Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
21-01-2025 21:28
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe
-
Size
920KB
-
MD5
07a127794c04818ec9231c0623bfb7e7
-
SHA1
3bd0aff1149dbee695f41b8368509da0e62665a2
-
SHA256
27e7132bab1dda48d64b592cca14de9efcb6dd072b467d5ea420e63e8ae737a1
-
SHA512
6e3dfa703bc76895c4b6a9db062e6d1b0bbc4f24da797e8d6e14ee5832c74ec8cd4f3a844b39d8e2f694fa9d54ab6c0e78092f3cdc04a6ecda0728482c8d422f
-
SSDEEP
24576:mJXWAayET+QuawV+XTUknfiuG7weke8juowZKMnunK:XTzuaxjnsywKMnY
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\56106ee3\\X" Explorer.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" keaiti.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" MDdyAsuPL1.exe -
Pony family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\etc\hosts 5eaj.exe -
Deletes itself 1 IoCs
pid Process 888 cmd.exe -
Executes dropped EXE 16 IoCs
pid Process 1100 MDdyAsuPL1.exe 2768 keaiti.exe 2668 2eaj.exe 2412 2eaj.exe 784 2eaj.exe 1044 2eaj.exe 2492 2eaj.exe 2084 2eaj.exe 1328 3eaj.exe 1984 4eaj.exe 332 csrss.exe 2220 X 1620 3eaj.exe 1544 3eaj.exe 2500 5eaj.exe 1348 844D.tmp -
Loads dropped DLL 16 IoCs
pid Process 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 1100 MDdyAsuPL1.exe 1100 MDdyAsuPL1.exe 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 1984 4eaj.exe 1984 4eaj.exe 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 1328 3eaj.exe 1328 3eaj.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 31.193.3.240 Destination IP 31.193.3.240 Destination IP 31.193.3.240 Destination IP 31.193.3.240 Destination IP 31.193.3.240 -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 55 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /w" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /u" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /i" MDdyAsuPL1.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /Y" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /J" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Init = "\"C:\\Users\\Admin\\AppData\\Roaming\\xjmozawqmon1l1xczjtfcskwfvbpocqh2\\svcnost.exe\"" 5eaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /M" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /y" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /l" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /b" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /f" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /B" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /P" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /I" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /z" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /d" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /m" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /O" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /t" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /D" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /N" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /S" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /c" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /v" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /o" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /x" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /j" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /q" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /p" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /L" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /g" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /U" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /K" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /Z" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /A" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /r" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /W" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /F" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /h" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /s" keaiti.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B66.exe = "C:\\Program Files (x86)\\LP\\85FF\\B66.exe" 3eaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /i" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /n" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /Q" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /R" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /e" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /T" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /k" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /X" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /C" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /a" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /V" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /E" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /G" keaiti.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\keaiti = "C:\\Users\\Admin\\keaiti.exe /H" keaiti.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2eaj.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 2eaj.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 2772 tasklist.exe 1176 tasklist.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 2668 set thread context of 2412 2668 2eaj.exe 36 PID 2668 set thread context of 784 2668 2eaj.exe 37 PID 2668 set thread context of 1044 2668 2eaj.exe 38 PID 2668 set thread context of 2492 2668 2eaj.exe 39 PID 2668 set thread context of 2084 2668 2eaj.exe 40 PID 1984 set thread context of 2660 1984 4eaj.exe 52 -
resource yara_rule behavioral1/memory/2412-40-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2412-42-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2412-48-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2412-47-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2412-45-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/784-58-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/784-55-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/784-53-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/784-61-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/784-60-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/784-63-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/1044-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2492-79-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2492-77-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/1044-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1044-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1044-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1044-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1044-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2492-87-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2492-85-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2492-83-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2412-101-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2492-160-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/files/0x0017000000019c57-355.dat upx behavioral1/memory/2500-357-0x0000000000400000-0x0000000000B19000-memory.dmp upx behavioral1/memory/2500-480-0x0000000000400000-0x0000000000B19000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\LP\85FF\B66.exe 3eaj.exe File opened for modification C:\Program Files (x86)\LP\85FF\B66.exe 3eaj.exe File opened for modification C:\Program Files (x86)\LP\85FF\844D.tmp 3eaj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MDdyAsuPL1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2eaj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3eaj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 844D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2eaj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2eaj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3eaj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4eaj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3eaj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language keaiti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 8 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \registry\machine\Software\Classes\Interface\{0ec5cbda-3e74-470a-ed06-b289fae0cf35} 4eaj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0ec5cbda-3e74-470a-ed06-b289fae0cf35}\u = "188" 4eaj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0ec5cbda-3e74-470a-ed06-b289fae0cf35}\cid = "1268773127520020880" 4eaj.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1100 MDdyAsuPL1.exe 1100 MDdyAsuPL1.exe 784 2eaj.exe 1044 2eaj.exe 2768 keaiti.exe 1044 2eaj.exe 2768 keaiti.exe 784 2eaj.exe 2768 keaiti.exe 2768 keaiti.exe 2768 keaiti.exe 1328 3eaj.exe 1328 3eaj.exe 1328 3eaj.exe 1328 3eaj.exe 1328 3eaj.exe 1328 3eaj.exe 784 2eaj.exe 2768 keaiti.exe 784 2eaj.exe 784 2eaj.exe 2768 keaiti.exe 1984 4eaj.exe 1984 4eaj.exe 1984 4eaj.exe 1984 4eaj.exe 2220 X 2768 keaiti.exe 2768 keaiti.exe 784 2eaj.exe 2768 keaiti.exe 784 2eaj.exe 2768 keaiti.exe 784 2eaj.exe 2768 keaiti.exe 2768 keaiti.exe 784 2eaj.exe 2768 keaiti.exe 784 2eaj.exe 784 2eaj.exe 2768 keaiti.exe 784 2eaj.exe 784 2eaj.exe 2768 keaiti.exe 2768 keaiti.exe 784 2eaj.exe 784 2eaj.exe 2768 keaiti.exe 784 2eaj.exe 2768 keaiti.exe 2768 keaiti.exe 784 2eaj.exe 784 2eaj.exe 784 2eaj.exe 2768 keaiti.exe 784 2eaj.exe 2768 keaiti.exe 784 2eaj.exe 2768 keaiti.exe 2768 keaiti.exe 784 2eaj.exe 784 2eaj.exe 784 2eaj.exe 2768 keaiti.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2624 explorer.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 2772 tasklist.exe Token: SeRestorePrivilege 1484 msiexec.exe Token: SeTakeOwnershipPrivilege 1484 msiexec.exe Token: SeSecurityPrivilege 1484 msiexec.exe Token: SeDebugPrivilege 1984 4eaj.exe Token: SeDebugPrivilege 1984 4eaj.exe Token: SeShutdownPrivilege 2624 explorer.exe Token: SeShutdownPrivilege 2624 explorer.exe Token: SeShutdownPrivilege 2624 explorer.exe Token: SeShutdownPrivilege 2624 explorer.exe Token: SeShutdownPrivilege 2624 explorer.exe Token: SeShutdownPrivilege 2624 explorer.exe Token: SeShutdownPrivilege 2624 explorer.exe Token: SeShutdownPrivilege 2624 explorer.exe Token: SeShutdownPrivilege 2624 explorer.exe Token: SeShutdownPrivilege 2624 explorer.exe Token: 33 376 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 376 AUDIODG.EXE Token: 33 376 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 376 AUDIODG.EXE Token: SeShutdownPrivilege 2624 explorer.exe Token: SeShutdownPrivilege 2624 explorer.exe Token: SeDebugPrivilege 1176 tasklist.exe -
Suspicious use of FindShellTrayWindow 24 IoCs
pid Process 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe -
Suspicious use of SendNotifyMessage 15 IoCs
pid Process 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe 2624 explorer.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 1100 MDdyAsuPL1.exe 2768 keaiti.exe 2668 2eaj.exe 2412 2eaj.exe 2492 2eaj.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 332 csrss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1688 wrote to memory of 1100 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 29 PID 1688 wrote to memory of 1100 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 29 PID 1688 wrote to memory of 1100 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 29 PID 1688 wrote to memory of 1100 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 29 PID 1100 wrote to memory of 2768 1100 MDdyAsuPL1.exe 30 PID 1100 wrote to memory of 2768 1100 MDdyAsuPL1.exe 30 PID 1100 wrote to memory of 2768 1100 MDdyAsuPL1.exe 30 PID 1100 wrote to memory of 2768 1100 MDdyAsuPL1.exe 30 PID 1100 wrote to memory of 3036 1100 MDdyAsuPL1.exe 31 PID 1100 wrote to memory of 3036 1100 MDdyAsuPL1.exe 31 PID 1100 wrote to memory of 3036 1100 MDdyAsuPL1.exe 31 PID 1100 wrote to memory of 3036 1100 MDdyAsuPL1.exe 31 PID 3036 wrote to memory of 2772 3036 cmd.exe 33 PID 3036 wrote to memory of 2772 3036 cmd.exe 33 PID 3036 wrote to memory of 2772 3036 cmd.exe 33 PID 3036 wrote to memory of 2772 3036 cmd.exe 33 PID 1688 wrote to memory of 2668 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 35 PID 1688 wrote to memory of 2668 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 35 PID 1688 wrote to memory of 2668 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 35 PID 1688 wrote to memory of 2668 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 35 PID 2668 wrote to memory of 2412 2668 2eaj.exe 36 PID 2668 wrote to memory of 2412 2668 2eaj.exe 36 PID 2668 wrote to memory of 2412 2668 2eaj.exe 36 PID 2668 wrote to memory of 2412 2668 2eaj.exe 36 PID 2668 wrote to memory of 2412 2668 2eaj.exe 36 PID 2668 wrote to memory of 2412 2668 2eaj.exe 36 PID 2668 wrote to memory of 2412 2668 2eaj.exe 36 PID 2668 wrote to memory of 2412 2668 2eaj.exe 36 PID 2668 wrote to memory of 784 2668 2eaj.exe 37 PID 2668 wrote to memory of 784 2668 2eaj.exe 37 PID 2668 wrote to memory of 784 2668 2eaj.exe 37 PID 2668 wrote to memory of 784 2668 2eaj.exe 37 PID 2668 wrote to memory of 784 2668 2eaj.exe 37 PID 2668 wrote to memory of 784 2668 2eaj.exe 37 PID 2668 wrote to memory of 784 2668 2eaj.exe 37 PID 2668 wrote to memory of 784 2668 2eaj.exe 37 PID 2668 wrote to memory of 1044 2668 2eaj.exe 38 PID 2668 wrote to memory of 1044 2668 2eaj.exe 38 PID 2668 wrote to memory of 1044 2668 2eaj.exe 38 PID 2668 wrote to memory of 1044 2668 2eaj.exe 38 PID 2668 wrote to memory of 1044 2668 2eaj.exe 38 PID 2668 wrote to memory of 1044 2668 2eaj.exe 38 PID 2668 wrote to memory of 1044 2668 2eaj.exe 38 PID 2668 wrote to memory of 1044 2668 2eaj.exe 38 PID 2668 wrote to memory of 2492 2668 2eaj.exe 39 PID 2668 wrote to memory of 2492 2668 2eaj.exe 39 PID 2668 wrote to memory of 2492 2668 2eaj.exe 39 PID 2668 wrote to memory of 2492 2668 2eaj.exe 39 PID 2668 wrote to memory of 2492 2668 2eaj.exe 39 PID 2668 wrote to memory of 2492 2668 2eaj.exe 39 PID 2668 wrote to memory of 2492 2668 2eaj.exe 39 PID 2668 wrote to memory of 2492 2668 2eaj.exe 39 PID 2668 wrote to memory of 2084 2668 2eaj.exe 40 PID 2668 wrote to memory of 2084 2668 2eaj.exe 40 PID 2668 wrote to memory of 2084 2668 2eaj.exe 40 PID 2668 wrote to memory of 2084 2668 2eaj.exe 40 PID 2668 wrote to memory of 2084 2668 2eaj.exe 40 PID 1688 wrote to memory of 1328 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 41 PID 1688 wrote to memory of 1328 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 41 PID 1688 wrote to memory of 1328 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 41 PID 1688 wrote to memory of 1328 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 41 PID 1688 wrote to memory of 1984 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 44 PID 1688 wrote to memory of 1984 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 44 PID 1688 wrote to memory of 1984 1688 JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe 44 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 3eaj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" 3eaj.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:332
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies WinLogon for persistence
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\MDdyAsuPL1.exeC:\Users\Admin\MDdyAsuPL1.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\keaiti.exe"C:\Users\Admin\keaiti.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2768
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del MDdyAsuPL1.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
-
-
-
C:\Users\Admin\2eaj.exeC:\Users\Admin\2eaj.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\2eaj.exe"C:\Users\Admin\2eaj.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2412
-
-
C:\Users\Admin\2eaj.exe"C:\Users\Admin\2eaj.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:784
-
-
C:\Users\Admin\2eaj.exe"C:\Users\Admin\2eaj.exe"4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1044
-
-
C:\Users\Admin\2eaj.exe"C:\Users\Admin\2eaj.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2492
-
-
C:\Users\Admin\2eaj.exe"C:\Users\Admin\2eaj.exe"4⤵
- Executes dropped EXE
PID:2084
-
-
-
C:\Users\Admin\3eaj.exeC:\Users\Admin\3eaj.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:1328 -
C:\Users\Admin\3eaj.exeC:\Users\Admin\3eaj.exe startC:\Users\Admin\AppData\Roaming\FABD3\75A85.exe%C:\Users\Admin\AppData\Roaming\FABD34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1620
-
-
C:\Users\Admin\3eaj.exeC:\Users\Admin\3eaj.exe startC:\Program Files (x86)\D3D99\lvvm.exe%C:\Program Files (x86)\D3D994⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1544
-
-
C:\Program Files (x86)\LP\85FF\844D.tmp"C:\Program Files (x86)\LP\85FF\844D.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1348
-
-
-
C:\Users\Admin\4eaj.exeC:\Users\Admin\4eaj.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1984 -
C:\Users\Admin\AppData\Local\56106ee3\X*0*bc*ee646990*31.193.3.240:534⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2220
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2660
-
-
-
C:\Users\Admin\5eaj.exeC:\Users\Admin\5eaj.exe3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
PID:2500
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_07a127794c04818ec9231c0623bfb7e7.exe3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:888 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1176
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1484
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:2360
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2624
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:2596
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4881⤵
- Suspicious use of AdjustPrivilegeToken
PID:376
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
5Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
121KB
MD56735cacc68031001bcf6459daa770b42
SHA178fc873eee60454534d7f39279d53d9bd9780c77
SHA256b1a7250c0fc8caa1a26ca2ebf18507ba4dcc564149ccfa81ed07e4fe2fbed026
SHA512ef092414d0b7f51ec8ec697148dba5656ba13987f2b7f746bda77267320dbbfdc0504e51699becbe30162ee0dd102cea80ab689f74221a2c6a50e1912ab82f08
-
Filesize
600B
MD53a7332622584157642f8fc87ed2cf90f
SHA1d2d818a540d6d20461a9b2b780852709ababa95b
SHA2562f4530f6757c0a3b802ffeef8d476eb40fdde97d5c53fd56a60e1b97723e76d8
SHA512d4db4452115facac5e2ee6dac33854d34f94eb89095ebc84c608f36b63466db66825f88d807f4f280eeedba9e5602b33364c615f79fd94da15c5fa2e51a90d83
-
Filesize
996B
MD5673ecf104e79bf8476baed3b31f2b587
SHA1a70f50ab8c2e2fdfbf5cd7b8feaa1c5390c63f4b
SHA2560c6a59ea6d65716e08badb5e8125907cfe07fac26360a891090aa0a8372f26c7
SHA51281a2b9aedc58a68b815a72ed4be59e743ca7ea3f6714a79a3464495c63bc2782820c55b922ded874b2004b046c215a6ee4a33deb1dab68df9b35111931eb31a8
-
Filesize
1KB
MD5c661c0666a822c23adb2a878e2a2d35a
SHA1922ec3d6d1ac0ea47539f5a84652318d4e459b07
SHA2565275188b2aa3c301b8e05ed2b806299fb3bcc45dadd3c7847a9550fd6def2198
SHA51292f2a2215582a55bdff24dbbddd54676a6507907b15fe38f414a1ed06b452f131fae996b0faa07abf9d1d26fa3509f32d7efe654962eb2910f75c024d1c17a09
-
Filesize
29KB
MD51149c1bd71248a9d170e4568fb08df30
SHA16f77f183d65709901f476c5d6eebaed060a495f9
SHA256c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1
SHA5129e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459
-
Filesize
100KB
MD58659e2fdb286421874e997e5b1d56ae4
SHA1e3b46183011a317dd80baf92ff9ef1b2da53cc05
SHA25680ceedded02c13a9c4ade2d2242b2bb295bc122b5c7c0f6b3332b0f4fceae2b8
SHA512ae12fd737c0a6f765ebe7a6e312230220e5fb79d42c1478a6f00edf5e67b6dec201aee90d3082b7817726c6501c7c94ce4a8eab72b2a00547bfdc382bbf2a8dc
-
Filesize
132KB
MD5afaca64214594290a9e01c2ab012f00c
SHA1eb1183a49d6da506072d34673f60a623687d2f82
SHA256ca9e0ce2d0cf500ddbad4e9ad42e6e4136e3fa351839ccc654f393e624528f7a
SHA5129f91e78c3a1de2e877e16b3cc862bc512051ccd011868c333dc66487bf1979c5f52406fa3498996e397705050b9c41a65a318d1f72e1e611dd9e2674a794a8b7
-
Filesize
283KB
MD5ab0bbc81ff15b6d295989e4076711c04
SHA199372e440fceb26128534ae44ba6649f4d6f5354
SHA256b936e7056270188775662177402c86da4028950320a772f3d56763e2f935b4e5
SHA512f1fa46e0fc9480766b68f7b3aba23bf41bb66e22d529d1006f5dbbfe467ec0bf490b50067184b38fa76639a76c15e88ca654544ea045bcbfce8c12d3d8347077
-
Filesize
273KB
MD590cfd3294a276c3bc20a9fddf574a8d1
SHA1fc294843a290d0bc223e67f3370009e0bd63e3b8
SHA2565b076d47b571824cd668c26e7fc0a53b54a58547b7cb6a70eccdf44b4ccbda14
SHA512a1ffc3e46490c74e7cd45b919b4668e0f38cbf28b3c3b81a25c68233cd68b72a5d9444306b9e8ef03fa1739d441c7f6504a36aabc2c53a7025b3c6260adc1aeb
-
Filesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
Filesize
256KB
MD5601683a024c1e27dd62d33de59536641
SHA14584d66af41c4f77a6e1b7df3dcd3e78217ad270
SHA25611ba7731f1b9b48116167234553254116e86f06091b0bbd7eaf0cbea4c2df049
SHA512b6ee2b371198d5a70124444596fb28831ec6b2f06910e0f772852f7d80ad2974373aead6f9597c61a89bd99496ca33a838030e458265f6ddea4920ffb0472008
-
Filesize
256KB
MD50c34a3deca77373177d2c2b19003e992
SHA11722cee91d3d88aa6623da16cb96ee533c3dfe40
SHA25619e451ce4cc4a6ce0f9eba8817552d011fe3b6d0d3081941b805ff6dca385d9f
SHA5127755f8ebb4810eccc6389defa1c391b86f2405858408280140061b9d507ba5e4276fd43f482049e2f8ce429d83054d69f63e93753c8b7248213044a5d07c301e
-
Filesize
2KB
MD5a5d7eac6c01a44b6a6256612f4b57ca3
SHA134197d3d33960563f01cd4fbc860af205e891de4
SHA256b205656391dba5728e73ba32074253a1da407794ebd3c192aacf22d73764e637
SHA512bd31f51eb92f9a08e0e5b96f2a28979115630a2776040f22c9cf46c1477bc92845a236b1e8a244a959c03a8f092da9be451f697ad892c8bf48a73a87410da582