only) \??\O: alg.exe File opened (read-only) \??\I: alg.exe File opened (read-only) \??\N: alg.exe File opened (read-only) \??\V: alg.exe File opened (read-only) \??\E: 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened (read-only) \??\L: 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened (read-only) \??\M: 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened (read-only) \??\G: alg.exe File opened (read-only) \??\H: alg.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\diagsvcs\diagnosticshub.standardcollector.service.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\svchost.exe alg.exe File opened for modification \??\c:\windows\system32\Appvclient.exe alg.exe File opened for modification \??\c:\windows\SysWOW64\vds.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\sensordataservice.exe alg.exe File opened for modification \??\c:\windows\system32\locator.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\wbem\wmiApsrv.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\tieringengineservice.exe alg.exe File opened for modification \??\c:\windows\SysWOW64\sensordataservice.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\openssh\ssh-agent.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\tieringengineservice.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\svchost.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\vds.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\msdtc.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\aadoefff.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created \??\c:\windows\system32\fafeddle.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\lsass.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\msdtc.exe alg.exe File created \??\c:\windows\system32\ieamhfji.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\msiexec.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\msiexec.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\locator.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\sgrmbroker.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created \??\c:\windows\system32\jjnmiggn.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\alg.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\perfhost.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\tieringengineservice.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created \??\c:\windows\system32\kdqkjoem.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\svchost.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\alg.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\lsass.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created \??\c:\windows\system32\emepiepg.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\syswow64\perfhost.exe alg.exe File opened for modification \??\c:\windows\system32\locator.exe alg.exe File created \??\c:\windows\SysWOW64\ooeggebe.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\vssvc.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created \??\c:\windows\system32\bjepioma.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created \??\c:\windows\system32\jlfibibd.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\Appvclient.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\wbengine.exe alg.exe File opened for modification \??\c:\windows\system32\wbengine.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\hlmdnhob.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\vds.exe alg.exe File opened for modification \??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created \??\c:\windows\system32\perceptionsimulation\ickekfng.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\sensordataservice.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\snmptrap.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\spectrum.exe alg.exe File created \??\c:\windows\system32\epbeablq.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created \??\c:\windows\system32\nbmjogjf.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created \??\c:\windows\system32\wbem\gigbnepa.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\dllhost.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\msdtc.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\snmptrap.exe alg.exe File opened for modification \??\c:\windows\system32\Agentservice.exe alg.exe File opened for modification \??\c:\windows\SysWOW64\perceptionsimulation\perceptionsimulationservice.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\openssh\ssh-agent.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\Agentservice.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\dllhost.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\MSInfo\jfjkgccl.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\miqfjfol.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\pgildlkb.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created C:\Program Files\dotnet\ddnfppgh.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created \??\c:\program files\google\chrome\Application\110.0.5481.104\hlmioqpj.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\elidehmc.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created C:\Program Files\7-Zip\gkooamha.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\knkmmeba.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\mngianin.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\dendjgfp.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created \??\c:\program files (x86)\mozilla maintenance service\hfphmchd.tmp alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\onbaidqf.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\lgamkbac.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clmaedbq.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\obkakffi.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created \??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\qhmhqkof.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\ldcnmoao.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\olemadei.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\elevation_service.exe alg.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\hlepeenn.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\ifpcoece.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe alg.exe File created C:\Program Files\Java\jdk-1.8\bin\dakeokhg.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\pijgofaf.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\jkgaipki.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\program files\google\chrome\Application\110.0.5481.104\elevation_service.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\mnmjadqg.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\hhfjjgab.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\kihlpche.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\dddilmae.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\pppjqpbi.tmp 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\elevation_service.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe alg.exe File opened for modification \??\c:\windows\servicing\trustedinstaller.exe alg.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification \??\c:\windows\servicing\trustedinstaller.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e586d60695dcda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058d4030795dcda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec57890795dcda01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001566f90795dcda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008491a30795dcda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006089a0795dcda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001539c80695dcda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e319cc0795dcda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe 3448 alg.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1640 65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe Token: SeAuditPrivilege 4516 fxssvc.exe Token: SeTakeOwnershipPrivilege 3448 alg.exe Token: SeSecurityPrivilege 2640 msiexec.exe Token: 33 2464 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2464 SearchIndexer.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2464 wrote to memory of 1648 2464 SearchIndexer.exe 115 PID 2464 wrote to memory of 1648 2464 SearchIndexer.exe 115 PID 2464 wrote to memory of 1048 2464 SearchIndexer.exe 116 PID 2464 wrote to memory of 1048 2464 SearchIndexer.exe 116 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" alg.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer alg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65385d169aeb282f21c367cefbc24994_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3448
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:4640
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3856
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4516
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4552
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2976
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5016
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2640
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1648
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 7882⤵
- Modifies data under HKEY_USERS
PID:1048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD54ebc90c2ec585b2edf2f474524facb4f
SHA176cb29eba0b17a4c80f3191ae7a9824a33712cbf
SHA25660b0da0e8a1efaae9b0d23cb666aa7e46f805c133dc260462199e9e6770c6c4a
SHA51294af707b6554718e88120e22b24b893269e5ac6c89c2ff51a8668c15640b4ce1660903b9de5be4b8203dc9f39b4ee885a1b71b0f19d857be2d2fc2a76e82b66c
-
Filesize
629KB
MD5c1cb08fecfb5a1cf96da2531c1eb6da6
SHA16578349bf510ca5b7f1652bc97873e31e20653f7
SHA256a614396844ce345745753b17c2a7697cbe09fd7ac5e6b44467798bd26a2ab70a
SHA51212ea1b410d05fc7f9ce88440d69c796e057d983fd5585c629c511282427f158b6851a22e70ee9f93d16a53089a6695f5f0c1160386fcfe033f110efd36317575
-
Filesize
940KB
MD52c53072af1b9b9173557e294fd9fc801
SHA1baf0f762c4e1e27ac3915291f8cd3d35718102e5
SHA256c76e4269700e66afc90d38406c84c7851c45be52072751728f76a6273e6a5ada
SHA51205c9a5b6205895bfc7505db1408c09e5bf5cbd6ac0539ec47352d67dbee6fdc6c799df5f6e8b3dfb502d711657729495ae96256d38de4c7e3938e54122494307
-
Filesize
1.3MB
MD5f6d136e2443014447776c3a3148c43b7
SHA15bdf9de34d58cb2ba0ef27f76b84e1899277a2e3
SHA25698c42b592d761ac8c15ca4b3eae62fd3f0347b2e53731b1f792cd239bd2ada2c
SHA51260ee19624cd47494bd5105aac85bc2ea25f9b01f08112635712c078151306d3ab18ff496bacab97fc3ad6264c43d386416e382e7ceca975f7c592c9813dcca69
-
Filesize
1.1MB
MD5105a2c7a38505fb9f201406b721eae3a
SHA1233b68a9027a11803e831e10a8b38577fec6b55e
SHA2569b7636875ae54c15beb14c340a285e640ca12617ae592bbdf3235aaacb17cea3
SHA512ef6cf26ced9217ba53e64723c209a932545744a8f6792097debbf3d34d2e5dced2cc8997f80dae387c270d27e7070dbab810b28075f2465e958c4f8c018542c7
-
Filesize
410KB
MD5edc7075f12cc1bb3bd5698fa83c87a63
SHA19de4efc78e62f19296b258103baee037b4efc9ab
SHA256f41fca4049de2552b558f1fd44c80c370ae324a1e2fd4b618d4b17aa900086e3
SHA51245c4770dcbd5c231a0031bf2b6130d3b5d18476a1a6221a75f87a8c9fcfb806738a952f7fd997eeafe8d5b8c66f77ef059aa268aea4c76c67622bd14ba919e0e
-
Filesize
672KB
MD5651ef8eb5cfe64d1a25012e81ce9eb32
SHA1547d45c4a352cda37827b2ebe28e98738d5af6f6
SHA25619cafc0bcb8fb992ffc04f6b490786794945bbec7e55305a50c8181f84a14475
SHA512f50be4268acf7f1c42cd49de3943e1961fedea3fc23c709451152e3adecaba9c1ca59c07075fc20ffdb57ffb595b4769c4f7100088e8e657d140add117b2378c
-
Filesize
4.5MB
MD5d74015a87d135c3819ab086c639b26ca
SHA15c02cb0eb8b125aca67c2b8d30e981c64ec524c6
SHA256c0b590691ee7045083f6cd78e3f415ab91f2b1cdd5f7b4e91dc99e749e0074bf
SHA5125701b7313dd2d5041597f49fb3caab3f3ac96c7f57438644fb23706b9c5c5996a75203c00e7a643a1bfe499862079c771565ace2d0472f960866176a7301bf22
-
Filesize
738KB
MD546b7d2649aaa55c09e2e591b33591af2
SHA17514543377892e1ac41aaa4650ddfb7075e0a05d
SHA256f5e89cd2a2fa1736caeb6a3be5b17b51c796d99cd96d0f33abac0ada05b128b2
SHA5124ef7c04f53bbcb3e7c2a30f527927e3eeb7d1efdb6a5e6ffe4ea1d37497b73288e44fe2ac9943f442ec0b43f3c1f9ee1f9e9b8ef307bff29ae766b5f676de68e
-
Filesize
23.8MB
MD590d93c18d5a51d441b9602755e81e6fd
SHA131a25932a3c612e2cbb2740e710de9d86e32b9d4
SHA256f162e4efe905c62b1cdcf294dc087fc8bab4f2fad259cf3865095443f5ea2ada
SHA512738d2d3b32c44ee9e90731e40c49a98d44e5c08a9211437848c21f5e2994ba0a1b187048cf8c474fd722741a6ea5c6034c4b6e08b6426f56e48e40447f9d4989
-
Filesize
2.5MB
MD5805edb73d3388333f49c809683a9bafa
SHA11bf698dbffa74457663f78b6cb59f2739c255616
SHA256aac919990a7b2a2c3f6c23f9555adc0debcf30ff7ef569d4cf53ebf22e4a7831
SHA512b4668d49a5749e1ef4363a61f189aa817a4a0a08b090c1a9703c59db06320d5274cf10733650400137b09256fac02e6404d444c6e3e6ef643f7c4aec953dc27c
-
Filesize
2.0MB
MD56e0592a211d225abe91547a62cb5bb66
SHA117d18fefb79a7cb6d31f6c52b84452031e6c6147
SHA25600b568f9dd9968b66cf5546fbed240bab50b813f47804e36b4de9f3186ddc5eb
SHA51206299af759ffc45ab9a527fa508cd66d93c1902510f1757c1d7b4f1425512314baccde6a35dfa259bc8862784ff751816eadadb94d68953a7e8230c1d42d0016
-
Filesize
625KB
MD5aaf8f95c5811445c4335bd35ffa30113
SHA1c9dcdf298d8b4f54f648ddfeccf6cd7ea11c4c94
SHA256b6da7d65774adb7e97e555b8e77021c562db128819bfb7c8bccefcce62882ead
SHA5127d718986e3951ed9caf7206661a874ff452ce390ad060a025babb7403ed8cd7ee25054bd1a33859b83242b6dfaf54fbc496f6eefffb8ff8695b1b7fb2b54d029
-
Filesize
818KB
MD51acd2898c9a030a08e6b95ff3972cde8
SHA1953e5c1fa9cb9ee353e9dd60992dc6dce36390aa
SHA256a235cf6cb8115f2e0022e4ccd254cdc99e247145fd255c1b860777528baf46a7
SHA5125f2038d3bde9a834f3133a0770f4e3425696ddbf1e93082fd9a139e5a8cfe053b7f38e4d1f2efe3c5322255a4eac74c210fe29cd6b1d67660d73898d6b3a2060
-
Filesize
487KB
MD5731507bf7abcb423bf59ba133226d60f
SHA14b4dbe21aaaf180897f0182fe5bab43630e0d5ed
SHA256ac017d50c19f6aa7557e4df6432a89363e6304e5118f06821fb6859ccd39d656
SHA512a318b9ba122f9c4780c489a34cbfb424b505eed6ee39f1b149f63ba3b161e8bae9a7fbdd4d3034cf9bf8e13dce2d19a860a870729ad93f875df959c01e8aae3e
-
Filesize
1.0MB
MD5511510448bcf1780793626c1ddbbefaa
SHA15473438b8a91f6745af0185a4bed7a455c708560
SHA25613e4cec2726fbec99a9252769e5b415631ab7e992a10fa05e3da3b265402cbda
SHA512d0e59da34c745b70d1898c5465da38743c8caa69fcc7ce68259c87727cc796fe65b9f37acd9eba1ca2fd4d696454c81fa79fd58276155f0294021f25bc572ab2
-
Filesize
1.3MB
MD5486c5793f9e257a03228813e7b8621a4
SHA10656dc4990b71501f6ea3bc4a5916a617ba964b7
SHA256b231be1c27c323fae29b25118da8e1d22245aeddafff26bbc5afda268b97cf3f
SHA5124b5cc13d22ad7a40ec74f247a716a1359d4a7e6ff01d5dfd683964645a294828108f8d7419c472a8b1fa81c593ae687325527bd98236407302009309ac7e1b1f
-
Filesize
489KB
MD5685795ed5933151ce0cbac8b1238283e
SHA18cc68b249f738ea92432255632b2ea29c1705777
SHA256b05da003eb749e16498f01012bb75ef0438fb0e5712f1d3fa371af06ad38b427
SHA512b8defb4bcf393b3c1670c4daa1f359e37b6c156c213ce0dfeaad9aff6378a09b23fc6db7764a9696119cfbecf62b2e52f95a56b1cce304996f79da08f75dd05c
-
Filesize
540KB
MD5158756e6f750526e59f617264983f57f
SHA12d1419e867d660210561cbc99bd66f2951dc4037
SHA256df494ac97fd5d8c00e22158bd82c051c71dcac3a131b4961fe4687fda6f93442
SHA51259268d1fc8c4d3a759677739cabef496c19187e7a2fd4767f9f2217a5d004fa78c34a08b17ad5375e46b6d781abb85e505c171eaefaef2e40dc842f5b4b19f79
-
Filesize
463KB
MD56252a004e389cdf25a8154c0a0ee28d5
SHA13e0935a8fae25498e9635051fc262d53fe453780
SHA25656f9f241bb12e46ce0f47edd93106f45de86413854e98e7b236d9c870e4c65d4
SHA512bc8f791ee892a2b9e5f9714d7c6a2c143fcfc078ccc48690fff7cba64a209dcceba33d370c58c7f64e38d1b75bf9734e09d0b3c4908597bf08b04d75f08188db
-
Filesize
839KB
MD57defd6bc234f8417ddfbe3e97807daa0
SHA1dde38582374cc1b376fdde99b3d9661ac1211a2f
SHA256c507cea47e58179fab401f512645e31db11afcac687804343fa586572ed0cbc0
SHA512b672b307fcc9c6db695c2366184561b0cda7d5f484f3dca50b9b9fe165c863209c834ef50028d8f0131b22f164c55d133ad53de20abd8f6bc71ba2f0110dc807
-
Filesize
637KB
MD5f7b886deee48d82ee23ed90058792d75
SHA1d98aeb2e39c054d0249e51a017d6fe156e2eb532
SHA256d41cd5d8ea07c60deebd7a58ffbee38376d7b135dd319088b528d72a612e5258
SHA5128953be1658e16fc3eca5be7efc0e8e7cd15ff873a69a367d444280ae00e122ba6bf95a70bb15f700d5220985b38d6d2d129aaec6a355419b42ea880ff9ebca03
-
Filesize
1.1MB
MD5bf2b485a26ac535ffb20305d82ba210b
SHA12d2af97e8738756b200b9a4a49b48678c00fdd79
SHA2569441278e11f24d464fb3849bfd91ab28a6b7c81fdf3cb87664daf2a2f626f0d0
SHA5122cf10e58cc2d0e886e7e2b78cb92f21ef498275d22bf982c6a1c53effe544622d8bb4f5efa0c9dbb7cb8972085a4706c6c098eb71d86426241b9eab67260a29f