Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-10-2024 21:53
Static task
static1
Behavioral task
behavioral1
Sample
445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe
-
Size
211KB
-
MD5
445ccd39adf264dd422cd181f7bfa915
-
SHA1
85f9e892fd3a6b396868d2f06f33fcd7ffbe9eab
-
SHA256
f1790d16765d15529243d326719330b7d0ad989f6fa452108e11646cc9328873
-
SHA512
9ce007c002a25dd6b0261cf2def6c3b1c486c72324d952c74754c2785d7273d23bc5ae8cb1097a482b2d4496e0ce97f7c2df03b4691a7cda04899a1e093069de
-
SSDEEP
3072:uyAaQqe90u5DdXJP45JxrpjTo2/G08XcK+fQM8X7Y79eUHnXALNODNvOz55E:uyAge9RNOxrF/GBXcKUQYMUHXLD52E
Malware Config
Extracted
C:\Users\Admin\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.xmfir0.win/D8B0-1C91-7EDB-0063-700C
http://cerberhhyed5frqa.gkfit9.win/D8B0-1C91-7EDB-0063-700C
http://cerberhhyed5frqa.305iot.win/D8B0-1C91-7EDB-0063-700C
http://cerberhhyed5frqa.dkrti5.win/D8B0-1C91-7EDB-0063-700C
http://cerberhhyed5frqa.vmfu48.win/D8B0-1C91-7EDB-0063-700C
http://cerberhhyed5frqa.onion/D8B0-1C91-7EDB-0063-700C
Extracted
C:\Users\Admin\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16400) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{73E2C040-E79E-C111-12FC-85EE17911C8A}\\raserver.exe\"" raserver.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{73E2C040-E79E-C111-12FC-85EE17911C8A}\\raserver.exe\"" 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation raserver.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\raserver.lnk 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\raserver.lnk raserver.exe -
Executes dropped EXE 2 IoCs
pid Process 4436 raserver.exe 1072 raserver.exe -
Loads dropped DLL 6 IoCs
pid Process 2672 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe 2672 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe 2672 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe 4436 raserver.exe 4436 raserver.exe 4436 raserver.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\raserver = "\"C:\\Users\\Admin\\AppData\\Roaming\\{73E2C040-E79E-C111-12FC-85EE17911C8A}\\raserver.exe\"" raserver.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raserver = "\"C:\\Users\\Admin\\AppData\\Roaming\\{73E2C040-E79E-C111-12FC-85EE17911C8A}\\raserver.exe\"" 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\raserver = "\"C:\\Users\\Admin\\AppData\\Roaming\\{73E2C040-E79E-C111-12FC-85EE17911C8A}\\raserver.exe\"" 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raserver = "\"C:\\Users\\Admin\\AppData\\Roaming\\{73E2C040-E79E-C111-12FC-85EE17911C8A}\\raserver.exe\"" raserver.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 28 ipinfo.io -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpA5AC.bmp" raserver.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2672 set thread context of 4652 2672 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe 89 PID 4436 set thread context of 1072 4436 raserver.exe 105 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language raserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language raserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5000 cmd.exe 5060 PING.EXE 5560 cmd.exe 5732 PING.EXE -
NSIS installer 2 IoCs
resource yara_rule behavioral2/files/0x0007000000023cde-59.dat nsis_installer_1 behavioral2/files/0x0007000000023cde-59.dat nsis_installer_2 -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2316 vssadmin.exe -
Kills process with taskkill 2 IoCs
pid Process 1844 taskkill.exe 5616 taskkill.exe -
Modifies Control Panel 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{73E2C040-E79E-C111-12FC-85EE17911C8A}\\raserver.exe\"" 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\Desktop raserver.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{73E2C040-E79E-C111-12FC-85EE17911C8A}\\raserver.exe\"" raserver.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\Desktop 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings raserver.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 5060 PING.EXE 5732 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe 1072 raserver.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe -
Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeDebugPrivilege 4652 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe Token: SeDebugPrivilege 1844 taskkill.exe Token: SeDebugPrivilege 1072 raserver.exe Token: SeBackupPrivilege 2356 vssvc.exe Token: SeRestorePrivilege 2356 vssvc.exe Token: SeAuditPrivilege 2356 vssvc.exe Token: SeIncreaseQuotaPrivilege 4564 wmic.exe Token: SeSecurityPrivilege 4564 wmic.exe Token: SeTakeOwnershipPrivilege 4564 wmic.exe Token: SeLoadDriverPrivilege 4564 wmic.exe Token: SeSystemProfilePrivilege 4564 wmic.exe Token: SeSystemtimePrivilege 4564 wmic.exe Token: SeProfSingleProcessPrivilege 4564 wmic.exe Token: SeIncBasePriorityPrivilege 4564 wmic.exe Token: SeCreatePagefilePrivilege 4564 wmic.exe Token: SeBackupPrivilege 4564 wmic.exe Token: SeRestorePrivilege 4564 wmic.exe Token: SeShutdownPrivilege 4564 wmic.exe Token: SeDebugPrivilege 4564 wmic.exe Token: SeSystemEnvironmentPrivilege 4564 wmic.exe Token: SeRemoteShutdownPrivilege 4564 wmic.exe Token: SeUndockPrivilege 4564 wmic.exe Token: SeManageVolumePrivilege 4564 wmic.exe Token: 33 4564 wmic.exe Token: 34 4564 wmic.exe Token: 35 4564 wmic.exe Token: 36 4564 wmic.exe Token: SeIncreaseQuotaPrivilege 4564 wmic.exe Token: SeSecurityPrivilege 4564 wmic.exe Token: SeTakeOwnershipPrivilege 4564 wmic.exe Token: SeLoadDriverPrivilege 4564 wmic.exe Token: SeSystemProfilePrivilege 4564 wmic.exe Token: SeSystemtimePrivilege 4564 wmic.exe Token: SeProfSingleProcessPrivilege 4564 wmic.exe Token: SeIncBasePriorityPrivilege 4564 wmic.exe Token: SeCreatePagefilePrivilege 4564 wmic.exe Token: SeBackupPrivilege 4564 wmic.exe Token: SeRestorePrivilege 4564 wmic.exe Token: SeShutdownPrivilege 4564 wmic.exe Token: SeDebugPrivilege 4564 wmic.exe Token: SeSystemEnvironmentPrivilege 4564 wmic.exe Token: SeRemoteShutdownPrivilege 4564 wmic.exe Token: SeUndockPrivilege 4564 wmic.exe Token: SeManageVolumePrivilege 4564 wmic.exe Token: 33 4564 wmic.exe Token: 34 4564 wmic.exe Token: 35 4564 wmic.exe Token: 36 4564 wmic.exe Token: 33 4920 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4920 AUDIODG.EXE Token: SeDebugPrivilege 5616 taskkill.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 4652 2672 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe 89 PID 2672 wrote to memory of 4652 2672 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe 89 PID 2672 wrote to memory of 4652 2672 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe 89 PID 2672 wrote to memory of 4652 2672 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe 89 PID 2672 wrote to memory of 4652 2672 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe 89 PID 2672 wrote to memory of 4652 2672 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe 89 PID 2672 wrote to memory of 4652 2672 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe 89 PID 2672 wrote to memory of 4652 2672 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe 89 PID 2672 wrote to memory of 4652 2672 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe 89 PID 4652 wrote to memory of 4436 4652 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe 100 PID 4652 wrote to memory of 4436 4652 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe 100 PID 4652 wrote to memory of 4436 4652 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe 100 PID 4652 wrote to memory of 5000 4652 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe 101 PID 4652 wrote to memory of 5000 4652 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe 101 PID 4652 wrote to memory of 5000 4652 445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe 101 PID 5000 wrote to memory of 1844 5000 cmd.exe 103 PID 5000 wrote to memory of 1844 5000 cmd.exe 103 PID 5000 wrote to memory of 1844 5000 cmd.exe 103 PID 5000 wrote to memory of 5060 5000 cmd.exe 104 PID 5000 wrote to memory of 5060 5000 cmd.exe 104 PID 5000 wrote to memory of 5060 5000 cmd.exe 104 PID 4436 wrote to memory of 1072 4436 raserver.exe 105 PID 4436 wrote to memory of 1072 4436 raserver.exe 105 PID 4436 wrote to memory of 1072 4436 raserver.exe 105 PID 4436 wrote to memory of 1072 4436 raserver.exe 105 PID 4436 wrote to memory of 1072 4436 raserver.exe 105 PID 4436 wrote to memory of 1072 4436 raserver.exe 105 PID 4436 wrote to memory of 1072 4436 raserver.exe 105 PID 4436 wrote to memory of 1072 4436 raserver.exe 105 PID 4436 wrote to memory of 1072 4436 raserver.exe 105 PID 1072 wrote to memory of 2316 1072 raserver.exe 106 PID 1072 wrote to memory of 2316 1072 raserver.exe 106 PID 1072 wrote to memory of 4564 1072 raserver.exe 111 PID 1072 wrote to memory of 4564 1072 raserver.exe 111 PID 1072 wrote to memory of 3364 1072 raserver.exe 129 PID 1072 wrote to memory of 3364 1072 raserver.exe 129 PID 3364 wrote to memory of 644 3364 msedge.exe 130 PID 3364 wrote to memory of 644 3364 msedge.exe 130 PID 1072 wrote to memory of 3048 1072 raserver.exe 131 PID 1072 wrote to memory of 3048 1072 raserver.exe 131 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 PID 3364 wrote to memory of 5088 3364 msedge.exe 132 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Roaming\{73E2C040-E79E-C111-12FC-85EE17911C8A}\raserver.exe"C:\Users\Admin\AppData\Roaming\{73E2C040-E79E-C111-12FC-85EE17911C8A}\raserver.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Roaming\{73E2C040-E79E-C111-12FC-85EE17911C8A}\raserver.exe"C:\Users\Admin\AppData\Roaming\{73E2C040-E79E-C111-12FC-85EE17911C8A}\raserver.exe"4⤵
- Adds policy Run key to start application
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet5⤵
- Interacts with shadow copies
PID:2316
-
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html5⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe643546f8,0x7ffe64354708,0x7ffe643547186⤵PID:644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:26⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:36⤵PID:1080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:86⤵PID:4136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:16⤵PID:2528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:16⤵PID:3812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:16⤵PID:2640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:16⤵PID:4164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:16⤵PID:3440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:86⤵PID:1444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:86⤵PID:4164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:16⤵PID:4396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:16⤵PID:4476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:16⤵PID:408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14136994168664721983,12229753890159430529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:16⤵PID:5200
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt5⤵PID:3048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cerberhhyed5frqa.xmfir0.win/D8B0-1C91-7EDB-0063-700C5⤵PID:2012
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe643546f8,0x7ffe64354708,0x7ffe643547186⤵PID:1760
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"5⤵PID:4000
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "raserver.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{73E2C040-E79E-C111-12FC-85EE17911C8A}\raserver.exe" > NUL5⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:5560 -
C:\Windows\system32\taskkill.exetaskkill /t /f /im "raserver.exe"6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5616
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5732
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe" > NUL3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "445ccd39adf264dd422cd181f7bfa915_JaffaCakes118.exe"4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1844
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5060
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2356
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1724
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4808
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4a8 0x33c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4920
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
2Query Registry
2Remote System Discovery
1System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD54f5769d6a05d83ce0dc50d87b7df639d
SHA10f027394298555259050a75d5dc968eb014200c4
SHA256d9fafd4c06349abb942048752bafa06ee63fe9e94c7f27e61536e7d0fc54741c
SHA512084f4476ae11de8b72bca8b3c190b8ebc4831668a8620dac2f709973f84b046c1c66d63b16bdfea63ca87f4be1c1fdf7633db9794e515a76593004d391bb8a40
-
Filesize
10KB
MD527663044ebdbd2f8bacaa1012a3d57bc
SHA1537ad94836dcf9e7f2ad73eefe33de9cc6eb8fc6
SHA256ac5b42836700b51fe54493d9e750968e91c1d325cbe4fbd44f3e0cfd532f047c
SHA5126e824b560b8341bb022acc1651fb8e1ee90a00735f2cca34a6bcd5f1f8263c0a1ee4bb8d65fdc2539f56830f797b252b767c6400739bbcdb0fa5625d5b9fffff
-
Filesize
85B
MD5a25454b04f35ef908526489062451a43
SHA1a6484d0cdf01fb37a1727933eb33f1e210e9b155
SHA25606a3bd1883891266f4f84d415a8ec160423a825873b77d9c0de42ad36b5e6ddf
SHA512e077fedb776963658816a3174d7a38d63bbfa5abee547ee430ecc55d9208ad72748f0aa575a0c068fccd03364c66207d922687c9821a0a2e5418720eaa109bff
-
Filesize
225B
MD5f6d629f2a4c0815f005230185bd892fe
SHA11572070cf8773883a6fd5f5d1eb51ec724bbf708
SHA256ff1de66f8a5386adc3363ee5e5f5ead298104d47de1db67941dcbfc0c4e7781f
SHA512b63ecf71f48394df16ef117750ed8608cc6fd45a621796478390a5d8e614255d12c96881811de1fd687985839d7401efb89b956bb4ea7c8af00c406d51afbc7c
-
Filesize
152B
MD5443a627d539ca4eab732bad0cbe7332b
SHA186b18b906a1acd2a22f4b2c78ac3564c394a9569
SHA2561e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9
SHA512923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d
-
Filesize
152B
MD599afa4934d1e3c56bbce114b356e8a99
SHA13f0e7a1a28d9d9c06b6663df5d83a65c84d52581
SHA25608e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8
SHA51276686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da
-
Filesize
6KB
MD51188036b0efe9a4d37778498f0bad22f
SHA1bfe423b93d47343c7de527379ecc7f99976101e9
SHA25698cc35bf203bdfe92ffa3b5c6007e00ff4d4f54fd31ff1fbfa2f8e68b8624b5d
SHA5122077e2fac680bd1bcb6957afab862e74d475d5d1198cddf0a98ed07c8c810bc7130683eeeab1e3aca63202beb6f9722d8c70929888cfb2469275672adfc79a62
-
Filesize
6KB
MD588b581d5d526aadb914120e2dd173f67
SHA11c3dfa9eecf4ca1d5c88a6e4e0680f4ace3a175c
SHA25612ff78cce6eca3e4ed042982a3c3c6b8d52f7590e40963c174040adc75f7aa45
SHA512a22b2826ac541bd6c96820c5cd06d2f8784658a09efdf8055df79583d8529373f0728b790c3a3fa4f711b13f9a0758de9b0fc02b4be0bd9259e04d68ab81ccfa
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD5dc2a7d82d16cbb6e0f25417e97aef9e9
SHA19fa913594ec8cf24b283dd409614645cb81e8421
SHA256139645b68a01aa45af82fc5130beba1905030fa8cf37335c44f1aabe366ff436
SHA5121e1a2fbc3ec297f25551948ed1c91b799c4e7f381a66d6eac7ef86f3d07c59d982a2dbdab1da2ef1c4f8484b3048a310b590f5d247836779f6027c239ed3af57
-
Filesize
11KB
MD56f5257c0b8c0ef4d440f4f4fce85fb1b
SHA1b6ac111dfb0d1fc75ad09c56bde7830232395785
SHA256b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1
SHA512a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8
-
Filesize
1KB
MD50867f716af23d31be71dfae15132e9f7
SHA15c6bcc7c2ec90563aecab3d5ae9be796ec711667
SHA256fd3a370b8f2b85902afed937a0e5b562c0aa978850cf21fa1269279162721859
SHA512419f771cdc80f86a1682c14ed60ed5c22a31b141e88f456b74b52f830642e4ed220c0c59d725dc1d9e69f8f68831d441c802a47b180bd5404768c2d9eb80aa4d
-
Filesize
1KB
MD56d07737bfe629f02f13c37ddeeb4773a
SHA14ac6fcf803cfe6d07fc1f709e73783674a87091e
SHA256eeb7eabec03ac23cf799cd60514ec95b4f853cef2a260e9873c4f597b5733f66
SHA5126bdbd84daa09f9c919437ea4aee239652af230ec6b07b16b6e3f901313d59278d2bb0eeeb5c1ecbc18d529dfe71f63f875c95246e9c441b0b891fad86950bc53
-
Filesize
344B
MD50def94f52c5e45256232320aaffeb1ce
SHA181508ec66d4305d2f291c666943fa19629fa67f3
SHA256959986b33f56465e2acfe85004c168e0c0988b69ec726bf7f18f0936dacefa1f
SHA5123400a02c438896d2a76b8e4c42e875b93d5806f9d8ebab0d9650359e89db8a891b873ec988031a08eadc3e686251cb5bfae5b59aff4e5105bb8a53e888b97f09
-
Filesize
716B
MD5eb4b5c7ec0788f5e539797f5579ac42b
SHA1e38935a1fac4650a37b89d87e973acd1d4d0898c
SHA256cb306a1063d1d2462b1fe3e6dc79f09558ed8863fb9eec1b02c6e157dd3e5a0a
SHA51225d022d838ff272af911610585679e3f5bdb074bdb22d4d8c00811d3119dda04ee18b2b201f0fc54745025567225ae39742b874156d92ea81782416baaeff667
-
Filesize
453B
MD56ee80d47909884474a149de238fd366f
SHA176880a7d4afb20d51b0eead05ef5d1a16b86d615
SHA256fed08d02e1f70abeb3e85207c8aca77404c3d4a5e067782a92fcf84763b5cfb1
SHA512d1a2adb50239615616a76ed75f7607cff723e8d6979aa67244ee17031e2bb73629a44d10228e215d9beeee4e0d628b20978bdd5b025a69a20d80a4205e7afc7b
-
Filesize
3KB
MD519ad62300dd66d6f479b13c40bae58e4
SHA1c2393e348c48f9f3e6644f08473dfe22f889f9b2
SHA2566505cb7369eb363a6dca90fd9dccfcb98bfd9eb9a1aaf586652f6e2950ff719d
SHA5122bca333525c9892bd0cf13ec58d1786b67b1c63f1e7cfe688383fdba366ae8dede26f4bcaebce2b5c393987a9a2fef6c9cabf150ac0d0bc3f7d332c09aa3029d
-
Filesize
3KB
MD5f000cae0746571f16ea828644b48d7c8
SHA1ed49ce8faf0681058f7ff56b1ceabac5a08a5577
SHA2565bd62c9373f40d25dab917fcff8b3da24373e826ab8cf209781f727d68adcd48
SHA5122272229465ec21ac5fe180f78a9004cd43bb73de731dd4f61c7ff34faeb0118e61a2e25823c935c15020ee5014414870f21d782fb511685f64988b877368027e
-
Filesize
524B
MD5b69b3adad4d6eb984ab4b597486038ee
SHA1024a44587667fa1419d3f3aa8ce6b6111169e09b
SHA25616b36fc550ca223fe6f35dadbdcd9746e84ad32b1880b9bf80ddbdabef7db156
SHA5121b534f8675d75bc5aad72135c82ab107a1f59a755d86b32e0d5b4d7498ce0ee72394bbb872930f5841d6d70879d903e7bb861261b52937f3b036afd8cc804058
-
Filesize
524B
MD501530c78ad082b812f0666d1be154bb7
SHA1a1004c03b9f0428ea8ad12ee56563b601469eadf
SHA256d380af43b5904bde5c53957f51627472f4186086b3124015b9854e91324244e5
SHA51218655104239779a14ba03fa98ad02ed9f9750f954f7d1258b2bc4fa367d8291a13d0567dc075a5032f5fd4fdec615cf7e79e8714818b68f420688eab4e89e467
-
Filesize
4KB
MD5a59552f1c776a3745ca8391aff8bcca6
SHA1be8e062d1fec7eed2ab33177019069798fde07ff
SHA2564adb9b44ae64eee08d87750ba2cd2ddb1e88da5ff7e90c63d813755d73a92005
SHA5121ee933756e08f71219753f5921ccbc8c307541ce4bfc15a654cbea075d7c28071b627779cec9d2146d8263e37dc8005bd333275058dc0de9a62c74391bd24595
-
Filesize
1KB
MD5ffcdcb20bd0798d3a424d11cb66cb889
SHA1dc6a7ab6705b3dc39ac17f789b618fcf778fc33e
SHA256d46d741412eedb69a13f292affbfb9b6cd1c5d18cee9bae789f5198cc766800b
SHA51289d18ed4f271db9d9e42c7138e668fbca50f98b9b83865a5293882195f2289aeadd4c09dc64b01f1d794aa25a27d46674e6d349df4aabdfe264e982346425e59
-
Filesize
127B
MD528d9887b962ab59d294eae376d61e315
SHA1b93371861f6ee888be1fb2b26a6a0bca7214d9c9
SHA2564c152354148193159c8e7de1f7d0a6ce921ef4c2b82c519e9a213aceb09b068c
SHA512010d32d5d3bdeae824e9d797e669d3752a1b24d33d68d9b119ad1457b527d05e4f17b2b41c92ea35fd7d82929ae1ffefac253d6be5d38186c360f509676dbd2e
-
Filesize
40KB
MD552ae8f7762522c2c6bad92bb437aac2e
SHA1323ab7cc3fdc285d9b19bcf3b1000227a0cf8f58
SHA2566bfa771b9bdb75e44601044b4bbaec87583caca07839814c7afb241f783282b0
SHA512a3cd9752e4576ed19fd57f24d562582ea1cd8ed775d96182b2fbc5de40d44f4e8a6b4ff1cda712748d2c98236a03b39d4b3d3fda69eca9fb4e59853b841fa398
-
Filesize
123KB
MD545f0acce40593a69a9a9938278aa3ebb
SHA1b1527ff839fe5f8f60f9f0873134bdde96e0185f
SHA25684ea3b5bc418eedf2088b0e1ce2ff4e943694df0f366c323daa541e041a3d1db
SHA51263bb4b010b2dbb175e00001eed512500d978a5511bb1790dd251b8ba8f1f835ed591b37963488c554e7161eb12430ef1713008f46febd5048dc466d75c753b8d
-
Filesize
27B
MD550acae087c7cadcbea89084d596e0ce1
SHA15d3b809185cbb2f7bcb9eaf019c28e9f60ff7672
SHA256473ce905ead8fdc35cd9a60dec506b6ed2462dd176d44a7e412601d1e8a725b3
SHA5124af6081e8a4b19b0fb9f82f67182f0c9d9b4c03d54df38a92e90e01a911189bd90171d5b5675dd450f6de478c137eb04852e13e87716bd19faf4150ab1747971
-
Filesize
1KB
MD5e8c6f36ce807cca7b555d39c1f04506e
SHA19a8f1287951eb28cc936255a67c9acd81d6064f6
SHA2567b6b717244d26344557088fee8cf9bdce3eafb6b79ab55c2c08d5140e8ca892c
SHA512a93cdb061ff34c82b581e0f38d1147753cbe85e4377d2d82268ca1e47ac37ce476fe8cbcecd25b670e704c575e6fec753abc0cd634b53e63ef0f36e7e5a5c876
-
Filesize
1KB
MD5857267961ea1d474c6f4eafa8a963ad1
SHA1c2c219e79844ef2444a03d8ed443fa17d8784593
SHA256de26a311ddbb8e30acec416ba66b71c0bdf6dc3369b9b51e2d2947c643c442f3
SHA5125f426015386785dd21e3a4f1c675c3b4eb10523c6cbe2228908ce244e0776d208d756464c86cfd4701585b1ba137d7726eaf6c8c159661c294ea78ec3204e71f
-
Filesize
1KB
MD566c966605830cb94d10fc95415ca9cec
SHA10f0bf09b6c04039cfd3c7e837ef073b48dd50f69
SHA256f6940a3a972c99fa34d755fd91e3f733e192d591851b76a56fbc181fa0262245
SHA512a04554662680e5cd6b5d748266e528b5fec7fb16b998c077e4f1bc06b85749716110840e01e5702dfd0fab5018d58999bb4eb02756a77bd18c1e4237544f0ae8
-
Filesize
1KB
MD5a8eb07304def5b4b6107ff965eef0b5c
SHA123948e2ff5c53b371531e0cf5d380d4e4a9b2f63
SHA256955479e2007a213237a290c61a7a8ec4dad949b9e1ecef4d0512ae5d4a6a9415
SHA512b1dd0d13f1298167b5ef366c9b999c3c69b14c9e8cd8b87ce2b62c520bd14c78cef08a106790494f011f92083e4330ba6e4aec38dc0b185b5933dee6bfd3c29d
-
Filesize
53B
MD51f4b75f76c2f4f47cc4d09ad69c9ddb9
SHA1ad667b272ad8c36f21f330c3fc5cdf463f27ab24
SHA256cabdd5f56d8321156f29249d4e10c450670728495975b553eeba49031c8e47ee
SHA512b7a5c6e0e14271897d49003037b8d105525ce11b2765c8f295acc38c1b5031fcc549a2dca3484528dfbd4df8ece203e617e2b8d7f226f5b623f571c30e4fa709
-
Filesize
435B
MD5ec27edb651223d1e829367628e0a22e1
SHA123840eaa578eec0555ab193922f98f2d65191bcb
SHA256f1432febd34374b00d2052e0727a589e1c3cef516f306a738b0955ab530c3583
SHA51265f1fc5937cb29cda3c28840245eba9206e01c35564e5884a4f29252ffa0fa78f1d5ff2cfa3d85d1be55accd51cabfb2773d32f7520c4fcdf8546183b7847204
-
Filesize
1KB
MD5370c70320cdcba10bcfb8afd5267888c
SHA1fe7d143794554dad4776c43066581d4fe094e6c8
SHA256b0ec9d1769d4dd4aba3ab79593972e1326e8008798d39fcff8857283efca836d
SHA512f5e44b869969619f0aac46054d10d1b75c915b4363cdb74ce3616867f48644e3f5508520b412b43e31a82767dcb925598a4653f7cfb3cf0e11f18ec6ed9ce39a
-
Filesize
1KB
MD543e2689baec1e0afd38fc77eba1c8abe
SHA1caca77c50543109a5a1b61a590a45b4f6b9f7441
SHA256f337061e91fa2accda0f605ce8ec6f9051f0cbb4e24ee08480140c87bbdef22a
SHA5125d90584200804ec1030950c2b09465e18c2104a6baf6000bf26ba61283113a38103532cb9141f0d290ba8a3d0de08976d6083412c1ec07f1e11ed093ed7243b0
-
Filesize
837B
MD58961808067af5253f333cdf0c8139004
SHA129adf64660e293b41583decab8a05df8edc93740
SHA25696108677136e482951437c3b41e0f6aec42526cb065b8654ef5b81343f788be9
SHA512ef88d7aa922ff6ce6b75f87c4b380a861db60dce94c4b0b958f5fdcd6685739a3a49ba5ff574a6df9e1f6673cd1d4b615a6327834dd53e25658e1c1e76be9c92
-
Filesize
1KB
MD5b32dace88cac82a07aa96fe87656f2c6
SHA108e511031a33a4680a5c586e695e699f78fc016e
SHA256680bb1c63be8b490df6caf85a8dcc8192b32b57aa331b7e3a49e3d9ad0540a58
SHA512b3f6c7ebc67bc2b555b67f314d6f3b898c08f132487201d105953c88baa09d382b7d55501aa9bc051b46ea60095fe2354eea3797cfbec77d48ce92567348d399
-
Filesize
5KB
MD5ac2095fcdfe4603c866f9f6bc157101f
SHA1244c844c54e236bce0ba004adce0832b3a38499e
SHA256716567625c60045faa010895618ebe8fc2879ea4e8d9fafd4dfd67ea03350ed8
SHA5122f95a08d9e5d72efcc6061ced4d59b574cc5b410e580fca273055226c8f45e6f501d201fa7d3d0a6666dd4c811f5f699c4e10ddb5f998111a65399b0fdda831a
-
Filesize
4KB
MD538acb815e1753df1c9ca12d791792f7f
SHA129e9de3f8a01893d85e712066dd6cb2df11d489f
SHA256bf929fa402c7b68b3de876ad186fa7d5be524b83bf47d0ac8b2daf949f086ae8
SHA512126178f9391171d19ac951a7ef3e54cd4391ed3214bb65ceee821a658b00eb369dc54578f339738dca9a5e907f3d66d1e5d62e7d15bac69f6ce29a9c42116fd9
-
Filesize
1KB
MD534013f7ba10c307ffe52cdff5731f3a1
SHA1b86d40b6e5cc2935bf4fd8fe6ea937e9f0c4448c
SHA256adcb5c3760fe94b1e6b205ecaacefa0e8fa34c7882f6668e62b5b82c46e02528
SHA5121d67d32cf696aa0afaccd4761da08d5df97639d6a84eef915dcf3f2d4a814e9401177f11d8bfc641c240c40aa6ed12ce23db9a0b98a90288ea04a59ce32b94d3
-
Filesize
1KB
MD53f1d6a0faa879df8fa3202e131687ee1
SHA1339812d5fad87c162d14e6aaf9c5a313382bf3d5
SHA256b2dfd9fbddc8c041ff3243770174620c3c4716e2993f7ac4d2ca84474933b848
SHA5121433abc7596037061c1128dc1ae3baae698ddd00dabcf41efd7e6ab0a22200ffb3d8a9ff8b8fc7639eeb9f2035b300e2c99bea2e3faef337d58fece719f29359
-
Filesize
3KB
MD5551ace9d95dd3883fdd0b19b37aaca75
SHA17aec5ae020696c1634bb76cfe12e87a20aa413ac
SHA256932d698a7677df7a3389f900c54bb127945ad8e6673b14cc0ed72f04306014bd
SHA51234cab6a038f460d50e1829c927aba3a58ca3a33f8efb0f2482b4b1a118538e564cf0435ce821f70856e2c7ed617ce90ff42a3f1259856aca616b21462608b6b7
-
Filesize
2KB
MD5178e152ee2e209d26786a745433ad712
SHA1a4bbd2efef3aa9dc09a2d393f3cdcb23ffa467c3
SHA256b5036788bb1d86da7263410892e70822e370302394a6c320124b973027d8b0ee
SHA5121f1eda2806b08a1252a865089ec3746fe61e434194634cb75025739e2cd3aec5bb8c0ad7602df19b02140aca3dc620d8fee35d85f40e2d119dbc9ea692fe251c
-
Filesize
775B
MD540c50b766e20fbf2fc6deab710f5aeb3
SHA1bb83416bb7191a49d0bcd37a57e28b719afe354e
SHA256f9d753b34a1bb5f1b8265c97c1b25d02269cd855ec9fc92e75bb690b44aebb75
SHA512aeddb6f4db0e5910df75e3e18d97d4e72350c7e9c07597d6d83ebd7c332deaaf74c82dd96619727cca44b3b764ace57f89b83f040496a86f1827bde25d664d25
-
Filesize
1KB
MD5e94ad4b9610368b911ae9acc29b8ec36
SHA1aa3c6ccc505794c99bbeefc6f9fe7da68e98f0da
SHA25681aa88d6f988acb34b1db52d133e9e8a43850c6a0bd288ff91f012d4bb3485a9
SHA512f71468baf5e22cae28b7ff0f0992026b6d8a2e8d7652d5d4d99982788cd5d1b8717e99841827be699f237307991d8af6d22e566446f9b682ffeb1501c4c2f103
-
Filesize
4KB
MD566774a13c8f3917bd188d164749e9637
SHA1505452afdc8c064bd36d520e38f98a6c2b854348
SHA25627fd5c0dff36fdceb96f8dceab5230010c86e94e295625e46f6ab12ba4b7e69f
SHA512fc43cd5f3aaacdf5ee9749f467b9a86fb661340d3e4a47b8b5096b3dd0a69a4f43a7ccd751f451491b66b29bdf787578f6d29bc5a06aaaeff5a4cf862feede9b
-
Filesize
4KB
MD59982680cc9d875f7fac6914f5f225ecf
SHA14e2323b0413c09cd495b21392338944fea0445f9
SHA256f7ec8f1f7e741f9998ca00a78e41ddd58dc8f14ec53c0711fecfb04cb3837362
SHA512df06e161b863e50873f811f00201d699f7466b27d3dc4a928e103fc93fdb0bebefeed96fc9d98b6982d0cbf6f28bf6456476d50406d66ab05d8468a0ca6a9857
-
Filesize
1KB
MD5970d4ba9d2ff6fa6bb0be1185309d0ac
SHA17d0b05bbd14fbec1f83d466d1a57e019b300373f
SHA256fa9aed53f4fb59fd5a16f49e3700d1feb50b351c904cd817f1cdf0f2e1cf0a3a
SHA5126e174e75057e9edff5b1f78b19e3b9ca67edf54a8552b6f015e86f230add70f869fa4d15a72fa75e16b94b85f6d252f8063b6904a0ca235ff4388fb7cc19fd87
-
Filesize
1KB
MD5ba13484b2294780e6fb964b8dce37525
SHA1bad6a9dabfc3a36e7a9eb87d35bb39a67ea67f8c
SHA25685c350f206f60a4995621208b8b82c271deeb0f7a58f3366b62d010e1886bcad
SHA512a5e3e1dcb28e2297b3bb37b92448f80d88cc2b263c3d07ec419326048c1a33980f0dcbeaaf037a5ba8400b7103f88738729216076f10fe54475351487801f29e
-
Filesize
1KB
MD586b436eac80e09ab73167e1c19482f3f
SHA1df618eaecc275ad751f3e45b71618655572e072f
SHA256f317efe6072c7e4bab43485d3b2dcb2262323159d4a4fb4a41e3561f7d3c57c3
SHA5127e5341acc76fdc0800c18b3879f9cf23e84c8291a15fbac53995cbcb353797dee26725633a45621c48c5303cb7174c92ca1ac9ec7f4067c22aa88a6d16f2a9d9
-
Filesize
960B
MD5fbaa353fc2559f142aea6250a505292b
SHA16b0712045722a8ac05d09d062266ac16e31bb3bf
SHA2561271cb8f19f8d7c04937271a2037db928de5f4eb2ffa4067ae96816ba4c75a09
SHA512e049808e913dea4f7f98d362c28a38894d6523add4bee31a73f3203b3a3a1cf6e7b8efea477c71507b1e823f1f780b61495cbd26264d068035fb908a5482bb8e
-
Filesize
4KB
MD516bbbec98772193c3b712afa603265f2
SHA152c8f2fa55eaf32711b7b8b1721de603d9b45a99
SHA256a527ce92781e80d9db05a09f3dc2339fc5d10942a7da5c08559b38e15e91ff85
SHA51298e41474ef721545ce4e2fae14468be4d14953d5ef5bf708b8216dcb79df8e941e41c7a453409fca8f8f89350ffcfc6d17bb9175d12d106fed74f6cee8428f0f
-
Filesize
3KB
MD5559051954c06cda77ce071b4f054aa48
SHA1ff8efb4e4e9709119dce2a551e71857cbe7edfc9
SHA256a1158994e013285a15cd5bb648f21216c3fb6025b6f6e59c47e03e705f3662c6
SHA512e952db9634a218affb422095645dd11c99079057be3129a56ec93896bbeeea245a0a940d78c61fdcdef4136caf5d4601d9ca06217f2c1bc872e028816225650b
-
Filesize
3KB
MD5bd8078dcc074aaebdc63ba53082e75c2
SHA1a3887f75154e5de9921871a82fe3d6e33b7b5ba7
SHA2569e35270e3510c195a64635292dfcc6dc508e93dcb5715c3e30cf3ec15af6951e
SHA5129a0b6c67c52ba0a0c9175a62680e9e35793676e4e06dfc6b5bafbff3b50474c94c5434e700d19eff4c46ee84ef0a424e850a3e7fd78d6f62d1d19912a8a38e66
-
Filesize
946B
MD5698edf38b621162b47ecec4210df45ed
SHA1d8765a302abe40e55ba29bd26497651a46756f62
SHA256f5907f5e0a5ba15fa9a0878143f71ef4962f0a3a20eea324a526b0cac31b2b01
SHA51208179156c0466572e497aeae7f464cfb34bb7172a6429de7d6e47c3dbb89e0b92a8e5448d5d95ae02ab76615e576218525b8004b63abc03877919accfee67de0
-
Filesize
1KB
MD56dcfd632eb0a8124ea05a92209e73bab
SHA1094612b281c4d378ec3def211d60a259bcb41fca
SHA2560b7e998b98af82bbf0e9f8916aa5e1614a3e42d7a79cd2877c7c72690a42272e
SHA512581f7f73592c3cf0999a76a2400e0d385330d0594f12c1fe7e37cdef492fd2eafafaec2b6310000efac34c507a1bc660a7e9d38158c888e3869d19ca3f74acab
-
Filesize
410B
MD51b509acbb124eda9d7a1f722941096cc
SHA19ed8ce338f74a57365546c4e112cc25564b7c971
SHA256b6eaa77c7f3cc6efa96fc6f7f555477d7ba9226206cc954212d52d2e2dd90ebc
SHA51261ec6ef8e4697456261b9d49b883f40a75f50f5c4c6bcdd4a88809724608fa6645803ec30b687b7d8a07eb6ff088e3eeb5bd46b55e0d916ad4a2fcaeec173d2f
-
Filesize
250B
MD542d41cbebc9df064e55e06bf3bcc5a2c
SHA1b037f0eef44b874aad0091b2c5e3b6bd12f219b1
SHA256b8a3ce2bc7d65d8f2c18b570f14ba03a8729b460e2e6e9a7364308199efbdb40
SHA512fff2355aa493f321eeba30417aa223fae2a57403b26bdc65ef67bdd5a943a32f62bf92c48f1db8fd2fca1f7efa0f8109ba89ee2d14215c663f758e7bed22e989
-
Filesize
2KB
MD5e8d4282400a1c4709ecb37b933269a98
SHA1dc9febbb99924c761c77bf69286241efaa803f38
SHA256cb1765e39a9bfde57e60683657257cdae7c84c88d55be43524168a4010be701e
SHA512f51e18f1705fa4bcb5bd7f072095ee4f9c37ed1503b038854a4a147344f08deda036e000ac4bcfbbe4d688bc238434d18dea75db645c7648ca63e8c00a6b11ec
-
Filesize
4KB
MD57246ded2719a2ed3a5d325dbe15e4226
SHA1d6f781dd2f3d9e3c4388ec7a07b20c9c490f9cef
SHA25644db2977e5bb2422e73c63d4bd1a727779313c1acfe124b205325db391076f3c
SHA51276855b922d4ecfd2caf708dd94a424853f03470f1d13a4ebccb3e56e8068dd36855ae529381f80817be576bd6d43f55e64ce8c1bec12e525a2ea16c090fe97ec
-
Filesize
1KB
MD504e342c4c897da1280973c56fdfa4017
SHA1b035ecefbb20dbf906fe3dcee8bc39e8341f8346
SHA25614130d579b728d41dddeead049bd96a1fa1b41a93bf0de5776164ce467e47790
SHA512aaaaa5f84671de83a894bd5531a0f8dc842763023352db3a74dba9629beaa0020a1bcfd0d6a83752338a13b862cdb69dcf26c6ee4df0c26db0a99a61bf77ab39
-
Filesize
1KB
MD5d9235deeacc7d331ccdc9d5bde06f32e
SHA1b72d0fafe7d59f98ac26f03f2aba7c260be0ecf5
SHA25663abc4a1a89822a59fd6ff22047a5020f37acbc8e35acb2a0dec5061807db943
SHA5122d5006f2fd85ed1d7c8d759f4b562290d4971e690d4e896a13691e85d1ab53aa24c49a21351c69755e6d954ac9f99ab5df97667f128dd3aec87df099ed9f4918
-
Filesize
4KB
MD5ad8bd1d148df05a5e4466ad1aa235238
SHA1a10d10f66ae7b761d52892bcae70ac24be183dd1
SHA2560f8b07de44956f6187754946f127e23f64c646493721db6459367d61eeec9190
SHA512ba291b0d95dc16e089de45f7e5966ccb465a45060f08c9a89403bd948b9f9c8a99d3320f83bbb49adc10ea80f3aa3835d6f541bdde8d9a680f6edd6e3d8b426f
-
Filesize
922B
MD5054b78215f249c0bdb4a66dc5194ff6b
SHA1b7375a86ea0bc22a5a2033ea92eb0435e5a6c0d4
SHA2564acce89219d39f8e1f024bd6e90f93936afc4899821cf0674548f96a80815fb9
SHA512e59c92ff9198afa690a61d789379e6cc448156c20a673e948066dbf97446bf2f11533516d92deba0b865b8b6460b785646cab9970234aada7fda02fdac15fca8
-
Filesize
510B
MD572846352548853b375cd1966c5b25a3a
SHA1c51c6d5641dfcabdb6569e071c502deacda8d2d1
SHA25697f1d4f62e381f8f65d3e7d3da9f3c5d8194c73a2d30a2d08057d0d5ce30e130
SHA512b4c5a4be9a676323e3f1df1eed60761def150a91e237d830c96413770397df3138176ffb1374580b10abb1466bebc8f8aef99d0a44be0fa29ac5edce3cf9874e
-
Filesize
211KB
MD5445ccd39adf264dd422cd181f7bfa915
SHA185f9e892fd3a6b396868d2f06f33fcd7ffbe9eab
SHA256f1790d16765d15529243d326719330b7d0ad989f6fa452108e11646cc9328873
SHA5129ce007c002a25dd6b0261cf2def6c3b1c486c72324d952c74754c2785d7273d23bc5ae8cb1097a482b2d4496e0ce97f7c2df03b4691a7cda04899a1e093069de