Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 10:44
Behavioral task
behavioral1
Sample
JaffaCakes118_58a7fe4f93c4252d5e1d12356b887897caaa5e88beba0722442e23545e3e44e5.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_58a7fe4f93c4252d5e1d12356b887897caaa5e88beba0722442e23545e3e44e5.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_58a7fe4f93c4252d5e1d12356b887897caaa5e88beba0722442e23545e3e44e5.exe
-
Size
1.3MB
-
MD5
3b476ac7e482beee4492355bd81a167c
-
SHA1
a1d1a526a930e1819883095d348bdbb076e529ef
-
SHA256
58a7fe4f93c4252d5e1d12356b887897caaa5e88beba0722442e23545e3e44e5
-
SHA512
4c8a3a5698f9b8fbbb9e126503b7c92a4c329c739e84d67b9b64c838a0ef61f430db58bb9a43fbce8b8fddebb3b4fe459d14b550a3e51ff7551fa8490c15e163
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 27 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3840 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2276 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4988 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1892 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4644 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 220 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1620 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1140 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2400 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3264 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1272 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1744 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4480 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2200 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3540 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4928 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1468 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5040 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3016 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4072 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4192 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4140 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1384 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3968 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1588 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3544 1568 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 116 1568 schtasks.exe 86 -
resource yara_rule behavioral2/files/0x000a000000023b8b-10.dat dcrat behavioral2/memory/1144-13-0x0000000000100000-0x0000000000210000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2752 powershell.exe 812 powershell.exe 4732 powershell.exe 316 powershell.exe 404 powershell.exe 2072 powershell.exe 1352 powershell.exe 4300 powershell.exe 4400 powershell.exe 1484 powershell.exe -
Checks computer location settings 2 TTPs 13 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation JaffaCakes118_58a7fe4f93c4252d5e1d12356b887897caaa5e88beba0722442e23545e3e44e5.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation Registry.exe -
Executes dropped EXE 12 IoCs
pid Process 1144 DllCommonsvc.exe 1152 Registry.exe 556 Registry.exe 5080 Registry.exe 3320 Registry.exe 4212 Registry.exe 1132 Registry.exe 4028 Registry.exe 4820 Registry.exe 4644 Registry.exe 704 Registry.exe 3564 Registry.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
flow ioc 16 raw.githubusercontent.com 38 raw.githubusercontent.com 45 raw.githubusercontent.com 47 raw.githubusercontent.com 49 raw.githubusercontent.com 51 raw.githubusercontent.com 17 raw.githubusercontent.com 24 raw.githubusercontent.com 37 raw.githubusercontent.com 41 raw.githubusercontent.com 48 raw.githubusercontent.com 50 raw.githubusercontent.com -
Drops file in Program Files directory 7 IoCs
description ioc Process File created C:\Program Files\Windows NT\TableTextService\en-US\unsecapp.exe DllCommonsvc.exe File created C:\Program Files\Windows NT\TableTextService\en-US\29c1c3cc0f7685 DllCommonsvc.exe File created C:\Program Files\Mozilla Firefox\dllhost.exe DllCommonsvc.exe File created C:\Program Files\Mozilla Firefox\5940a34987c991 DllCommonsvc.exe File created C:\Program Files (x86)\MSBuild\Microsoft\spoolsv.exe DllCommonsvc.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\spoolsv.exe DllCommonsvc.exe File created C:\Program Files (x86)\MSBuild\Microsoft\f3b6ecef712a24 DllCommonsvc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\uk-UA\SppExtComObj.exe DllCommonsvc.exe File created C:\Windows\uk-UA\e1ef82546f0b02 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_58a7fe4f93c4252d5e1d12356b887897caaa5e88beba0722442e23545e3e44e5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings JaffaCakes118_58a7fe4f93c4252d5e1d12356b887897caaa5e88beba0722442e23545e3e44e5.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings Registry.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1272 schtasks.exe 5040 schtasks.exe 3544 schtasks.exe 116 schtasks.exe 1468 schtasks.exe 2276 schtasks.exe 4928 schtasks.exe 4072 schtasks.exe 4140 schtasks.exe 1744 schtasks.exe 3540 schtasks.exe 1892 schtasks.exe 1620 schtasks.exe 4480 schtasks.exe 2200 schtasks.exe 1588 schtasks.exe 4644 schtasks.exe 220 schtasks.exe 1384 schtasks.exe 3968 schtasks.exe 3264 schtasks.exe 3016 schtasks.exe 4192 schtasks.exe 3840 schtasks.exe 4988 schtasks.exe 1140 schtasks.exe 2400 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 1144 DllCommonsvc.exe 1144 DllCommonsvc.exe 1144 DllCommonsvc.exe 1144 DllCommonsvc.exe 1144 DllCommonsvc.exe 1144 DllCommonsvc.exe 1144 DllCommonsvc.exe 316 powershell.exe 2752 powershell.exe 2752 powershell.exe 4732 powershell.exe 4732 powershell.exe 404 powershell.exe 404 powershell.exe 812 powershell.exe 812 powershell.exe 1484 powershell.exe 1484 powershell.exe 4300 powershell.exe 4300 powershell.exe 1352 powershell.exe 1352 powershell.exe 4400 powershell.exe 4400 powershell.exe 2072 powershell.exe 2072 powershell.exe 4732 powershell.exe 2752 powershell.exe 316 powershell.exe 316 powershell.exe 1484 powershell.exe 812 powershell.exe 2072 powershell.exe 404 powershell.exe 4300 powershell.exe 1352 powershell.exe 4400 powershell.exe 1152 Registry.exe 556 Registry.exe 5080 Registry.exe 3320 Registry.exe 4212 Registry.exe 1132 Registry.exe 4028 Registry.exe 4820 Registry.exe 4644 Registry.exe 704 Registry.exe 3564 Registry.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 1144 DllCommonsvc.exe Token: SeDebugPrivilege 316 powershell.exe Token: SeDebugPrivilege 2752 powershell.exe Token: SeDebugPrivilege 4732 powershell.exe Token: SeDebugPrivilege 1484 powershell.exe Token: SeDebugPrivilege 404 powershell.exe Token: SeDebugPrivilege 812 powershell.exe Token: SeDebugPrivilege 4300 powershell.exe Token: SeDebugPrivilege 1352 powershell.exe Token: SeDebugPrivilege 2072 powershell.exe Token: SeDebugPrivilege 4400 powershell.exe Token: SeDebugPrivilege 1152 Registry.exe Token: SeDebugPrivilege 556 Registry.exe Token: SeDebugPrivilege 5080 Registry.exe Token: SeDebugPrivilege 3320 Registry.exe Token: SeDebugPrivilege 4212 Registry.exe Token: SeDebugPrivilege 1132 Registry.exe Token: SeDebugPrivilege 4028 Registry.exe Token: SeDebugPrivilege 4820 Registry.exe Token: SeDebugPrivilege 4644 Registry.exe Token: SeDebugPrivilege 704 Registry.exe Token: SeDebugPrivilege 3564 Registry.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3564 wrote to memory of 4776 3564 JaffaCakes118_58a7fe4f93c4252d5e1d12356b887897caaa5e88beba0722442e23545e3e44e5.exe 82 PID 3564 wrote to memory of 4776 3564 JaffaCakes118_58a7fe4f93c4252d5e1d12356b887897caaa5e88beba0722442e23545e3e44e5.exe 82 PID 3564 wrote to memory of 4776 3564 JaffaCakes118_58a7fe4f93c4252d5e1d12356b887897caaa5e88beba0722442e23545e3e44e5.exe 82 PID 4776 wrote to memory of 5028 4776 WScript.exe 83 PID 4776 wrote to memory of 5028 4776 WScript.exe 83 PID 4776 wrote to memory of 5028 4776 WScript.exe 83 PID 5028 wrote to memory of 1144 5028 cmd.exe 85 PID 5028 wrote to memory of 1144 5028 cmd.exe 85 PID 1144 wrote to memory of 4300 1144 DllCommonsvc.exe 114 PID 1144 wrote to memory of 4300 1144 DllCommonsvc.exe 114 PID 1144 wrote to memory of 4400 1144 DllCommonsvc.exe 115 PID 1144 wrote to memory of 4400 1144 DllCommonsvc.exe 115 PID 1144 wrote to memory of 1352 1144 DllCommonsvc.exe 116 PID 1144 wrote to memory of 1352 1144 DllCommonsvc.exe 116 PID 1144 wrote to memory of 2072 1144 DllCommonsvc.exe 117 PID 1144 wrote to memory of 2072 1144 DllCommonsvc.exe 117 PID 1144 wrote to memory of 404 1144 DllCommonsvc.exe 118 PID 1144 wrote to memory of 404 1144 DllCommonsvc.exe 118 PID 1144 wrote to memory of 316 1144 DllCommonsvc.exe 119 PID 1144 wrote to memory of 316 1144 DllCommonsvc.exe 119 PID 1144 wrote to memory of 1484 1144 DllCommonsvc.exe 120 PID 1144 wrote to memory of 1484 1144 DllCommonsvc.exe 120 PID 1144 wrote to memory of 4732 1144 DllCommonsvc.exe 121 PID 1144 wrote to memory of 4732 1144 DllCommonsvc.exe 121 PID 1144 wrote to memory of 812 1144 DllCommonsvc.exe 122 PID 1144 wrote to memory of 812 1144 DllCommonsvc.exe 122 PID 1144 wrote to memory of 2752 1144 DllCommonsvc.exe 123 PID 1144 wrote to memory of 2752 1144 DllCommonsvc.exe 123 PID 1144 wrote to memory of 4232 1144 DllCommonsvc.exe 134 PID 1144 wrote to memory of 4232 1144 DllCommonsvc.exe 134 PID 4232 wrote to memory of 2124 4232 cmd.exe 136 PID 4232 wrote to memory of 2124 4232 cmd.exe 136 PID 4232 wrote to memory of 1152 4232 cmd.exe 137 PID 4232 wrote to memory of 1152 4232 cmd.exe 137 PID 1152 wrote to memory of 1228 1152 Registry.exe 140 PID 1152 wrote to memory of 1228 1152 Registry.exe 140 PID 1228 wrote to memory of 4616 1228 cmd.exe 142 PID 1228 wrote to memory of 4616 1228 cmd.exe 142 PID 1228 wrote to memory of 556 1228 cmd.exe 145 PID 1228 wrote to memory of 556 1228 cmd.exe 145 PID 556 wrote to memory of 3068 556 Registry.exe 148 PID 556 wrote to memory of 3068 556 Registry.exe 148 PID 3068 wrote to memory of 4752 3068 cmd.exe 150 PID 3068 wrote to memory of 4752 3068 cmd.exe 150 PID 3068 wrote to memory of 5080 3068 cmd.exe 152 PID 3068 wrote to memory of 5080 3068 cmd.exe 152 PID 5080 wrote to memory of 812 5080 Registry.exe 154 PID 5080 wrote to memory of 812 5080 Registry.exe 154 PID 812 wrote to memory of 1180 812 cmd.exe 156 PID 812 wrote to memory of 1180 812 cmd.exe 156 PID 812 wrote to memory of 3320 812 cmd.exe 157 PID 812 wrote to memory of 3320 812 cmd.exe 157 PID 3320 wrote to memory of 4392 3320 Registry.exe 158 PID 3320 wrote to memory of 4392 3320 Registry.exe 158 PID 4392 wrote to memory of 4456 4392 cmd.exe 160 PID 4392 wrote to memory of 4456 4392 cmd.exe 160 PID 4392 wrote to memory of 4212 4392 cmd.exe 161 PID 4392 wrote to memory of 4212 4392 cmd.exe 161 PID 4212 wrote to memory of 1136 4212 Registry.exe 162 PID 4212 wrote to memory of 1136 4212 Registry.exe 162 PID 1136 wrote to memory of 4948 1136 cmd.exe 164 PID 1136 wrote to memory of 4948 1136 cmd.exe 164 PID 1136 wrote to memory of 1132 1136 cmd.exe 165 PID 1136 wrote to memory of 1132 1136 cmd.exe 165 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_58a7fe4f93c4252d5e1d12356b887897caaa5e88beba0722442e23545e3e44e5.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_58a7fe4f93c4252d5e1d12356b887897caaa5e88beba0722442e23545e3e44e5.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\spoolsv.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4400
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1352
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2072
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:404
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\uk-UA\SppExtComObj.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:316
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\en-US\unsecapp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4732
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Registry.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:812
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KxN7vbLbkz.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:2124
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\r7gOBUt9HL.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:4616
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Asmf6CRzTu.bat"9⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:4752
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NiQtqM3qVs.bat"11⤵
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:1180
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cU7BGbiaqd.bat"13⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:4456
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RaUzDWAd8R.bat"15⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:4948
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1132 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\r7gOBUt9HL.bat"17⤵PID:2104
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:1240
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4028 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GvLkm7sAXX.bat"19⤵PID:924
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:3164
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\q3WH03M43W.bat"21⤵PID:2292
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:3372
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4644 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lEFN0vw97k.bat"23⤵PID:2568
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:3000
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:704 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bbT3NvUu3s.bat"25⤵PID:3320
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:2984
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"26⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3840
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\providercommon\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4644
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Public\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1140
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Users\Public\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\providercommon\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3264
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Windows\uk-UA\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\uk-UA\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2200
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Windows\uk-UA\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3540
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5040
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4072
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4192
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\providercommon\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4140
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1384
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3544
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:116
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
195B
MD58181e340783545a9ee6510cfacdc25b9
SHA11f23c2fc96837658518492120dc15aa58098a26f
SHA256728d676ac5e31da503720aa2bb850824e0ccb5ff366a0f210249a9555d60dd06
SHA512fec975cfe977e15e00df6dbbcda575edcb5df10632f09529ed1c5ccd42bb026438bc84a28c1b3d8106f7d4fbf50f90ff1f226f8cb1e70495ed95de4760e870de
-
Filesize
195B
MD5dedf5f2b96963f37d7ec59fd81a052a6
SHA16e9c85f4efc20fa62e45fde80bd26609de8fda97
SHA256a14140a57f2dc440434ff214dff56017f24b4776ad02620ad1c275f4add2307f
SHA512cbc4145910a1cd054c42cdb6705cbb376222243cf8b72fb7155c1ed5850161a67eaf5e9d03e7c46425541b33bfda99b34795aa26af5e3be66ec7ca12f3b37ebc
-
Filesize
195B
MD518e45061cb3444ee9e1827f679ceab27
SHA1f2ff716d9ab35be42469229f174e2c66321e00c5
SHA25638c859897df00d5f529d729bac665ad5ec9ca9c52ad92bbc65631ee8165fa28f
SHA512403525905f0607fdf7e3321e4ed1e79db856354aef8dfd07cb609492dd08055cd03ffab2d454a38866f658c6b281860eeaec2d87da00b4eb51643f9813aa68e9
-
Filesize
195B
MD58ba031d51456a257da6e219e872c98ee
SHA1cf27bddea478e6be5df2d9a9c7e7e4eee01d09a4
SHA256fe624ee4c0471dd545a3ef9899d0367ed50a7c263b15ed383db12f8e4ec66271
SHA512ba96223181f9d37e7b90a24b88997f4b2c0e38bf93ec08e49c6b3de492e0601f73c82ac25c586f2ff5e69a90ad779df35e4fede0f52e4dcfb3e722b9ad7b6fc4
-
Filesize
195B
MD5cae015afdb548f7ed35ea106c579c789
SHA10eae2e467553663d819118855dd774e4d096f11b
SHA256ea455fe32feee10bfed1939736298675d1cb11da75e1449775490e70beed9e1d
SHA51211690994c738ee48b7d704f57a1ec7b2240db931513c420d93b5d556baee3a9dbf63e3c42a7e1d69f7b95d70dc1184645de4a09c90c951db20a7f073e9130ca8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
195B
MD5ed42c4e624a1fc117a597db0d6ac4bdb
SHA14ed77b3f4a436da9cca4d59b53585b757e0ba679
SHA2562fb28adcad29f3de7d0e05d97104a90b706778f7a543dd6c50834170a48531bc
SHA512125b455dfc647c3346c3513b30a0447418fb40c3028419e3457b27079010956e13858695fdbf789ec6a8d332dec2dd8f5e67cbeb07fb384bd5f8ce2828b243e8
-
Filesize
195B
MD517b9da624445d3f3ff7e0614dfbcca95
SHA1a54fbd187ec93483d471d6bef444c17839d594dc
SHA2561abecbb27b96f1b4ed3f43cdb5f4a985f899139d301fc424174e8e66b29ea9dc
SHA51218bcf92d95edf2a1daf60123f23f88be59818d61cc39e67cc22ec4498ad0a6cea87786bfc00566a9151d65f6eb6261c12a1fbe216ee7350fa59ce2f85c3d9ed7
-
Filesize
195B
MD5f33b0c32661c21ffc0719ab824c27303
SHA17c9c366dc8ce2fe31fb592b545453a837a3f475f
SHA25655e6a1da7cc8cc5f64155ea14f392fbf8aeb4549b3debd10afd80ff06189d3db
SHA512bc38e6e412f82910034c494b7022be7e2e2b2aeca68b6af664d2f7fada008627f8494d3b8132a8dd8d1293b10538b381b06729cafcbf5ee56f2a52ee1432a1ab
-
Filesize
195B
MD53c39abe84623f99b606a2947a6b0a6b0
SHA1d669b5ec1576d9a7ee430b7511a890cec6365b0f
SHA2568ae3ecc65e2be0df28e0b5a5c45e22ede4fb3f30063aaaf12416f0668cab297a
SHA5128dc45345d5b821c77c07ad69a864b9486b01a0db541a335fe057e51493cc9ed4b1a7dee6b3dcc95b2d4109c206fe47395fecaff446608862060977133ef99175
-
Filesize
195B
MD588a762aad01970e2f1e72a5458782b6f
SHA1d57875d3e9a26e19bf70920f5c9c8337e2c8bb7d
SHA2560715d47c2fb43aaa3097e67e552a2885627681bf39bd0edd42ab6fcaf093198a
SHA5126a4a01975889e9380d301ba5aaee9be048be3425567fbfb9f262e1f9c6956250ad8fb5fb5794353bf41f72c2efb45269279415928e07a855ab7ed3aefe0837fb
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478