Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 04:16
Behavioral task
behavioral1
Sample
JaffaCakes118_4ead0cfa1b09fbc17cb40c9bc0ba213411bedb60de68ef8473e1f2b59c9816ef.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_4ead0cfa1b09fbc17cb40c9bc0ba213411bedb60de68ef8473e1f2b59c9816ef.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_4ead0cfa1b09fbc17cb40c9bc0ba213411bedb60de68ef8473e1f2b59c9816ef.exe
-
Size
1.3MB
-
MD5
d876aff0b01d9dfad949aa030032c959
-
SHA1
414c6eecb52179fa542f7e6898e7a9202a2641bc
-
SHA256
4ead0cfa1b09fbc17cb40c9bc0ba213411bedb60de68ef8473e1f2b59c9816ef
-
SHA512
a0b11727ee6528a20757ea879cc2e99aa2cb40485900a46c532ad7e0f4918be84faaa3a7691ba21118009c0b7a2581077fea3400da5ac71e47104ebff44444f7
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 27 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3192 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2136 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3828 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3932 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2400 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3840 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4832 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1988 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4656 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 676 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4160 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5072 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4964 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5116 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3368 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 224 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1984 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3436 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4892 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1300 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4464 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2420 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4636 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2904 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4380 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4516 1100 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1080 1100 schtasks.exe 86 -
resource yara_rule behavioral2/files/0x0007000000023cb4-9.dat dcrat behavioral2/memory/5060-13-0x0000000000750000-0x0000000000860000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3212 powershell.exe 1748 powershell.exe 820 powershell.exe 772 powershell.exe 2344 powershell.exe 1784 powershell.exe 3924 powershell.exe 3940 powershell.exe 4632 powershell.exe 4504 powershell.exe -
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation JaffaCakes118_4ead0cfa1b09fbc17cb40c9bc0ba213411bedb60de68ef8473e1f2b59c9816ef.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe -
Executes dropped EXE 14 IoCs
pid Process 5060 DllCommonsvc.exe 412 RuntimeBroker.exe 4588 RuntimeBroker.exe 3652 RuntimeBroker.exe 2396 RuntimeBroker.exe 2112 RuntimeBroker.exe 1444 RuntimeBroker.exe 4676 RuntimeBroker.exe 3052 RuntimeBroker.exe 4592 RuntimeBroker.exe 4160 RuntimeBroker.exe 4148 RuntimeBroker.exe 2316 RuntimeBroker.exe 2664 RuntimeBroker.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
flow ioc 16 raw.githubusercontent.com 41 raw.githubusercontent.com 45 raw.githubusercontent.com 46 raw.githubusercontent.com 53 raw.githubusercontent.com 54 raw.githubusercontent.com 22 raw.githubusercontent.com 55 raw.githubusercontent.com 17 raw.githubusercontent.com 33 raw.githubusercontent.com 56 raw.githubusercontent.com 40 raw.githubusercontent.com 47 raw.githubusercontent.com 52 raw.githubusercontent.com -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe DllCommonsvc.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\9e8d7a4ca61bd9 DllCommonsvc.exe File created C:\Program Files\Windows NT\Accessories\SppExtComObj.exe DllCommonsvc.exe File created C:\Program Files\Windows NT\Accessories\e1ef82546f0b02 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\lsass.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\6203df4a6bafc7 DllCommonsvc.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\CbsTemp\upfc.exe DllCommonsvc.exe File created C:\Windows\CbsTemp\ea1d8f6d871115 DllCommonsvc.exe File created C:\Windows\ShellExperiences\RuntimeBroker.exe DllCommonsvc.exe File opened for modification C:\Windows\ShellExperiences\RuntimeBroker.exe DllCommonsvc.exe File created C:\Windows\ShellExperiences\9e8d7a4ca61bd9 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_4ead0cfa1b09fbc17cb40c9bc0ba213411bedb60de68ef8473e1f2b59c9816ef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings JaffaCakes118_4ead0cfa1b09fbc17cb40c9bc0ba213411bedb60de68ef8473e1f2b59c9816ef.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings RuntimeBroker.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1300 schtasks.exe 4656 schtasks.exe 4892 schtasks.exe 2904 schtasks.exe 4516 schtasks.exe 224 schtasks.exe 3828 schtasks.exe 3932 schtasks.exe 3436 schtasks.exe 1988 schtasks.exe 5116 schtasks.exe 1080 schtasks.exe 3192 schtasks.exe 3840 schtasks.exe 4832 schtasks.exe 2420 schtasks.exe 4636 schtasks.exe 676 schtasks.exe 4464 schtasks.exe 4964 schtasks.exe 1984 schtasks.exe 2400 schtasks.exe 5072 schtasks.exe 3368 schtasks.exe 2136 schtasks.exe 4160 schtasks.exe 4380 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 5060 DllCommonsvc.exe 5060 DllCommonsvc.exe 5060 DllCommonsvc.exe 5060 DllCommonsvc.exe 5060 DllCommonsvc.exe 5060 DllCommonsvc.exe 5060 DllCommonsvc.exe 3940 powershell.exe 3940 powershell.exe 3212 powershell.exe 3212 powershell.exe 4632 powershell.exe 4632 powershell.exe 820 powershell.exe 820 powershell.exe 1784 powershell.exe 1784 powershell.exe 1748 powershell.exe 1748 powershell.exe 4504 powershell.exe 4504 powershell.exe 3924 powershell.exe 3924 powershell.exe 772 powershell.exe 772 powershell.exe 2344 powershell.exe 2344 powershell.exe 412 RuntimeBroker.exe 412 RuntimeBroker.exe 4504 powershell.exe 3940 powershell.exe 4632 powershell.exe 1748 powershell.exe 1784 powershell.exe 3212 powershell.exe 820 powershell.exe 772 powershell.exe 3924 powershell.exe 2344 powershell.exe 4588 RuntimeBroker.exe 3652 RuntimeBroker.exe 2396 RuntimeBroker.exe 2112 RuntimeBroker.exe 1444 RuntimeBroker.exe 4676 RuntimeBroker.exe 3052 RuntimeBroker.exe 4592 RuntimeBroker.exe 4160 RuntimeBroker.exe 4148 RuntimeBroker.exe 2316 RuntimeBroker.exe 2664 RuntimeBroker.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 5060 DllCommonsvc.exe Token: SeDebugPrivilege 3940 powershell.exe Token: SeDebugPrivilege 772 powershell.exe Token: SeDebugPrivilege 4504 powershell.exe Token: SeDebugPrivilege 3212 powershell.exe Token: SeDebugPrivilege 4632 powershell.exe Token: SeDebugPrivilege 820 powershell.exe Token: SeDebugPrivilege 1784 powershell.exe Token: SeDebugPrivilege 1748 powershell.exe Token: SeDebugPrivilege 3924 powershell.exe Token: SeDebugPrivilege 412 RuntimeBroker.exe Token: SeDebugPrivilege 2344 powershell.exe Token: SeDebugPrivilege 4588 RuntimeBroker.exe Token: SeDebugPrivilege 3652 RuntimeBroker.exe Token: SeDebugPrivilege 2396 RuntimeBroker.exe Token: SeDebugPrivilege 2112 RuntimeBroker.exe Token: SeDebugPrivilege 1444 RuntimeBroker.exe Token: SeDebugPrivilege 4676 RuntimeBroker.exe Token: SeDebugPrivilege 3052 RuntimeBroker.exe Token: SeDebugPrivilege 4592 RuntimeBroker.exe Token: SeDebugPrivilege 4160 RuntimeBroker.exe Token: SeDebugPrivilege 4148 RuntimeBroker.exe Token: SeDebugPrivilege 2316 RuntimeBroker.exe Token: SeDebugPrivilege 2664 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3220 wrote to memory of 4332 3220 JaffaCakes118_4ead0cfa1b09fbc17cb40c9bc0ba213411bedb60de68ef8473e1f2b59c9816ef.exe 82 PID 3220 wrote to memory of 4332 3220 JaffaCakes118_4ead0cfa1b09fbc17cb40c9bc0ba213411bedb60de68ef8473e1f2b59c9816ef.exe 82 PID 3220 wrote to memory of 4332 3220 JaffaCakes118_4ead0cfa1b09fbc17cb40c9bc0ba213411bedb60de68ef8473e1f2b59c9816ef.exe 82 PID 4332 wrote to memory of 2688 4332 WScript.exe 83 PID 4332 wrote to memory of 2688 4332 WScript.exe 83 PID 4332 wrote to memory of 2688 4332 WScript.exe 83 PID 2688 wrote to memory of 5060 2688 cmd.exe 85 PID 2688 wrote to memory of 5060 2688 cmd.exe 85 PID 5060 wrote to memory of 2344 5060 DllCommonsvc.exe 114 PID 5060 wrote to memory of 2344 5060 DllCommonsvc.exe 114 PID 5060 wrote to memory of 3212 5060 DllCommonsvc.exe 115 PID 5060 wrote to memory of 3212 5060 DllCommonsvc.exe 115 PID 5060 wrote to memory of 772 5060 DllCommonsvc.exe 116 PID 5060 wrote to memory of 772 5060 DllCommonsvc.exe 116 PID 5060 wrote to memory of 4504 5060 DllCommonsvc.exe 117 PID 5060 wrote to memory of 4504 5060 DllCommonsvc.exe 117 PID 5060 wrote to memory of 4632 5060 DllCommonsvc.exe 119 PID 5060 wrote to memory of 4632 5060 DllCommonsvc.exe 119 PID 5060 wrote to memory of 3940 5060 DllCommonsvc.exe 120 PID 5060 wrote to memory of 3940 5060 DllCommonsvc.exe 120 PID 5060 wrote to memory of 3924 5060 DllCommonsvc.exe 121 PID 5060 wrote to memory of 3924 5060 DllCommonsvc.exe 121 PID 5060 wrote to memory of 1748 5060 DllCommonsvc.exe 122 PID 5060 wrote to memory of 1748 5060 DllCommonsvc.exe 122 PID 5060 wrote to memory of 1784 5060 DllCommonsvc.exe 123 PID 5060 wrote to memory of 1784 5060 DllCommonsvc.exe 123 PID 5060 wrote to memory of 820 5060 DllCommonsvc.exe 124 PID 5060 wrote to memory of 820 5060 DllCommonsvc.exe 124 PID 5060 wrote to memory of 412 5060 DllCommonsvc.exe 134 PID 5060 wrote to memory of 412 5060 DllCommonsvc.exe 134 PID 412 wrote to memory of 5048 412 RuntimeBroker.exe 137 PID 412 wrote to memory of 5048 412 RuntimeBroker.exe 137 PID 5048 wrote to memory of 604 5048 cmd.exe 139 PID 5048 wrote to memory of 604 5048 cmd.exe 139 PID 5048 wrote to memory of 4588 5048 cmd.exe 142 PID 5048 wrote to memory of 4588 5048 cmd.exe 142 PID 4588 wrote to memory of 3736 4588 RuntimeBroker.exe 145 PID 4588 wrote to memory of 3736 4588 RuntimeBroker.exe 145 PID 3736 wrote to memory of 2688 3736 cmd.exe 147 PID 3736 wrote to memory of 2688 3736 cmd.exe 147 PID 3736 wrote to memory of 3652 3736 cmd.exe 148 PID 3736 wrote to memory of 3652 3736 cmd.exe 148 PID 3652 wrote to memory of 212 3652 RuntimeBroker.exe 150 PID 3652 wrote to memory of 212 3652 RuntimeBroker.exe 150 PID 212 wrote to memory of 1340 212 cmd.exe 152 PID 212 wrote to memory of 1340 212 cmd.exe 152 PID 212 wrote to memory of 2396 212 cmd.exe 153 PID 212 wrote to memory of 2396 212 cmd.exe 153 PID 2396 wrote to memory of 2632 2396 RuntimeBroker.exe 155 PID 2396 wrote to memory of 2632 2396 RuntimeBroker.exe 155 PID 2632 wrote to memory of 2212 2632 cmd.exe 157 PID 2632 wrote to memory of 2212 2632 cmd.exe 157 PID 2632 wrote to memory of 2112 2632 cmd.exe 158 PID 2632 wrote to memory of 2112 2632 cmd.exe 158 PID 2112 wrote to memory of 1624 2112 RuntimeBroker.exe 159 PID 2112 wrote to memory of 1624 2112 RuntimeBroker.exe 159 PID 1624 wrote to memory of 4956 1624 cmd.exe 161 PID 1624 wrote to memory of 4956 1624 cmd.exe 161 PID 1624 wrote to memory of 1444 1624 cmd.exe 162 PID 1624 wrote to memory of 1444 1624 cmd.exe 162 PID 1444 wrote to memory of 512 1444 RuntimeBroker.exe 163 PID 1444 wrote to memory of 512 1444 RuntimeBroker.exe 163 PID 512 wrote to memory of 1080 512 cmd.exe 165 PID 512 wrote to memory of 1080 512 cmd.exe 165 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4ead0cfa1b09fbc17cb40c9bc0ba213411bedb60de68ef8473e1f2b59c9816ef.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4ead0cfa1b09fbc17cb40c9bc0ba213411bedb60de68ef8473e1f2b59c9816ef.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2344
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellExperiences\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3212
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OfficeClickToRun.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:772
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4504
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4632
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\WindowsHolographicDevices\SpatialStore\unsecapp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3924
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\upfc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1748
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\Accessories\SppExtComObj.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:820
-
-
C:\Windows\ShellExperiences\RuntimeBroker.exe"C:\Windows\ShellExperiences\RuntimeBroker.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WLCDTNV5Zk.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:604
-
-
C:\Windows\ShellExperiences\RuntimeBroker.exe"C:\Windows\ShellExperiences\RuntimeBroker.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9j3rBUpSkc.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:2688
-
-
C:\Windows\ShellExperiences\RuntimeBroker.exe"C:\Windows\ShellExperiences\RuntimeBroker.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8pOjIocmws.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:1340
-
-
C:\Windows\ShellExperiences\RuntimeBroker.exe"C:\Windows\ShellExperiences\RuntimeBroker.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HZWv28qLDz.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:2212
-
-
C:\Windows\ShellExperiences\RuntimeBroker.exe"C:\Windows\ShellExperiences\RuntimeBroker.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BcIiUXCUMc.bat"14⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:4956
-
-
C:\Windows\ShellExperiences\RuntimeBroker.exe"C:\Windows\ShellExperiences\RuntimeBroker.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wtOcRLEbie.bat"16⤵
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:1080
-
-
C:\Windows\ShellExperiences\RuntimeBroker.exe"C:\Windows\ShellExperiences\RuntimeBroker.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4676 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GUMorhJGzB.bat"18⤵PID:1908
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:3008
-
-
C:\Windows\ShellExperiences\RuntimeBroker.exe"C:\Windows\ShellExperiences\RuntimeBroker.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3052 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MQa1PIx8rY.bat"20⤵PID:4044
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:2400
-
-
C:\Windows\ShellExperiences\RuntimeBroker.exe"C:\Windows\ShellExperiences\RuntimeBroker.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4592 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lEFN0vw97k.bat"22⤵PID:2900
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:3044
-
-
C:\Windows\ShellExperiences\RuntimeBroker.exe"C:\Windows\ShellExperiences\RuntimeBroker.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4160 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8pOjIocmws.bat"24⤵PID:3436
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:4980
-
-
C:\Windows\ShellExperiences\RuntimeBroker.exe"C:\Windows\ShellExperiences\RuntimeBroker.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\k2jNhBdkgg.bat"26⤵PID:4832
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:3488
-
-
C:\Windows\ShellExperiences\RuntimeBroker.exe"C:\Windows\ShellExperiences\RuntimeBroker.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VG36Hwy0Lv.bat"28⤵PID:3688
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:3028
-
-
C:\Windows\ShellExperiences\RuntimeBroker.exe"C:\Windows\ShellExperiences\RuntimeBroker.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ST975DOJvB.bat"30⤵PID:2376
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵PID:4392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\ShellExperiences\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3192
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\ShellExperiences\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3828
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\providercommon\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3840
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4832
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:676
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4160
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\providercommon\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5116
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3368
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\WindowsHolographicDevices\SpatialStore\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\All Users\WindowsHolographicDevices\SpatialStore\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\WindowsHolographicDevices\SpatialStore\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Windows\CbsTemp\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\CbsTemp\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1300
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Windows\CbsTemp\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\Accessories\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\Accessories\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Music\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4380
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Public\Music\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4516
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Music\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1080
Network
-
Remote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request181.129.81.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request2.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestraw.githubusercontent.comIN AResponseraw.githubusercontent.comIN A185.199.109.133raw.githubusercontent.comIN A185.199.110.133raw.githubusercontent.comIN A185.199.111.133raw.githubusercontent.comIN A185.199.108.133
-
Remote address:185.199.109.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: BFDF:081B:57086:70797:6766E7BC
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 04:16:49 GMT
Via: 1.1 varnish
X-Served-By: cache-lcy-eglc8600026-LCY
X-Cache: HIT
X-Cache-Hits: 2
X-Timer: S1734841010.887359,VS0,VE0
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: 4e6a86c1ab5c99ed8c4c14785fd573957b766eba
Expires: Sun, 22 Dec 2024 04:21:49 GMT
Source-Age: 136
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request133.109.199.185.in-addr.arpaIN PTRResponse133.109.199.185.in-addr.arpaIN PTRcdn-185-199-109-133githubcom
-
Remote address:185.199.109.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: BFDF:081B:57086:70797:6766E7BC
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 04:16:58 GMT
Via: 1.1 varnish
X-Served-By: cache-lcy-eglc8600050-LCY
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1734841019.814935,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: 62486479895301c43737f28aa7b7f1b74e15754c
Expires: Sun, 22 Dec 2024 04:21:58 GMT
Source-Age: 145
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request197.87.175.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:185.199.109.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: DA94:39D8B8:441DE8:596B25:6766E7B4
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 04:17:13 GMT
Via: 1.1 varnish
X-Served-By: cache-lon420106-LON
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1734841034.856453,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: c3e94b6a34a9b7028dcad226a4c4943a66807761
Expires: Sun, 22 Dec 2024 04:22:13 GMT
Source-Age: 59
-
Remote address:8.8.8.8:53Request133.130.81.91.in-addr.arpaIN PTRResponse
-
Remote address:185.199.109.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: BFDF:081B:57086:70797:6766E7BC
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 04:17:24 GMT
Via: 1.1 varnish
X-Served-By: cache-lcy-eglc8600088-LCY
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1734841044.047027,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: 26ff1a6ff0c0faca662fcb8868d087890afa0fa4
Expires: Sun, 22 Dec 2024 04:22:24 GMT
Source-Age: 170
-
Remote address:185.199.109.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: BFDF:081B:57086:70797:6766E7BC
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 04:17:38 GMT
Via: 1.1 varnish
X-Served-By: cache-lcy-eglc8600029-LCY
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1734841058.433289,VS0,VE0
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: d7862f4c83ea12e12723ace8fd11980fbdd9e71d
Expires: Sun, 22 Dec 2024 04:22:38 GMT
Source-Age: 184
-
Remote address:8.8.8.8:53Request20.49.80.91.in-addr.arpaIN PTRResponse
-
Remote address:185.199.109.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: BFDF:081B:57086:70797:6766E7BC
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 04:17:50 GMT
Via: 1.1 varnish
X-Served-By: cache-lcy-eglc8600089-LCY
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1734841070.012636,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: f01ba9a7a48c3e0f568a77ab41160a2862f7be6a
Expires: Sun, 22 Dec 2024 04:22:50 GMT
Source-Age: 196
-
Remote address:185.199.109.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: BFDF:081B:57086:70797:6766E7BC
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 04:18:02 GMT
Via: 1.1 varnish
X-Served-By: cache-lcy-eglc8600052-LCY
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1734841083.528711,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: 5bfc03eb7cf53135de5847a2112ff0f9d2e2896d
Expires: Sun, 22 Dec 2024 04:23:02 GMT
Source-Age: 208
-
Remote address:185.199.109.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: DA94:39D8B8:441DE8:596B25:6766E7B4
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 04:18:09 GMT
Via: 1.1 varnish
X-Served-By: cache-lon4247-LON
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1734841089.144283,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: 29e099782ad1fa3264d3702ac3adcadc25643624
Expires: Sun, 22 Dec 2024 04:23:09 GMT
Source-Age: 114
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:185.199.109.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: BFDF:081B:57086:70797:6766E7BC
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 04:18:16 GMT
Via: 1.1 varnish
X-Served-By: cache-lcy-eglc8600023-LCY
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1734841097.785529,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: 29f02c89b2fc6dd9214301a70ca122a3d96872bf
Expires: Sun, 22 Dec 2024 04:23:16 GMT
Source-Age: 223
-
Remote address:185.199.109.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: DA94:39D8B8:441DE8:596B25:6766E7B4
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 04:18:29 GMT
Via: 1.1 varnish
X-Served-By: cache-lon4250-LON
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1734841110.856590,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: 38e4bda4f0e752584bdb18a412b024d8b5d7686b
Expires: Sun, 22 Dec 2024 04:23:29 GMT
Source-Age: 135
-
Remote address:185.199.109.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: DA94:39D8B8:441DE8:596B25:6766E7B4
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 04:18:45 GMT
Via: 1.1 varnish
X-Served-By: cache-lon420108-LON
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1734841125.215229,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: a9fa71c5a83859d04c1850cb343536995b98e726
Expires: Sun, 22 Dec 2024 04:23:45 GMT
Source-Age: 151
-
Remote address:185.199.109.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: BFDF:081B:57086:70797:6766E7BC
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 04:18:52 GMT
Via: 1.1 varnish
X-Served-By: cache-lcy-eglc8600068-LCY
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1734841132.378716,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: d20e9096f16da01a82cb1f19b9dc8f216335e0f4
Expires: Sun, 22 Dec 2024 04:23:52 GMT
Source-Age: 258
-
Remote address:185.199.109.133:443RequestGET /justbio123/raven/main/api.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "e02d2a68e3127684593cad90a6339315a5353b0c3584608402c5a1bac4c9c6e4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: DA94:39D8B8:441DE8:596B25:6766E7B4
Accept-Ranges: bytes
Date: Sun, 22 Dec 2024 04:19:06 GMT
Via: 1.1 varnish
X-Served-By: cache-lon420103-LON
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1734841147.800411,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: 36ee09072c0f96901690f1f89d4096c7fb7d8b97
Expires: Sun, 22 Dec 2024 04:24:06 GMT
Source-Age: 172
-
185.199.109.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpRuntimeBroker.exe849 B 5.1kB 8 9
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.109.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpRuntimeBroker.exe861 B 5.1kB 8 10
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.109.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpRuntimeBroker.exe897 B 5.1kB 8 10
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.109.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpRuntimeBroker.exe861 B 5.1kB 8 9
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.109.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpRuntimeBroker.exe861 B 5.1kB 8 9
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.109.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpRuntimeBroker.exe861 B 5.1kB 8 9
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.109.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpRuntimeBroker.exe861 B 5.1kB 8 10
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.109.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpRuntimeBroker.exe861 B 5.1kB 8 9
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.109.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpRuntimeBroker.exe849 B 5.1kB 8 9
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.109.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpRuntimeBroker.exe897 B 5.1kB 8 10
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.109.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpRuntimeBroker.exe849 B 5.1kB 8 10
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.109.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpRuntimeBroker.exe849 B 5.1kB 8 9
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200 -
185.199.109.133:443https://raw.githubusercontent.com/justbio123/raven/main/api.txttls, httpRuntimeBroker.exe897 B 5.1kB 8 10
HTTP Request
GET https://raw.githubusercontent.com/justbio123/raven/main/api.txtHTTP Response
200
-
73 B 147 B 1 1
DNS Request
196.249.167.52.in-addr.arpa
-
72 B 147 B 1 1
DNS Request
181.129.81.91.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
2.159.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
raw.githubusercontent.com
DNS Response
185.199.109.133185.199.110.133185.199.111.133185.199.108.133
-
71 B 157 B 1 1
DNS Request
13.86.106.20.in-addr.arpa
-
74 B 118 B 1 1
DNS Request
133.109.199.185.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
197.87.175.4.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
72 B 147 B 1 1
DNS Request
133.130.81.91.in-addr.arpa
-
70 B 145 B 1 1
DNS Request
20.49.80.91.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
19.229.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
210B
MD54820339eaa6791e4822bc21cb704ab0f
SHA122c8b9b7f916df4834894279584de4577e291c2b
SHA256387a96f660be6a63f08aa5cd4f319c18b0dc78719d5c7ac9d025c54d0e5b09d9
SHA5123f79d1ede5b96635a625181e9c8de11656b9a77a6684130ad3640b53eb71356a2018814540e9c4d546eb73f81e7c4d96eebfaa400c1e348053d8671c808b2731
-
Filesize
210B
MD5af1a6532f019b554b93cce681d13ec66
SHA149878ac279cbf9bd697eb8f11506614223740685
SHA2568334ed10fa14fc319ad1c1aa50051c290c18d114aaff98adb6777eba9bc62730
SHA512299678abfcfc89c0416b1f0b8a4b621ddacb85b802753ab4d76fe38914553b27f2d04a08ee55da5ff51a35421720c9d0833b09c7bb4d7f3f9292275b5661694b
-
Filesize
210B
MD5fae521bc1e721c3009b7427586d3f318
SHA197d3200eaa1a436b174ab67b5a204d75d8e25675
SHA256b3cb02488f4d81c51829d65476ae957b64f2f6a6703e9b26b6c5346a21273ae6
SHA51206196a4a6c007383a0c1a3e976bb70c255c098cb413ec3fde60ed4f4f822c3c317a3064c9fdfedce9f50e3c61af8a402b6c3e15a7ab7a51378123ade7d838cfb
-
Filesize
210B
MD567b8a0c223c98852e9a08fc68ac40ce9
SHA1087929f835c3ab9f3d45e318f2456f708e8f3b79
SHA256888d6d0ea83e2dec3dd5cd68e5e314b6c14d2ca029ad95bb727f5d8e7d9af605
SHA512b5f44a726e088dc335358b0064abb0b46d07b7f0931f932f6fa11d32ac9bbac66b06cc1c9298a586d6717a3d0f53207ccc62bf82522a7690cd15ffd9d5d0e374
-
Filesize
210B
MD58d415d2e124f5a4145c810ea684a8c83
SHA1d9816aa24afa20bee83badbf8c34c31bf49e04d2
SHA2569a3d98b3140d5c20ff2e65a775b8803695d8bdfe50cf60722d5a693874b43cce
SHA51259d97b2cf15b2acc17e95786b58bb7453a9b57d921298b7d2414fed9111fac06e2c801f73df182d32c3eac467539f903af11344b4f49fe46297995ca58596657
-
Filesize
210B
MD5eb1987f8a4e50cfbf94a024b77b9c4a3
SHA1e0b2587301dd22a0db5150841f777aa3ad311802
SHA256330a791daa2925b008eb43955011938736e195befd12778de124ccbfabfcdd6d
SHA51283ed41207d752a3ff0d43177ad576657779e69780cd9300f17753a493d248dc1d511ce13a127bbd365a10470e44d5b350bcd8ed58c043763f1e59ef51ead4968
-
Filesize
210B
MD53d8dc6b9ad07f216aa818de4324ca6cf
SHA1773cc7b526e32b8d4c070d19fe5c9cc60e5b719d
SHA2565d0e4f8f7f4a9eb1dd1c38af8bedadb7a3167befa8279a12deb0c9dc6823e1e7
SHA51234ae8b0558d54c8d5ce40d71fca6e792b1694f8ff4416a3992c95963a06db88820b93f914f6d93901652647f19549059034a3bfcb8227ef255a0a06928c23d2c
-
Filesize
210B
MD5e5c59cebdcb84988800d2dbfd126c746
SHA1b83af0b3d07281358309ed3c7e0cc58b13531aed
SHA256b0a8a183a12a338e7ccb680defc6cce8c640caff29cb8c780ebafa60fbe60083
SHA512d4f6d1af9264bc7fe657f585ad812603fa45959ddeb8f0a8731cfb20bb3cfd83267718c429bbf8ac0fd1a36a5085b4cde4ac54570116d9e65cb9c2e31b50918a
-
Filesize
210B
MD543b4792fc94c0ce98167829f6d9e8df8
SHA1aba2ea2eff868b8613625fb28a357dfd61707e3a
SHA2561c502c4b683fb229e78753a3b81adeb9b5b43a0f7527e49d83ec420f1e74527a
SHA512c8512943f2f4de5b1b5747be3a3eae5259a35be865561ac19f872a62d0a6188061b4ded4c7d8e65ae649cfe39e7af8184706f367076e8470e4fc27c2b3a9c5ae
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
210B
MD5f1d5303735ec2af9f1473bc491e93bb0
SHA1178e26ad5d08e72198eb23c4c49bb866db4e62a8
SHA2560bf01a3fa7a7fd284e98da6b1a7b20233e76b45b232981aa807dff7fda5bb7e6
SHA512ce3e6380aba7d0a46af561db9666b5f6a96b00dcd8c8913d528d43e0ef6705ea7ebfc37bdf0ad994e2ab16909b9f6e5af1b40f0cce148715919d004739bffb38
-
Filesize
210B
MD575929d37d6934e80f0bb4f4f03071245
SHA12bc746874397de99335e80b50bb2a516c5aa84b0
SHA25626cb69587c109e610b029051ad907a2b34ad0a915bd2060d67b6a4af7338fae8
SHA512792ec153a0cf328a896eff07540c36c3f33a1188479e89f2f7516f101aa6773086b1ae6e97556af5a2a23bbd8405633602bb2bed610c57c1742d49cf3f1fe858
-
Filesize
210B
MD558e4bc16fe924d5535c5d5640951e84f
SHA153f92f4e170577e8cc798a1620b3cf306ae2059a
SHA256be358f84cc99287948e71ab627a1a22cf3d6b31baf399371b31b85f505bfec04
SHA512f2fd4e6703ee93e7adac7d3cf33b2706b256ff0059fcdc962183ec91f95bb3a211786677ca15bed7e30bce3bea6d9f9955591af35599b3b7939fe15f31e6c72a
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478