Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-12-2024 19:34
Behavioral task
behavioral1
Sample
JaffaCakes118_c19238382edbc6b885d3105f7134140d5bb1532c607868bdeb844ebe3c156e96.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_c19238382edbc6b885d3105f7134140d5bb1532c607868bdeb844ebe3c156e96.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_c19238382edbc6b885d3105f7134140d5bb1532c607868bdeb844ebe3c156e96.exe
-
Size
1.3MB
-
MD5
fcf3b7201f583150d14839331b58b665
-
SHA1
71b2596496c2aee893cc738fbfa0fe6cfb438c47
-
SHA256
c19238382edbc6b885d3105f7134140d5bb1532c607868bdeb844ebe3c156e96
-
SHA512
8288669988c9c7151ba9c6a9d999d3731d94dd3f0e0972d92366f16e695b26c94a2acad1669fed882f5fd1e2a5af6157b502a15006d57779077dbb83c7fc76a1
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 24 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 508 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4636 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4588 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1504 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2912 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1472 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3760 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1788 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3320 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1124 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1588 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1432 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5048 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2412 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3100 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4304 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2284 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 800 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4704 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4468 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4968 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4556 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2548 4116 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1908 4116 schtasks.exe 87 -
resource yara_rule behavioral2/files/0x000a000000023b7b-10.dat dcrat behavioral2/memory/4388-13-0x0000000000CD0000-0x0000000000DE0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3588 powershell.exe 4916 powershell.exe 4676 powershell.exe 4868 powershell.exe 3384 powershell.exe 4952 powershell.exe 4004 powershell.exe 948 powershell.exe 1600 powershell.exe -
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation JaffaCakes118_c19238382edbc6b885d3105f7134140d5bb1532c607868bdeb844ebe3c156e96.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation unsecapp.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation unsecapp.exe -
Executes dropped EXE 15 IoCs
pid Process 4388 DllCommonsvc.exe 1620 unsecapp.exe 2236 unsecapp.exe 4664 unsecapp.exe 1012 unsecapp.exe 4764 unsecapp.exe 2080 unsecapp.exe 2464 unsecapp.exe 4308 unsecapp.exe 1068 unsecapp.exe 2768 unsecapp.exe 4272 unsecapp.exe 4344 unsecapp.exe 2128 unsecapp.exe 5076 unsecapp.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
flow ioc 43 raw.githubusercontent.com 53 raw.githubusercontent.com 13 raw.githubusercontent.com 37 raw.githubusercontent.com 18 raw.githubusercontent.com 38 raw.githubusercontent.com 49 raw.githubusercontent.com 42 raw.githubusercontent.com 44 raw.githubusercontent.com 50 raw.githubusercontent.com 51 raw.githubusercontent.com 52 raw.githubusercontent.com 14 raw.githubusercontent.com 23 raw.githubusercontent.com -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files\Windows NT\Accessories\uk-UA\SppExtComObj.exe DllCommonsvc.exe File created C:\Program Files\Windows NT\Accessories\uk-UA\e1ef82546f0b02 DllCommonsvc.exe File created C:\Program Files\Windows Mail\csrss.exe DllCommonsvc.exe File created C:\Program Files\Windows Mail\886983d96e3d3e DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\winlogon.exe DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\cc11b995f2a76d DllCommonsvc.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\diagnostics\sppsvc.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_c19238382edbc6b885d3105f7134140d5bb1532c607868bdeb844ebe3c156e96.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings JaffaCakes118_c19238382edbc6b885d3105f7134140d5bb1532c607868bdeb844ebe3c156e96.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings unsecapp.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings unsecapp.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1472 schtasks.exe 3320 schtasks.exe 1432 schtasks.exe 4304 schtasks.exe 2284 schtasks.exe 800 schtasks.exe 1504 schtasks.exe 2912 schtasks.exe 4704 schtasks.exe 4468 schtasks.exe 5048 schtasks.exe 2412 schtasks.exe 3100 schtasks.exe 4556 schtasks.exe 2548 schtasks.exe 4636 schtasks.exe 1788 schtasks.exe 1588 schtasks.exe 3760 schtasks.exe 1124 schtasks.exe 4968 schtasks.exe 1908 schtasks.exe 508 schtasks.exe 4588 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 4388 DllCommonsvc.exe 4388 DllCommonsvc.exe 4388 DllCommonsvc.exe 4388 DllCommonsvc.exe 4388 DllCommonsvc.exe 4388 DllCommonsvc.exe 4388 DllCommonsvc.exe 4388 DllCommonsvc.exe 4388 DllCommonsvc.exe 4388 DllCommonsvc.exe 3384 powershell.exe 4676 powershell.exe 4676 powershell.exe 1600 powershell.exe 1600 powershell.exe 948 powershell.exe 948 powershell.exe 4004 powershell.exe 4004 powershell.exe 4916 powershell.exe 4916 powershell.exe 4952 powershell.exe 4952 powershell.exe 4868 powershell.exe 4868 powershell.exe 3384 powershell.exe 3384 powershell.exe 4676 powershell.exe 1620 unsecapp.exe 1620 unsecapp.exe 3588 powershell.exe 3588 powershell.exe 1600 powershell.exe 4916 powershell.exe 4004 powershell.exe 948 powershell.exe 4868 powershell.exe 4952 powershell.exe 3588 powershell.exe 2236 unsecapp.exe 4664 unsecapp.exe 1012 unsecapp.exe 4764 unsecapp.exe 2080 unsecapp.exe 2464 unsecapp.exe 4308 unsecapp.exe 1068 unsecapp.exe 2768 unsecapp.exe 4272 unsecapp.exe 4344 unsecapp.exe 2128 unsecapp.exe 5076 unsecapp.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 4388 DllCommonsvc.exe Token: SeDebugPrivilege 3384 powershell.exe Token: SeDebugPrivilege 4676 powershell.exe Token: SeDebugPrivilege 1600 powershell.exe Token: SeDebugPrivilege 4916 powershell.exe Token: SeDebugPrivilege 948 powershell.exe Token: SeDebugPrivilege 4004 powershell.exe Token: SeDebugPrivilege 4952 powershell.exe Token: SeDebugPrivilege 1620 unsecapp.exe Token: SeDebugPrivilege 4868 powershell.exe Token: SeDebugPrivilege 3588 powershell.exe Token: SeDebugPrivilege 2236 unsecapp.exe Token: SeDebugPrivilege 4664 unsecapp.exe Token: SeDebugPrivilege 1012 unsecapp.exe Token: SeDebugPrivilege 4764 unsecapp.exe Token: SeDebugPrivilege 2080 unsecapp.exe Token: SeDebugPrivilege 2464 unsecapp.exe Token: SeDebugPrivilege 4308 unsecapp.exe Token: SeDebugPrivilege 1068 unsecapp.exe Token: SeDebugPrivilege 2768 unsecapp.exe Token: SeDebugPrivilege 4272 unsecapp.exe Token: SeDebugPrivilege 4344 unsecapp.exe Token: SeDebugPrivilege 2128 unsecapp.exe Token: SeDebugPrivilege 5076 unsecapp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3736 wrote to memory of 3020 3736 JaffaCakes118_c19238382edbc6b885d3105f7134140d5bb1532c607868bdeb844ebe3c156e96.exe 83 PID 3736 wrote to memory of 3020 3736 JaffaCakes118_c19238382edbc6b885d3105f7134140d5bb1532c607868bdeb844ebe3c156e96.exe 83 PID 3736 wrote to memory of 3020 3736 JaffaCakes118_c19238382edbc6b885d3105f7134140d5bb1532c607868bdeb844ebe3c156e96.exe 83 PID 3020 wrote to memory of 944 3020 WScript.exe 84 PID 3020 wrote to memory of 944 3020 WScript.exe 84 PID 3020 wrote to memory of 944 3020 WScript.exe 84 PID 944 wrote to memory of 4388 944 cmd.exe 86 PID 944 wrote to memory of 4388 944 cmd.exe 86 PID 4388 wrote to memory of 3588 4388 DllCommonsvc.exe 113 PID 4388 wrote to memory of 3588 4388 DllCommonsvc.exe 113 PID 4388 wrote to memory of 4916 4388 DllCommonsvc.exe 114 PID 4388 wrote to memory of 4916 4388 DllCommonsvc.exe 114 PID 4388 wrote to memory of 1600 4388 DllCommonsvc.exe 115 PID 4388 wrote to memory of 1600 4388 DllCommonsvc.exe 115 PID 4388 wrote to memory of 948 4388 DllCommonsvc.exe 116 PID 4388 wrote to memory of 948 4388 DllCommonsvc.exe 116 PID 4388 wrote to memory of 4004 4388 DllCommonsvc.exe 117 PID 4388 wrote to memory of 4004 4388 DllCommonsvc.exe 117 PID 4388 wrote to memory of 4676 4388 DllCommonsvc.exe 119 PID 4388 wrote to memory of 4676 4388 DllCommonsvc.exe 119 PID 4388 wrote to memory of 4952 4388 DllCommonsvc.exe 120 PID 4388 wrote to memory of 4952 4388 DllCommonsvc.exe 120 PID 4388 wrote to memory of 3384 4388 DllCommonsvc.exe 122 PID 4388 wrote to memory of 3384 4388 DllCommonsvc.exe 122 PID 4388 wrote to memory of 4868 4388 DllCommonsvc.exe 123 PID 4388 wrote to memory of 4868 4388 DllCommonsvc.exe 123 PID 4388 wrote to memory of 1620 4388 DllCommonsvc.exe 130 PID 4388 wrote to memory of 1620 4388 DllCommonsvc.exe 130 PID 1620 wrote to memory of 2512 1620 unsecapp.exe 133 PID 1620 wrote to memory of 2512 1620 unsecapp.exe 133 PID 2512 wrote to memory of 4812 2512 cmd.exe 135 PID 2512 wrote to memory of 4812 2512 cmd.exe 135 PID 2512 wrote to memory of 2236 2512 cmd.exe 137 PID 2512 wrote to memory of 2236 2512 cmd.exe 137 PID 2236 wrote to memory of 1168 2236 unsecapp.exe 146 PID 2236 wrote to memory of 1168 2236 unsecapp.exe 146 PID 1168 wrote to memory of 3180 1168 cmd.exe 148 PID 1168 wrote to memory of 3180 1168 cmd.exe 148 PID 1168 wrote to memory of 4664 1168 cmd.exe 154 PID 1168 wrote to memory of 4664 1168 cmd.exe 154 PID 4664 wrote to memory of 3664 4664 unsecapp.exe 157 PID 4664 wrote to memory of 3664 4664 unsecapp.exe 157 PID 3664 wrote to memory of 1668 3664 cmd.exe 159 PID 3664 wrote to memory of 1668 3664 cmd.exe 159 PID 3664 wrote to memory of 1012 3664 cmd.exe 162 PID 3664 wrote to memory of 1012 3664 cmd.exe 162 PID 1012 wrote to memory of 3256 1012 unsecapp.exe 164 PID 1012 wrote to memory of 3256 1012 unsecapp.exe 164 PID 3256 wrote to memory of 4704 3256 cmd.exe 166 PID 3256 wrote to memory of 4704 3256 cmd.exe 166 PID 3256 wrote to memory of 4764 3256 cmd.exe 168 PID 3256 wrote to memory of 4764 3256 cmd.exe 168 PID 4764 wrote to memory of 1616 4764 unsecapp.exe 170 PID 4764 wrote to memory of 1616 4764 unsecapp.exe 170 PID 1616 wrote to memory of 464 1616 cmd.exe 172 PID 1616 wrote to memory of 464 1616 cmd.exe 172 PID 1616 wrote to memory of 2080 1616 cmd.exe 174 PID 1616 wrote to memory of 2080 1616 cmd.exe 174 PID 2080 wrote to memory of 4388 2080 unsecapp.exe 176 PID 2080 wrote to memory of 4388 2080 unsecapp.exe 176 PID 4388 wrote to memory of 4232 4388 cmd.exe 178 PID 4388 wrote to memory of 4232 4388 cmd.exe 178 PID 4388 wrote to memory of 2464 4388 cmd.exe 180 PID 4388 wrote to memory of 2464 4388 cmd.exe 180 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c19238382edbc6b885d3105f7134140d5bb1532c607868bdeb844ebe3c156e96.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c19238382edbc6b885d3105f7134140d5bb1532c607868bdeb844ebe3c156e96.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:944 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3588
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\unsecapp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4916
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:948
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\Accessories\uk-UA\SppExtComObj.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4004
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4676
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\unsecapp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4952
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3384
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868
-
-
C:\providercommon\unsecapp.exe"C:\providercommon\unsecapp.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NjKeWzk8OD.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:4812
-
-
C:\providercommon\unsecapp.exe"C:\providercommon\unsecapp.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Gy1gqmGK9f.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:3180
-
-
C:\providercommon\unsecapp.exe"C:\providercommon\unsecapp.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oLfAgN0jmw.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:1668
-
-
C:\providercommon\unsecapp.exe"C:\providercommon\unsecapp.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WSSqGJyhfL.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:4704
-
-
C:\providercommon\unsecapp.exe"C:\providercommon\unsecapp.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\be8zRZs4e0.bat"14⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:464
-
-
C:\providercommon\unsecapp.exe"C:\providercommon\unsecapp.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\A1nTHBcTHH.bat"16⤵
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:4232
-
-
C:\providercommon\unsecapp.exe"C:\providercommon\unsecapp.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2464 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nGW3UwTeX7.bat"18⤵PID:1168
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:3696
-
-
C:\providercommon\unsecapp.exe"C:\providercommon\unsecapp.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4308 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\A1nTHBcTHH.bat"20⤵PID:1936
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:948
-
-
C:\providercommon\unsecapp.exe"C:\providercommon\unsecapp.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1068 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wKGJ2NUoAL.bat"22⤵PID:1012
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:1644
-
-
C:\providercommon\unsecapp.exe"C:\providercommon\unsecapp.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2768 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tDjG3X7WPV.bat"24⤵PID:1152
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:2220
-
-
C:\providercommon\unsecapp.exe"C:\providercommon\unsecapp.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4272 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BmKXfVMxAz.bat"26⤵PID:1216
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:4956
-
-
C:\providercommon\unsecapp.exe"C:\providercommon\unsecapp.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4344 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D2zd9hDRps.bat"28⤵PID:3180
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:1244
-
-
C:\providercommon\unsecapp.exe"C:\providercommon\unsecapp.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2128 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\38MS6cfT7h.bat"30⤵PID:772
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵PID:2320
-
-
C:\providercommon\unsecapp.exe"C:\providercommon\unsecapp.exe"31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\providercommon\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:508
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\providercommon\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\providercommon\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4588
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\providercommon\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\providercommon\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1788
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3320
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\Accessories\uk-UA\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\uk-UA\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1124
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\Accessories\uk-UA\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3100
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\providercommon\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4304
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\providercommon\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\providercommon\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:800
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\providercommon\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4704
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
195B
MD5ae27b5060815e426ee9987ba002c0160
SHA16714baa34215a72332fc7f20a9560170635fce6d
SHA2569af2d8b202b259d29f1e948b6683aa9cd6a20e4f333d2c856608ca7fe417998b
SHA5129b95e3e77c8e595e7bb7a0e11f467923ca29ae951423bdf61ef87f664e49b54f266b8b51c94142b904c50dacc4c71879ca6d2cbf6ef5a82636bc12af36f16b0d
-
Filesize
195B
MD50f84e6d6e3c3225a4d5d13d12ab2ea74
SHA126b98674f78237bf64a925a5c72dad08cd927eeb
SHA2565940b6ac65125b28e10a4366a0a388a0221b18cffced065be7c88ddc64f5979d
SHA5121e89fdc976a6e84791cadb971a5e652191d4d64674d483b63606823c71a235232b30ab3732538db24f5e6d4614d74ce606923ce7ebac37efe2a31fff7d362821
-
Filesize
195B
MD5542580e06123568a16d418c896d46619
SHA1f6ed57b44cd3c65d2914c61d3df231138ae4a0f0
SHA256575a16b228e199ceafe28ec8b67c57df5b5e1a7bb1fd3f124b03bc7faac15bda
SHA51245d79e3ebf80c81f97486b539e426f9defb8a89a8d172b25c903cc3ec56c0793fa65aa6e1258ab0b7819b37913ed0663ac37b70189d3fbe69ea0bbaf8dd63e20
-
Filesize
195B
MD5383f1c29af97200ba255b03b8081983d
SHA12a089bc23b3e37a72f5b46c2b99f2d67ae29e754
SHA256b69891beaf38dc5354eb764cdf5963d3ddcd6e2f9eb3e0b9af718a5e764f2a30
SHA51224d037e4d073d41d21cb866fd4ebbaedbbfa8aeb34b340c3b849d0f1f66b45b2885e14b6037625d98eb806476675cb476600bef812c2a0bee2f5b8ab5f3006b1
-
Filesize
195B
MD5f5234706a5810e661a86de78b2cbeeff
SHA19744b6bb1d498ad16fd626795306736075533e28
SHA2567466daeb04ea741e0adf3e6a3290adedf53df6bfe46e13b739747b06f62db097
SHA512f1d234d5a18e320b8681a678c848d6451accf820ae1b75318a2b0fffa77de6a56b119e5c45ae63d439467b782446c373dc9992e7795ed29408aa2b9359b5b49a
-
Filesize
195B
MD518fe0ee0a355b00ca2613da52681378d
SHA16514cd6f6cd5a988fa591c2119503c3166904191
SHA256758b180dacf363b1791f3312087c0c1d92512e561545bd58633f650faeca7ea8
SHA512091caefc5818e40bd4411404eaf4fb57304aafbc9679ae6ba8c3a3c1b96381526db728c56431bbc69ba9ee2cc06f38f1683985ac05950c9195397206016e61e8
-
Filesize
195B
MD52e31f7eefd74a67618c56a6214856114
SHA189041509c900576b3f8e9c0224b7f1a211df8b26
SHA25661f1e2e6e8ed40fcc1c57f9ecb843512736f8030e15216550414f7061aa6d988
SHA51281bc4b2ead8ab3b2b0bb6a3d070748c0c20784148e85ff4f3a3fcb96e3b98d0d290afe60f0726c77d579a77a97b9e261dc7645453a452889547ea585e451c9e8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
195B
MD5babe848eb5d17de5845abdbbf246622e
SHA132c1a04241eff6c3e8d81a5ac3cb584222d58c77
SHA256bc2ea13c2f70c582216e908068241a85bc02eddf3c688375b6da9ef7314bd1a7
SHA5125bd484d333cdc21e62c5f5c307c45c331cea6427eee87aebfb89a8eb69276285f0cb18da84fbd67bfed7148409bfd21e53ac48b9555df61da775b5fbdfa313f1
-
Filesize
195B
MD5df748328bd61bfcdd54e984d4719e61b
SHA17f37b87a97a11d4107d86fdfe7fc137b78772e62
SHA2568efa83d08a81db88daa657d721e6f56765677cad9096791af00dd176ad6d7bea
SHA51261f429af2a5635585d31a696e9807559b279af5abc8c31b8d04bffab9edbc19932e4a7f1711a8ae837dd9d1c3adfa8d6b941e4fafbb3c08bb4f9c0e8bdda3080
-
Filesize
195B
MD5296de3421705429bacd46dd6905ba184
SHA12b8fd5904619cbda3140c5c1c200d89a7d67b086
SHA25676c8d3d8c0262df9c91e297cff72410ce49c740b563b5a3ceddad52fc9d2b6af
SHA51219ce1940f0c70d5d79764a0dcb8f8c0dd20b25c5d460276f0b6e1a6bf69c1f31bd02eb3b807b10369c59d0ccccb8b75041e93db3a3ee2ded42d0e77b3ee93bd7
-
Filesize
195B
MD5316765ed28cfe8d950b48c050b93660e
SHA1402ee2380a2b5b14937969f06447274ba3ca9e85
SHA2564bd97a23ae2461c6c4f6c54772d240bddfeda75dffdf9db5112ee75fbb49cd29
SHA5120fbf706e64cc16b86a9c23268ebfe02810b5eb8124de41421250e1954afdb688e9119c0f7324593d30679dffc0403c2d2328331a22ca6b9a980d4a48609b7141
-
Filesize
195B
MD552603b0df17b175461ead42f218ea92e
SHA1496754c90bdf9fa54f7bd3ab7ad795bc9434094d
SHA256160dd1ce010b5120caa09a9efeeeb6ccbada480b2526f6451c5be22e0d5100a7
SHA51297b52df1045458a9e48d52155dfe3623e110793474dc3375d39d6fb7f0f57c5cb70c74b3448357ce7cd7db7bb0b77941b7020b22f852c4439804f0244ea14a58
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478