Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 05:58
Behavioral task
behavioral1
Sample
38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe
-
Size
934KB
-
MD5
38b9796d251b0a5a51f82df94d4887cc
-
SHA1
779febb870645fb9c4e839927b4ffe9e31667d6c
-
SHA256
ac1dfe3059d67ac1888c99204e1db1a816cb76fca4f03a6fedc5ff5d9369d5ce
-
SHA512
53d913bb6bfa12b372c1307848705409aac35ee493d5730dfb7c416d40b018623d1c5b364bd65c2fdd4018302be7d145c3e69a90b479cc678897d12d84887313
-
SSDEEP
24576:xTyYEQJnYrA/I+iOGoI/y+y6+bIaF82i4sIomr:MY58QICGBt+0Qyf2
Score
8/10
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9} Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}\ = "Microsoft Windows Script 5.6" Script56.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}\IsInstalled = "1" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}\Version = "5,6,0,8825" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}\Locale = "CN" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}\ComponentID = "MSVBScript" Script56.exe -
Manipulates Digital Signatures 1 TTPs 36 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}\FuncName = "IsFileSupportedName" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090}\Dll = "C:\\Windows\\system32\\wshext.dll" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090}\Dll = "C:\\Windows\\system32\\wshext.dll" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090}\FuncName = "VerifyIndirectData" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}\FuncName = "RemoveSignedDataMsg" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}\Dll = "C:\\Windows\\system32\\wshext.dll" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}\Dll = "C:\\Windows\\system32\\wshext.dll" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{1A610570-38CE-11D4-A2A3-00104BD35090}\Dll = "C:\\Windows\\system32\\wshext.dll" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{1A610570-38CE-11D4-A2A3-00104BD35090}\FuncName = "CreateIndirectData" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}\FuncName = "CreateIndirectData" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}\Dll = "C:\\Windows\\system32\\wshext.dll" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}\FuncName = "RemoveSignedDataMsg" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{06C9E010-38CE-11D4-A2A3-00104BD35090}\Dll = "C:\\Windows\\system32\\wshext.dll" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}\FuncName = "PutSignedDataMsg" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}\Dll = "C:\\Windows\\system32\\wshext.dll" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}\FuncName = "GetSignedDataMsg" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}\Dll = "C:\\Windows\\system32\\wshext.dll" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}\FuncName = "RemoveSignedDataMsg" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1A610570-38CE-11D4-A2A3-00104BD35090}\Dll = "C:\\Windows\\system32\\wshext.dll" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}\Dll = "C:\\Windows\\system32\\wshext.dll" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090}\FuncName = "CreateIndirectData" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{1A610570-38CE-11D4-A2A3-00104BD35090}\Dll = "C:\\Windows\\system32\\wshext.dll" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}\Dll = "C:\\Windows\\system32\\wshext.dll" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}\FuncName = "GetSignedDataMsg" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}\Dll = "C:\\Windows\\system32\\wshext.dll" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}\Dll = "C:\\Windows\\system32\\wshext.dll" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}\Dll = "C:\\Windows\\system32\\wshext.dll" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}\FuncName = "PutSignedDataMsg" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}\Dll = "C:\\Windows\\system32\\wshext.dll" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{1A610570-38CE-11D4-A2A3-00104BD35090}\FuncName = "IsFileSupportedName" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}\FuncName = "PutSignedDataMsg" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}\FuncName = "GetSignedDataMsg" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{06C9E010-38CE-11D4-A2A3-00104BD35090}\FuncName = "IsFileSupportedName" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1A610570-38CE-11D4-A2A3-00104BD35090}\FuncName = "VerifyIndirectData" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}\Dll = "C:\\Windows\\system32\\wshext.dll" Script56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}\FuncName = "VerifyIndirectData" Script56.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1312 Script56.exe -
Loads dropped DLL 1 IoCs
pid Process 1312 Script56.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Regsister WScript = "wscript -regserver" Script56.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/436-83-0x0000000000400000-0x00000000004A4000-memory.dmp autoit_exe behavioral2/memory/436-448-0x0000000000400000-0x00000000004A4000-memory.dmp autoit_exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\SET1D4.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\jschs.dll Script56.exe File opened for modification C:\Windows\SysWOW64\SET1A11.tmp Script56.exe File created C:\Windows\SysWOW64\SET4A7D.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\dllcache\SET9324.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\dllcache\jscript.dll Script56.exe File opened for modification C:\Windows\SysWOW64\dllcache\SET9338.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\dllcache\SET9360.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\jscript.dll Script56.exe File opened for modification C:\Windows\SysWOW64\SETE9A7.tmp Script56.exe File created C:\Windows\SysWOW64\SET1A10.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\scochs.dll Script56.exe File opened for modification C:\Windows\SysWOW64\SET1A12.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\SET1A33.tmp Script56.exe File created C:\Windows\SysWOW64\SET3240.tmp Script56.exe File created C:\Windows\SysWOW64\dllcache\SET9324.tmp Script56.exe File created C:\Windows\SysWOW64\SET1A12.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\scrrnchs.dll Script56.exe File opened for modification C:\Windows\SysWOW64\SET62B9.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\dllcache\wshext.dll Script56.exe File opened for modification C:\Windows\SysWOW64\dllcache\cscript.exe Script56.exe File opened for modification C:\Windows\SysWOW64\dllcache\SET934F.tmp Script56.exe File created C:\Windows\SysWOW64\dllcache\SET935F.tmp Script56.exe File created C:\Windows\SysWOW64\SET1A33.tmp Script56.exe File created C:\Windows\SysWOW64\SET7AD6.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\dllcache\SET9327.tmp Script56.exe File created C:\Windows\SysWOW64\dllcache\SET9338.tmp Script56.exe File created C:\Windows\SysWOW64\dllcache\SET933B.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\scrrun.dll Script56.exe File created C:\Windows\SysWOW64\SETE9A7.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\SET1A23.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\wshchs.dll Script56.exe File opened for modification C:\Windows\SysWOW64\dllcache\SET934E.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\wshext.dll Script56.exe File created C:\Windows\SysWOW64\SET62B9.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\SET7AD6.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\wshcon.dll Script56.exe File created C:\Windows\SysWOW64\SET9302.tmp Script56.exe File created C:\Windows\SysWOW64\dllcache\SET933A.tmp Script56.exe File created C:\Windows\SysWOW64\dllcache\SET9360.tmp Script56.exe File created C:\Windows\SysWOW64\dllcache\SET9327.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\dllcache\wscript.exe Script56.exe File opened for modification C:\Windows\SysWOW64\dllcache\scochs.dll Script56.exe File opened for modification C:\Windows\SysWOW64\vbscript.dll Script56.exe File opened for modification C:\Windows\SysWOW64\SETD18A.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\SET1A10.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\wshom.ocx Script56.exe File opened for modification C:\Windows\SysWOW64\SET9302.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\dllcache\scrrun.dll Script56.exe File opened for modification C:\Windows\SysWOW64\dllcache\SET933B.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\dllcache\SET934C.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\dllcache\SET934D.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\dllcache\jschs.dll Script56.exe File opened for modification C:\Windows\SysWOW64\SETA4DB.tmp Script56.exe File created C:\Windows\SysWOW64\SET1A11.tmp Script56.exe File created C:\Windows\SysWOW64\dllcache\SET9325.tmp Script56.exe File created C:\Windows\SysWOW64\dllcache\SET9339.tmp Script56.exe File created C:\Windows\SysWOW64\dllcache\SET934E.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\dllcache\SET935F.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\SETB95E.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\scrobj.dll Script56.exe File created C:\Windows\SysWOW64\SET1A23.tmp Script56.exe File opened for modification C:\Windows\SysWOW64\dllcache\dispex.dll Script56.exe File opened for modification C:\Windows\SysWOW64\dllcache\SET933A.tmp Script56.exe -
resource yara_rule behavioral2/memory/436-0-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral2/memory/436-83-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral2/memory/436-448-0x0000000000400000-0x00000000004A4000-memory.dmp upx -
Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\INF\SET9314.tmp Script56.exe File opened for modification C:\Windows\INF\scripchs.inf Script56.exe File created \??\c:\windows\system\Script56.exe 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe File opened for modification \??\c:\windows\system\Script56.exe 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe File opened for modification C:\Windows\help\SET9303.tmp Script56.exe File created C:\Windows\help\SET9303.tmp Script56.exe File opened for modification C:\Windows\help\wscript.hlp Script56.exe File opened for modification C:\Windows\INF\SET9314.tmp Script56.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Script56.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CAAACA0F-9B02-4565-B3C5-9B20FC4DA566}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{44C09D56-8D3B-419D-A462-7B956B105B47}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B5E9ED86-F7B7-4B8B-B603-01446C759C07}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D86CF271-2D45-4831-A2FD-5B61601A1A82}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E2A10C6C-A31C-425A-A9C1-7B2713D1AF7D}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A8CDA3D0-B61A-462A-AB62-646464C69D20} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FA1C27EE-A334-470A-861B-DBB78351A042}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{483C2FD8-0508-47A0-8AB5-69FF5162C0FB} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptHostEncode\ = "{85131631-480C-11D2-B1F9-00C04F86C324}" Script56.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F414C261-6AC0-11CF-B6D1-00AA00BBBB58}\Implemented Categories\{0AEE2A92-BCBB-11D0-8C72-00C04FC2B085} Script56.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8EC4FC3A-DDB1-4E84-A7FC-210EC0FFEE84} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0968e258-16c7-4dba-aa86-462dd61e31a3}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6A283FE2-ECFA-4599-91C4-E80957137B26}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8C1DB5F-CBB3-48BC-AFD9-CE6B880C79ED}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1DF997E7-21C2-4258-A795-49C5D8869BD2} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DB8AEC44-C731-49ED-B8EF-C8FAF39E46C2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WSHFile\Shell\Open\ = "´ò¿ª(&O)" Script56.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\ProgID Script56.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FC6BCD5-71C7-54DF-8B7F-FEBBACD70152}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JScript Author\CLSID Script56.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7D39402F-5B52-4B34-B528-B95F66927E1D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{86D6986D-B7E8-4246-B823-14BEE2C4232A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8BC4E083-AB24-4E22-A341-1999EEA5D005} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID Script56.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1ABA2312-77B6-44D7-B975-CCE3F3D3FB2F}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B2D4644A-A026-4DDE-81BE-FB471FC419E8} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B0120C9-73AB-4249-91E0-CA3E61924B7F}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{46763EE0-CAB2-11CE-8C20-00AA0051E5D4}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FC6BCD5-71C7-54DF-8B7F-FEBBACD70152}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66A9CB08-4802-11D2-A561-00A0C92DBFE8} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D73A659-E5D0-4D42-AFC0-5121BA425C8D}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4BFDDEB8-130E-41D1-8E6E-670E469DC9CD}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AD8ACA15-875F-4A2A-BF6D-E21CF4ABDA73}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{365E356C-9C2E-42BF-9A92-5E4E017D0575}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4BFDDEB8-130E-41D1-8E6E-670E469DC9CD} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A46D8E2-2072-4AED-8509-BADB844E51F6} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7D858463-1B07-482E-8405-6BD792455E88}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WSFFile\DefaultIcon Script56.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{86D6986D-B7E8-4246-B823-14BEE2C4232A}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E93D4057-B9A2-42A5-8AF8-E5BBF177D365}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA90700F-2340-46A7-AB00-867FD691ECEE}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B196B289-BAB4-101A-B69C-00AA00341D07}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A6F7053-3035-4EB7-8020-551E80A67998}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AE08CF60-0965-4901-AD25-CC79B1297FCA}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{29D25BFC-E5DB-473E-9E19-CDB9C77393A4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2491E7F1-0FF2-5536-B711-4CFDDA5802F3} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{30DAD006-CF4A-45E0-AEC1-2195D76FD9C0}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AD8ACA15-875F-4A2A-BF6D-E21CF4ABDA73} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\ProgID\ = "JScript.Encode" Script56.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{59007C49-CB25-4BD5-AAD9-6943F08F4F9E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{41FE86AF-F148-457E-B0EC-D0389FA74670}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1C2056CC-5EF4-101B-8BC8-00AA003E3B29}\ProxyStubClsid32\ = "{B196B286-BAB4-101A-B69C-00AA00341D07}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{76550116-B458-4B21-B1BB-8A48027C1200} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BD1AE5E0-A6AE-11CE-BD37-504200C10000}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.2 AuthorJavaScript1.3 Author\CLSID\ = "{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}" Script56.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AEE53265-5B70-401D-89E1-65DDBA58518E}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD7A55EB-4C97-4CDC-9163-FC1B0219E13A}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{26155FA2-5BA5-4EA4-A3B4-2DC7D63C8E26}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85AC9776-CA88-4CF2-894E-09598C078A41} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{886B09D6-A6AE-4007-A56D-1CA70C84C0D2}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF Script56.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\JAVASCRIPT AUTHOR\CLSID Script56.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 436 wrote to memory of 2392 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 85 PID 436 wrote to memory of 2392 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 85 PID 436 wrote to memory of 2392 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 85 PID 436 wrote to memory of 320 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 87 PID 436 wrote to memory of 320 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 87 PID 436 wrote to memory of 320 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 87 PID 436 wrote to memory of 4064 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 88 PID 436 wrote to memory of 4064 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 88 PID 436 wrote to memory of 4064 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 88 PID 436 wrote to memory of 2660 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 89 PID 436 wrote to memory of 2660 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 89 PID 436 wrote to memory of 2660 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 89 PID 436 wrote to memory of 3092 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 90 PID 436 wrote to memory of 3092 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 90 PID 436 wrote to memory of 3092 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 90 PID 436 wrote to memory of 4444 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 91 PID 436 wrote to memory of 4444 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 91 PID 436 wrote to memory of 4444 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 91 PID 436 wrote to memory of 3464 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 92 PID 436 wrote to memory of 3464 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 92 PID 436 wrote to memory of 3464 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 92 PID 436 wrote to memory of 1312 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 93 PID 436 wrote to memory of 1312 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 93 PID 436 wrote to memory of 1312 436 38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\38b9796d251b0a5a51f82df94d4887cc_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s actxprxy.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2392
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s shdocvw.dll2⤵
- System Location Discovery: System Language Discovery
PID:320
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s smhtml.dll2⤵
- System Location Discovery: System Language Discovery
PID:4064
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s urlmon.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2660
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s msjava.dll2⤵
- System Location Discovery: System Language Discovery
PID:3092
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s XPrxy.dll2⤵
- System Location Discovery: System Language Discovery
PID:4444
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s oleaut32.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3464
-
-
\??\c:\windows\system\Script56.exec:\windows\system\Script56.exe /Q2⤵
- Boot or Logon Autostart Execution: Active Setup
- Manipulates Digital Signatures
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1312
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD5513f69829f80c63b9c41fbd5c2e7b236
SHA1495ef59bf409f1bc2029c7f21b04bdc4fbaab0c6
SHA25639f60eb0bbebaa9717ebe7e7af75842ed65992ca25a236002c2322054223dfd2
SHA512621644d668ebe3ecd0279ba5219b59224b8234bcc23444d639bab03e56a3721ea590e1fc6bf6d6d1f33fcd595cc910c2c13b952e26c1c0c471f9e2399cdad26b
-
Filesize
96KB
MD5c1494c32fcdfc3fc5bd269986d596071
SHA1db65668159940108f68772f76644dd86d39c9ddc
SHA25689fc1a4266b24bf5002080b676ff08d76abadc7503aa1ab7a7d95f93343cab75
SHA512c1293560fa095787f742e37c343ed0b5e060dbbd711aee1bc53b93335bb1d8446901630799334f8087a825957b1fe29436a4e3f1a9d63637524cb137052e999b
-
Filesize
28KB
MD5c193b6164b7cf695f042dba1a00997a3
SHA111da456d83eaa6564ced7769c65efac6a24a93f1
SHA25611c5c88f25102f9527cd72062c3a20840ddfddf62a869287eca977063dd3e08e
SHA5128a3964d6808a3ceb8e40a2a73780e4277bddcfed173fca3b099a72e641d49e3c25b51b5f5c9fceffd8fdd3743488a35dc893245eacdd66cc7eb8420505383d56
-
Filesize
13KB
MD596216cfa8f541578fabc12aec983aeb1
SHA186f96931cb83e90e2dae9900fa0c5340e8a2a194
SHA25608d159b1ece14fbdeb0cff2c8b117e7f244610dd55566d859c2fdf9e674976ed
SHA512504bb9e61bc69fbc49c94f7bc4f221498065b673911565b810b162d7be7da669765c76955c684b4cd58c86001f53e39dc96510f516726fc798b64247da71fcd4
-
Filesize
454KB
MD5e360e9fa0d2bc67603ad8aa4328136c6
SHA11638d154e201029403bcd1540b60f02357a3c6d6
SHA256cd1818ed991851cd055382cc868b746ba84d3668ae0d47e76b42a4a307f593cb
SHA512a7be35c690a14d80e27ebd64ee07b1512e5dd2ae925a808eb7c655a29047bdbcb312200067f6b45e816c28aea60fe6ea5b91c724c2dbc151a8f69c22ae219f0d
-
Filesize
9KB
MD5fa27899a21067617b2bb775e691e7c17
SHA1503ddb6497bc0d399ac070a52d266c428cd10e8a
SHA256a1d00d9bb3e9040f13ddecaa2326640b02023ea0c780f4f3888689eb6ad2104f
SHA51226d619fcbd63ff6185095d2d04673fe393292f2c54ea50c203bdfebdac12033d6907be4d0e20ea61ccf304a3495ffd5c2525260be1de6ba1a07fe13e50009150
-
Filesize
8KB
MD5ce56edf4ec29c283d4e88fb40c1e14b4
SHA1fda29d9b2ec76fb8725f7ec33857bc9bb6fdef9c
SHA2562935dee89a05adef511f5e4ee493a8a86eeb234629ce8c040ba6c58f8c38c859
SHA512dc6b0d6de360232c02eb62ae688cc68237f39a2036b56b21eb2c54e08c9a3bd273d020567d74ac719ab26890d781d2069107e8dabc317d5cce74c5a889ecac95
-
Filesize
148KB
MD5055353c41855329c198bb46106320bdb
SHA1953edf51209c81807bb950dfe41ae08a5d824b4d
SHA256ccbe15552148680c31a2963710a80103b3ae07d1c23c8a4bc3947374fc31834c
SHA512150af17035d23bd8da9799106848fced252157820f1f21710a9274a69534a9b01cd92f271a80a1b6f587d1666e5225341a20b12c5553f476149466efe189da02
-
Filesize
10KB
MD56f1a32d143b5f4f4a3cb135021995e21
SHA109c91c8496c979f4e09d1e91a4d7f4e9aed3e234
SHA2564dfdde35373e0b2dcfa99bc5ea1516b28c6c9ddd16c2b81fa8e7d3f56ce020ce
SHA512ce365e8e766013f8107ac48d7c2e8474d590eb04c4ba57b46092014060a98d0f44aaf9e43b2d673b8ec6b1a139c2481375c70e623d866486b8380c40cc0d7413
-
Filesize
148KB
MD5a73bec00e9c23dcd34ca8c2055e950e7
SHA1aa23cef84c2049aa196e60b3bec7d8bd4984b973
SHA2568138579cecc8ca4d4ffcaab3876e6c3cd78ad22164903e98932db9f3fe6c77f8
SHA5126749c99468974d72326c826d178a4fd47cc5e0e35fc72d29521cf86303dce4608c9eb523cdfd20f85ce239b91c9c3989efdd49944a9e51182f7da8397b9eb486
-
Filesize
11KB
MD511c397da07b995fe8f99a33b5bf89569
SHA15b56d64e26ed0a229498c6739e78edadbb66e686
SHA256df8f8dc202332b62be4550c1c677d5b1ab94257637de81797d2638b9330c2c4c
SHA5127040feda58e22533fa239481aa512188b94ce52874a096fa4c0d1b632e944a93da9d333057ce59ad0baeedd5b4ef107df39014b8ec6a2bb8555fdf88d4d11750
-
Filesize
428KB
MD505744121db054560ea28f7178861e6b0
SHA1551cea7603a441fb7016532138cf89f81008804f
SHA2567bd9ce993f7c559c2fcfb17b708535c03fea1300b5fb2f312fd503dcf23268dc
SHA5127845c2ea3d402de0462c8a7ca36de590e3a561815452d670caf1750dc887f5664d5702274a48a86ed72a8158779007d8f43fccd0b4b11b6a2b268549f8e6bfb6
-
Filesize
112KB
MD5f5aff05c4b08ef753084d19690cfb5f3
SHA18fd83a7cabc99b10ec0fe9b80024cd9b57f2d594
SHA256ff55af695f614fed069a5407ec33cfa0b701b61aab78930f077a887908e9744d
SHA512032c3a6e6774307fa261bcfcea0e52aa2af46c52425142b46fece2f7f77e3743797c82160dc4ccb9e8454b791bf5035abff35b233c9a5cb18b30bac84182af31
-
Filesize
7KB
MD55029918b96997a3fc0fcc59c9cea38c7
SHA14885c3b5bc135d1984d9c23a93db3adc08ed6cc9
SHA256b5a6f79888ecb817d1a218b507262aaad6553362ba3719290a4750f1b9d6abd7
SHA512b56c93119cb3a4a6d29633132e642a7218128cbf84ed25ecc29c798681879b466d68235a4a9c65b1227624d23a8da1c4dc15739609e4efd53a997b9fc7687bca
-
Filesize
52KB
MD5fd70a58379688f01c1bd0a93cd4d73a8
SHA1da6a7a557b642020ef20224cc80688e7bbe9a945
SHA256445a59b4229c3f27ccd31998691fc7712112bca37fbc3b82e42881c3f1ab4e1f
SHA512a7217fb4ccbf35fdd1790321e9cee0fe225d99172b22b9ece4539193020ee3c53b3ffb5d220b0a771c32fd6ec1c63d9669b151acf32f753207ae03fc78f751e6
-
Filesize
28KB
MD51fd9724f26ccf867a087af0c318053ac
SHA150b198b178280ebccb1fce8a4977110eb561d303
SHA256b377da2144bdedea8c7e3bd8e2f867cf8d6cb608609c5f8491ef19f7a5d37a5c
SHA5120f1d129de626174dc8f04c18187b8bf2e0fa38f6e9ba9ae45cc7cb28f738721e39a1222afde58e556f5895d8597c1535b439758cc0d79b3b7fbb30741097c4ac
-
Filesize
64KB
MD51905f39172a4864f8abad9337bdcad22
SHA1cf6e84595529d4be8c1c017ce3a891c46045ba30
SHA2566d85ecedec85ee047cbaf19da675402288318db63b8df3adcdd0aeac3f46edd4
SHA512fe031cf9a59750815a4a192fd5a876af880efffa734cd08fb7b28b965091a1b7c6182fb2dd006515c5fc938f9b0c240250491b62b44910830e5b8fc631ea90af
-
Filesize
96KB
MD5ab23681c2fa65c460b1e5d5db034fdd0
SHA11e7fce121c2045b0fa49607570aca5e4edb1da7e
SHA256661882a3222b5a4a85a7db9487fd6170da9b662f765ad97ce17e81d90b677516
SHA51274dd8401edf214e79bf09bfd034c4b46f8b5fc41d042e9ca1af73addf8a0e29bd61836d02f7ff83ee36a92efffd0855da507ae4f55aceb0cf79681f55db5ad7b
-
Filesize
684KB
MD59bf6dfe7cc420b1ba1d56cba882726aa
SHA14de5ac44b843cc74580d851911a7908fb350efaf
SHA25671acd4d01c8d87fd70f47fb9ce777a2b2ebf3ff857d65b1afe344b275e18194c
SHA51255507d144bcebcb49538be7c41e3d1f6d8cf01ee899b88b6b61c94277699be22531d34e262b5da31e1f43fab7e161664df6b8671345e70684b2300d7c49e2504