Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 01:15
Behavioral task
behavioral1
Sample
JaffaCakes118_6da6f32ddec4d88499b2f22ef1db04349863d39f49efe903db3fa6d1759d142b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6da6f32ddec4d88499b2f22ef1db04349863d39f49efe903db3fa6d1759d142b.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_6da6f32ddec4d88499b2f22ef1db04349863d39f49efe903db3fa6d1759d142b.exe
-
Size
1.3MB
-
MD5
cf6af80ab793c0b281f4359e4372fc32
-
SHA1
03db3a6ff5867f800ae63f927cf5c07ec98cec0d
-
SHA256
6da6f32ddec4d88499b2f22ef1db04349863d39f49efe903db3fa6d1759d142b
-
SHA512
fbe28145ee7668be15c7a52ea022b6b54a497d9590e1dbe566b3f99be26afc450d44fc0f2a0a56476b8216ff3228460440acdd675b85fe8a7710bcee6462ab3b
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 27 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1448 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2828 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2396 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2756 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4000 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5008 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 780 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 220 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1556 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1612 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3016 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4620 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2220 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4212 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2732 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3356 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1140 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4864 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1796 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3920 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1936 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3020 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4632 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1476 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3416 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3692 1212 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 992 1212 schtasks.exe 86 -
resource yara_rule behavioral2/files/0x0007000000023c9e-9.dat dcrat behavioral2/memory/2380-13-0x00000000008B0000-0x00000000009C0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1728 powershell.exe 1636 powershell.exe 3868 powershell.exe 1748 powershell.exe 3492 powershell.exe 4928 powershell.exe 1440 powershell.exe 2392 powershell.exe 2480 powershell.exe 5052 powershell.exe -
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation JaffaCakes118_6da6f32ddec4d88499b2f22ef1db04349863d39f49efe903db3fa6d1759d142b.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Idle.exe -
Executes dropped EXE 14 IoCs
pid Process 2380 DllCommonsvc.exe 4616 Idle.exe 2504 Idle.exe 3632 Idle.exe 468 Idle.exe 4404 Idle.exe 2136 Idle.exe 4976 Idle.exe 2156 Idle.exe 640 Idle.exe 2432 Idle.exe 1308 Idle.exe 4476 Idle.exe 1536 Idle.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
flow ioc 14 raw.githubusercontent.com 44 raw.githubusercontent.com 40 raw.githubusercontent.com 52 raw.githubusercontent.com 15 raw.githubusercontent.com 21 raw.githubusercontent.com 32 raw.githubusercontent.com 49 raw.githubusercontent.com 51 raw.githubusercontent.com 53 raw.githubusercontent.com 54 raw.githubusercontent.com 55 raw.githubusercontent.com 39 raw.githubusercontent.com 43 raw.githubusercontent.com -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files\Windows Mail\DllCommonsvc.exe DllCommonsvc.exe File created C:\Program Files\Windows Mail\a76d7bf15d8370 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\es-ES\sihost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\es-ES\66fc9ff0ee96c2 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\Network Sharing\fontdrvhost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\Network Sharing\5b884080fd4f94 DllCommonsvc.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\Globalization\Sorting\0a1fd5f707cd16 DllCommonsvc.exe File created C:\Windows\it-IT\csrss.exe DllCommonsvc.exe File created C:\Windows\it-IT\886983d96e3d3e DllCommonsvc.exe File created C:\Windows\Globalization\Sorting\sppsvc.exe DllCommonsvc.exe File opened for modification C:\Windows\Globalization\Sorting\sppsvc.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6da6f32ddec4d88499b2f22ef1db04349863d39f49efe903db3fa6d1759d142b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings JaffaCakes118_6da6f32ddec4d88499b2f22ef1db04349863d39f49efe903db3fa6d1759d142b.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Idle.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4000 schtasks.exe 1612 schtasks.exe 4620 schtasks.exe 992 schtasks.exe 1448 schtasks.exe 220 schtasks.exe 1140 schtasks.exe 1796 schtasks.exe 2732 schtasks.exe 4632 schtasks.exe 3416 schtasks.exe 5008 schtasks.exe 1556 schtasks.exe 3016 schtasks.exe 2756 schtasks.exe 1476 schtasks.exe 2828 schtasks.exe 2396 schtasks.exe 2220 schtasks.exe 4212 schtasks.exe 4864 schtasks.exe 780 schtasks.exe 3020 schtasks.exe 3692 schtasks.exe 3356 schtasks.exe 3920 schtasks.exe 1936 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 53 IoCs
pid Process 2380 DllCommonsvc.exe 2380 DllCommonsvc.exe 2380 DllCommonsvc.exe 2380 DllCommonsvc.exe 2380 DllCommonsvc.exe 2380 DllCommonsvc.exe 2380 DllCommonsvc.exe 2380 DllCommonsvc.exe 2380 DllCommonsvc.exe 2392 powershell.exe 2392 powershell.exe 1440 powershell.exe 1440 powershell.exe 3492 powershell.exe 3492 powershell.exe 1748 powershell.exe 1748 powershell.exe 1636 powershell.exe 1636 powershell.exe 1728 powershell.exe 1728 powershell.exe 5052 powershell.exe 5052 powershell.exe 2480 powershell.exe 2480 powershell.exe 4928 powershell.exe 4928 powershell.exe 3868 powershell.exe 3868 powershell.exe 1748 powershell.exe 4616 Idle.exe 4616 Idle.exe 2392 powershell.exe 1636 powershell.exe 5052 powershell.exe 1440 powershell.exe 2480 powershell.exe 1728 powershell.exe 3492 powershell.exe 3868 powershell.exe 4928 powershell.exe 2504 Idle.exe 3632 Idle.exe 468 Idle.exe 4404 Idle.exe 2136 Idle.exe 4976 Idle.exe 2156 Idle.exe 640 Idle.exe 2432 Idle.exe 1308 Idle.exe 4476 Idle.exe 1536 Idle.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 2380 DllCommonsvc.exe Token: SeDebugPrivilege 2392 powershell.exe Token: SeDebugPrivilege 1440 powershell.exe Token: SeDebugPrivilege 3492 powershell.exe Token: SeDebugPrivilege 1748 powershell.exe Token: SeDebugPrivilege 1636 powershell.exe Token: SeDebugPrivilege 1728 powershell.exe Token: SeDebugPrivilege 5052 powershell.exe Token: SeDebugPrivilege 2480 powershell.exe Token: SeDebugPrivilege 4928 powershell.exe Token: SeDebugPrivilege 3868 powershell.exe Token: SeDebugPrivilege 4616 Idle.exe Token: SeDebugPrivilege 2504 Idle.exe Token: SeDebugPrivilege 3632 Idle.exe Token: SeDebugPrivilege 468 Idle.exe Token: SeDebugPrivilege 4404 Idle.exe Token: SeDebugPrivilege 2136 Idle.exe Token: SeDebugPrivilege 4976 Idle.exe Token: SeDebugPrivilege 2156 Idle.exe Token: SeDebugPrivilege 640 Idle.exe Token: SeDebugPrivilege 2432 Idle.exe Token: SeDebugPrivilege 1308 Idle.exe Token: SeDebugPrivilege 4476 Idle.exe Token: SeDebugPrivilege 1536 Idle.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3272 wrote to memory of 2548 3272 JaffaCakes118_6da6f32ddec4d88499b2f22ef1db04349863d39f49efe903db3fa6d1759d142b.exe 82 PID 3272 wrote to memory of 2548 3272 JaffaCakes118_6da6f32ddec4d88499b2f22ef1db04349863d39f49efe903db3fa6d1759d142b.exe 82 PID 3272 wrote to memory of 2548 3272 JaffaCakes118_6da6f32ddec4d88499b2f22ef1db04349863d39f49efe903db3fa6d1759d142b.exe 82 PID 2548 wrote to memory of 4416 2548 WScript.exe 83 PID 2548 wrote to memory of 4416 2548 WScript.exe 83 PID 2548 wrote to memory of 4416 2548 WScript.exe 83 PID 4416 wrote to memory of 2380 4416 cmd.exe 85 PID 4416 wrote to memory of 2380 4416 cmd.exe 85 PID 2380 wrote to memory of 4928 2380 DllCommonsvc.exe 114 PID 2380 wrote to memory of 4928 2380 DllCommonsvc.exe 114 PID 2380 wrote to memory of 1440 2380 DllCommonsvc.exe 115 PID 2380 wrote to memory of 1440 2380 DllCommonsvc.exe 115 PID 2380 wrote to memory of 1728 2380 DllCommonsvc.exe 116 PID 2380 wrote to memory of 1728 2380 DllCommonsvc.exe 116 PID 2380 wrote to memory of 1636 2380 DllCommonsvc.exe 117 PID 2380 wrote to memory of 1636 2380 DllCommonsvc.exe 117 PID 2380 wrote to memory of 2392 2380 DllCommonsvc.exe 118 PID 2380 wrote to memory of 2392 2380 DllCommonsvc.exe 118 PID 2380 wrote to memory of 2480 2380 DllCommonsvc.exe 119 PID 2380 wrote to memory of 2480 2380 DllCommonsvc.exe 119 PID 2380 wrote to memory of 3868 2380 DllCommonsvc.exe 120 PID 2380 wrote to memory of 3868 2380 DllCommonsvc.exe 120 PID 2380 wrote to memory of 5052 2380 DllCommonsvc.exe 121 PID 2380 wrote to memory of 5052 2380 DllCommonsvc.exe 121 PID 2380 wrote to memory of 1748 2380 DllCommonsvc.exe 122 PID 2380 wrote to memory of 1748 2380 DllCommonsvc.exe 122 PID 2380 wrote to memory of 3492 2380 DllCommonsvc.exe 123 PID 2380 wrote to memory of 3492 2380 DllCommonsvc.exe 123 PID 2380 wrote to memory of 4616 2380 DllCommonsvc.exe 134 PID 2380 wrote to memory of 4616 2380 DllCommonsvc.exe 134 PID 4616 wrote to memory of 1488 4616 Idle.exe 135 PID 4616 wrote to memory of 1488 4616 Idle.exe 135 PID 1488 wrote to memory of 1744 1488 cmd.exe 137 PID 1488 wrote to memory of 1744 1488 cmd.exe 137 PID 1488 wrote to memory of 2504 1488 cmd.exe 138 PID 1488 wrote to memory of 2504 1488 cmd.exe 138 PID 2504 wrote to memory of 4416 2504 Idle.exe 145 PID 2504 wrote to memory of 4416 2504 Idle.exe 145 PID 4416 wrote to memory of 1924 4416 cmd.exe 147 PID 4416 wrote to memory of 1924 4416 cmd.exe 147 PID 4416 wrote to memory of 3632 4416 cmd.exe 149 PID 4416 wrote to memory of 3632 4416 cmd.exe 149 PID 3632 wrote to memory of 384 3632 Idle.exe 150 PID 3632 wrote to memory of 384 3632 Idle.exe 150 PID 384 wrote to memory of 780 384 cmd.exe 152 PID 384 wrote to memory of 780 384 cmd.exe 152 PID 384 wrote to memory of 468 384 cmd.exe 154 PID 384 wrote to memory of 468 384 cmd.exe 154 PID 468 wrote to memory of 2124 468 Idle.exe 155 PID 468 wrote to memory of 2124 468 Idle.exe 155 PID 2124 wrote to memory of 2704 2124 cmd.exe 157 PID 2124 wrote to memory of 2704 2124 cmd.exe 157 PID 2124 wrote to memory of 4404 2124 cmd.exe 158 PID 2124 wrote to memory of 4404 2124 cmd.exe 158 PID 4404 wrote to memory of 2940 4404 Idle.exe 159 PID 4404 wrote to memory of 2940 4404 Idle.exe 159 PID 2940 wrote to memory of 2044 2940 cmd.exe 161 PID 2940 wrote to memory of 2044 2940 cmd.exe 161 PID 2940 wrote to memory of 2136 2940 cmd.exe 162 PID 2940 wrote to memory of 2136 2940 cmd.exe 162 PID 2136 wrote to memory of 4928 2136 Idle.exe 163 PID 2136 wrote to memory of 4928 2136 Idle.exe 163 PID 4928 wrote to memory of 652 4928 cmd.exe 165 PID 4928 wrote to memory of 652 4928 cmd.exe 165 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da6f32ddec4d88499b2f22ef1db04349863d39f49efe903db3fa6d1759d142b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da6f32ddec4d88499b2f22ef1db04349863d39f49efe903db3fa6d1759d142b.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4928
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Globalization\Sorting\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1440
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1728
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\OfficeClickToRun.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1636
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\es-ES\sihost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2392
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\it-IT\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\Network Sharing\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3868
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5052
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1748
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3492
-
-
C:\providercommon\Idle.exe"C:\providercommon\Idle.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OPOGTQits7.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:1744
-
-
C:\providercommon\Idle.exe"C:\providercommon\Idle.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L9j9zErPDE.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:1924
-
-
C:\providercommon\Idle.exe"C:\providercommon\Idle.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XErLL4imMU.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:780
-
-
C:\providercommon\Idle.exe"C:\providercommon\Idle.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0SbqORFfit.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:2704
-
-
C:\providercommon\Idle.exe"C:\providercommon\Idle.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LIqDUaLb8G.bat"14⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:2044
-
-
C:\providercommon\Idle.exe"C:\providercommon\Idle.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kwOVarqRTQ.bat"16⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:652
-
-
C:\providercommon\Idle.exe"C:\providercommon\Idle.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4976 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6VAw4LgrmW.bat"18⤵PID:1488
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:5116
-
-
C:\providercommon\Idle.exe"C:\providercommon\Idle.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2156 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5ldsg1wMto.bat"20⤵PID:3960
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:2576
-
-
C:\providercommon\Idle.exe"C:\providercommon\Idle.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:640 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ATZuYpZxcK.bat"22⤵PID:4220
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:4920
-
-
C:\providercommon\Idle.exe"C:\providercommon\Idle.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2432 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KOC6cu7vKW.bat"24⤵PID:2904
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:4024
-
-
C:\providercommon\Idle.exe"C:\providercommon\Idle.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1308 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\T7KIMELUbd.bat"26⤵PID:2008
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:4032
-
-
C:\providercommon\Idle.exe"C:\providercommon\Idle.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4476 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cxnNEsMM51.bat"28⤵PID:2652
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:4432
-
-
C:\providercommon\Idle.exe"C:\providercommon\Idle.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1536 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j5VZ5DKdOS.bat"30⤵PID:5060
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵PID:4812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Windows\Globalization\Sorting\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Globalization\Sorting\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Windows\Globalization\Sorting\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\providercommon\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4000
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\it-IT\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\it-IT\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\it-IT\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\Network Sharing\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3356
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Network Sharing\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1140
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\Network Sharing\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3920
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Mail\DllCommonsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4632
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1476
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\providercommon\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3416
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3692
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
192B
MD55e0a15964ada3789b61ed8f58073571d
SHA140060b684f0eddb8715610d8917effb6b71fdfa4
SHA256e14617b4d5484bfd601d07b898e585175bf1ddbd19bbacb36a4644807be68ba2
SHA512ff58b3641ecccd68f9a4e66a0fb7b3808c70d3119828f94e42c601bed6d84d6e1738cc1d1a493eb246a6dc3a87760d0794fac04dc6381a6b2f8fdd21927f5b5b
-
Filesize
191B
MD50b9ddf052d02330a9e684ec71e01d394
SHA1a41d6ff2556661652dd23fc30914fa2db9b989f9
SHA256eda7415b84aa1522c675ccc8782933e63b04fe2143e3ed3e0d234ded2dc2e3bd
SHA51293e410cc4fe35414221a7596272b5db1fc272ce4dfafe46694a3013a45cd7f63bbe20f6d97cf7a1d5c9e121f3adea2112cfe5bf491b6a84c40e45cd05fe44ef0
-
Filesize
191B
MD5927e0819b8a6ce0272cbeded8239756e
SHA1966502face4474571c2a7ab01d27dfe3c0e8a0fa
SHA2562e6cc09aaff6a3e0cad1e291d7f3801d75c040e92e9e39b79dd893f3f77a141b
SHA512e244eea81fe160124e6557707e3d5f6904e456ada41989be3ddd68a5d311264dc9d2b3daad48965907308ac0c16286fd17fac8501da0c585ad15bdd6dc1a2812
-
Filesize
191B
MD5ef2f900268d19b594b14071e6851f60c
SHA11a75642162941ae4b572f03292d545fda75531f2
SHA25617a019e27f5a8e1f04f92142964c8f732c1ee420b40ebd4950c4d20217954bbc
SHA5125c74b0bd327b89e0f39542bff2f55ef8ccfba145213466807afed46e50e6a89975877c03648d6a1978f1e6281cca677ba2bb9865b7dcc15c05800c2cd18c03a8
-
Filesize
191B
MD5223b3783c3108643e7f7825ee5ddd090
SHA14192c8e72be446143fa46202faeaa405a06c4faf
SHA25601a2edda02d020fa03f50562f87e0303452f7fc4640fba3ec062529d3959e115
SHA512e85fa2c386bc32942cda5715185b2279f42b73221bb861eee424d9cfef0e8fbfcab998c297de907f385e2ea6ad7ac028982ee3a1071f994864f311f80e0cc132
-
Filesize
191B
MD5ce83ed1f710019ea978c876b983ac42c
SHA1a86304391d176b706865a3d6cec29a0bc02e6dcb
SHA2569df7d48de7687ef3ec85d312484751ffd931c8fc82c0340b107adde686f0277a
SHA5129db29ff0083e154d155eb00329cf0ed2be396b774c06486cd839dd09ab16bdf321ee64d6c51e7be75f2516b60a7e08f44e4dd636e379002ec624533f06365ea1
-
Filesize
191B
MD5cb2dbfed709892d428a36971869062ec
SHA1a429c5d8a1122d579ad44adcca05756e583c20bd
SHA256b2c9c3815953ea97759aca2345d868675c5a19f2caabf7174f9cdb4328a31e74
SHA512d9669de28ed84b7e58b777b02c2973cd05e2a74102d0521264832e682aadffb7bfa81bae61b88bf3fef471bbb2d788d2886b7cf50ad9ec72a16104a1382ecf6a
-
Filesize
191B
MD5b666eb516d33c902106486cca52c6c9a
SHA1ff1e4c01bf46485f0e05a962433287f70e33246e
SHA256af3e50fe94e63b9e4a4d51217c812737a1c3f606b279410a25343fcbe4f3808d
SHA51294408339cb627a2c6e1091a7d72efa2a4749df12b37d82a034a96aa37b9291071a9b02cc661312a113320216d6a704e13df3e96f4a57a52c021e0aaa58aeeeda
-
Filesize
191B
MD598402fd56ce97535a22edd94122f5877
SHA119cbac0cccab21e39777396a84fd3a1c9acfa703
SHA256d4c1df01084080453929d68948d3665e136b0f2ad9138e5b5a21c893fa4425c4
SHA5129c2bb0373453bf1316e0a38b6985d1c13a73b3ddb088435b8511a48f910abc28fdac3b831d23dc97a0b5958028957e2b0cbd2d1fd644f9f43788e68ac20568f6
-
Filesize
191B
MD507ba32f0c59aa2360ce1edc68f9b9f4d
SHA1eb19a4437e1a3f78994f5fd1368fa975ba275315
SHA2564eccbfd148002ca96d0ad0c7e81a869a978a4856727698ea6db6076ce127f570
SHA5124bac66de6692612667526f75b8222323efb0c6fdb7e188efbb9f47457eab1aafd02cbce7934e3a2ba8ac3dc8ae1ec376f8783edc1e36d227092399b6d9f05cd2
-
Filesize
191B
MD50bdfd7b5bba555d5646d76089f543b12
SHA1d9622e6d146590d4f561f820a87c5d1758ea345f
SHA256557b692ed2dc50e8585511711278e57fb6bde47ab3bcb4c4cdd131b4b6738163
SHA512d634e2d5e6373870cf625a5d2d3d4f655b4e0e221f7f4c98b9c4c3abb3dbd4c52a256e15f49d86102e91f6ce3789924b510ff9b58ef13d3079fc1c5f9659a597
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
191B
MD5bf236cf158bc36c174e950553dab949b
SHA1201d3cc5d9560c952c3e4b817485f8f34b12d8b7
SHA25688c3c1672941a62129af0a12b5e742040be72dd62d53bd595e1e656a580022fb
SHA51205806b1abb37bdc786c45d53fd20044805d814eb2e8b8373f13232717adddde22e1e76e12a711708b1ccc7bb816e8ca3e3658e403205057968df1a71de38d4c3
-
Filesize
191B
MD5f29789c022b90a99d1b5a543b4d0882d
SHA1446fd829019fe8a3af43e1d703bb3250f24a02d4
SHA25642fbf67bfb80828f0efea0bc72a0fe16d2996fd0a4ff6531d01b775f7f71f500
SHA5127d42b7f4ea2a9ac8775f79118a2160e9197b38adb53cb02f106d8fa1d644c3701c5fb392b158e97e853738b790bc4c55d142eeb8c025b5be7dc90359c79e3f3c
-
Filesize
191B
MD54f7f5cd08edb5aa58c075379fabd939d
SHA1a76eceb6e74d37a6471c73856dcdf21da982994b
SHA256b966d971f71dd5662b9e7ce58c79d7ef08856d212d06e15ab22220e38d0a3784
SHA51243f14842fec339f0de99d5157e008fa5e20e9da867e61bab26c9e53c204778996f3b23411c0b187c9f6da60413899c8940425b33e3ddf8ca7a2c624b096d6cb8
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478