Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 13:05
Behavioral task
behavioral1
Sample
JaffaCakes118_89a8b7765c165c59acd848f57da879077286dd77ec92317345f6746196b21b6e.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_89a8b7765c165c59acd848f57da879077286dd77ec92317345f6746196b21b6e.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_89a8b7765c165c59acd848f57da879077286dd77ec92317345f6746196b21b6e.exe
-
Size
1.3MB
-
MD5
bcb137bb110878a1567a5a649a8e6f8f
-
SHA1
8f902e7206cbeef4433a3bbbf29a78e2d35ec39f
-
SHA256
89a8b7765c165c59acd848f57da879077286dd77ec92317345f6746196b21b6e
-
SHA512
860b9d5bc0a8084ff9e11afc00d6904a14bf9fe2dc62bb1e6a145f4a3053cf07f188b544a59e35907f1dbd6a2257eea4359e44e1f38e7367dc002c2c2fd6d068
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 24 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2736 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3732 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2764 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3560 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4608 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3712 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3172 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1224 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2140 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4044 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3740 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1612 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3844 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2164 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3564 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3212 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2580 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2172 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2484 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1104 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2324 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2176 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3636 4032 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3016 4032 schtasks.exe 87 -
resource yara_rule behavioral2/files/0x0007000000023ca8-10.dat dcrat behavioral2/memory/3412-13-0x0000000000FD0000-0x00000000010E0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1960 powershell.exe 1220 powershell.exe 940 powershell.exe 1552 powershell.exe 1492 powershell.exe 404 powershell.exe 4768 powershell.exe 4452 powershell.exe 452 powershell.exe -
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation wininit.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation wininit.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation wininit.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation wininit.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation wininit.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation wininit.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation wininit.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation wininit.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation wininit.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation wininit.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation JaffaCakes118_89a8b7765c165c59acd848f57da879077286dd77ec92317345f6746196b21b6e.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation wininit.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation wininit.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation wininit.exe -
Executes dropped EXE 14 IoCs
pid Process 3412 DllCommonsvc.exe 2588 wininit.exe 1680 wininit.exe 404 wininit.exe 4812 wininit.exe 1112 wininit.exe 1924 wininit.exe 4900 wininit.exe 4644 wininit.exe 2168 wininit.exe 2552 wininit.exe 4520 wininit.exe 4640 wininit.exe 348 wininit.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
flow ioc 51 raw.githubusercontent.com 52 raw.githubusercontent.com 53 raw.githubusercontent.com 14 raw.githubusercontent.com 38 raw.githubusercontent.com 43 raw.githubusercontent.com 13 raw.githubusercontent.com 19 raw.githubusercontent.com 23 raw.githubusercontent.com 54 raw.githubusercontent.com 50 raw.githubusercontent.com 37 raw.githubusercontent.com 42 raw.githubusercontent.com 49 raw.githubusercontent.com -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Mail\sihost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Mail\66fc9ff0ee96c2 DllCommonsvc.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\dllhost.exe DllCommonsvc.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\5940a34987c991 DllCommonsvc.exe File created C:\Program Files\ModifiableWindowsApps\upfc.exe DllCommonsvc.exe File created C:\Program Files (x86)\MSBuild\explorer.exe DllCommonsvc.exe File opened for modification C:\Program Files (x86)\MSBuild\explorer.exe DllCommonsvc.exe File created C:\Program Files (x86)\MSBuild\7a0fd90576e088 DllCommonsvc.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe DllCommonsvc.exe File created C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\56085415360792 DllCommonsvc.exe File created C:\Windows\ShellExperiences\DllCommonsvc.exe DllCommonsvc.exe File created C:\Windows\ShellExperiences\a76d7bf15d8370 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_89a8b7765c165c59acd848f57da879077286dd77ec92317345f6746196b21b6e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings wininit.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings wininit.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings wininit.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings wininit.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings wininit.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings wininit.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings wininit.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings wininit.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings wininit.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings wininit.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings wininit.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings JaffaCakes118_89a8b7765c165c59acd848f57da879077286dd77ec92317345f6746196b21b6e.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings wininit.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings wininit.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3844 schtasks.exe 2172 schtasks.exe 4044 schtasks.exe 3740 schtasks.exe 3564 schtasks.exe 2580 schtasks.exe 2484 schtasks.exe 2324 schtasks.exe 3636 schtasks.exe 3016 schtasks.exe 3712 schtasks.exe 2764 schtasks.exe 3560 schtasks.exe 4608 schtasks.exe 3172 schtasks.exe 1224 schtasks.exe 2164 schtasks.exe 3732 schtasks.exe 2140 schtasks.exe 1612 schtasks.exe 3212 schtasks.exe 1104 schtasks.exe 2176 schtasks.exe 2736 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 3412 DllCommonsvc.exe 3412 DllCommonsvc.exe 3412 DllCommonsvc.exe 3412 DllCommonsvc.exe 3412 DllCommonsvc.exe 3412 DllCommonsvc.exe 3412 DllCommonsvc.exe 3412 DllCommonsvc.exe 3412 DllCommonsvc.exe 3412 DllCommonsvc.exe 3412 DllCommonsvc.exe 4768 powershell.exe 1220 powershell.exe 1220 powershell.exe 452 powershell.exe 452 powershell.exe 4452 powershell.exe 4452 powershell.exe 940 powershell.exe 940 powershell.exe 1492 powershell.exe 1492 powershell.exe 1552 powershell.exe 1552 powershell.exe 1220 powershell.exe 1960 powershell.exe 1960 powershell.exe 404 powershell.exe 404 powershell.exe 1960 powershell.exe 4768 powershell.exe 4768 powershell.exe 452 powershell.exe 4452 powershell.exe 1492 powershell.exe 940 powershell.exe 404 powershell.exe 1552 powershell.exe 2588 wininit.exe 1680 wininit.exe 404 wininit.exe 4812 wininit.exe 1112 wininit.exe 1924 wininit.exe 4900 wininit.exe 4644 wininit.exe 2168 wininit.exe 2552 wininit.exe 4520 wininit.exe 4640 wininit.exe 348 wininit.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 3412 DllCommonsvc.exe Token: SeDebugPrivilege 4768 powershell.exe Token: SeDebugPrivilege 1220 powershell.exe Token: SeDebugPrivilege 452 powershell.exe Token: SeDebugPrivilege 4452 powershell.exe Token: SeDebugPrivilege 940 powershell.exe Token: SeDebugPrivilege 1492 powershell.exe Token: SeDebugPrivilege 1960 powershell.exe Token: SeDebugPrivilege 1552 powershell.exe Token: SeDebugPrivilege 404 powershell.exe Token: SeDebugPrivilege 2588 wininit.exe Token: SeDebugPrivilege 1680 wininit.exe Token: SeDebugPrivilege 404 wininit.exe Token: SeDebugPrivilege 4812 wininit.exe Token: SeDebugPrivilege 1112 wininit.exe Token: SeDebugPrivilege 1924 wininit.exe Token: SeDebugPrivilege 4900 wininit.exe Token: SeDebugPrivilege 4644 wininit.exe Token: SeDebugPrivilege 2168 wininit.exe Token: SeDebugPrivilege 2552 wininit.exe Token: SeDebugPrivilege 4520 wininit.exe Token: SeDebugPrivilege 4640 wininit.exe Token: SeDebugPrivilege 348 wininit.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4852 wrote to memory of 832 4852 JaffaCakes118_89a8b7765c165c59acd848f57da879077286dd77ec92317345f6746196b21b6e.exe 83 PID 4852 wrote to memory of 832 4852 JaffaCakes118_89a8b7765c165c59acd848f57da879077286dd77ec92317345f6746196b21b6e.exe 83 PID 4852 wrote to memory of 832 4852 JaffaCakes118_89a8b7765c165c59acd848f57da879077286dd77ec92317345f6746196b21b6e.exe 83 PID 832 wrote to memory of 3948 832 WScript.exe 84 PID 832 wrote to memory of 3948 832 WScript.exe 84 PID 832 wrote to memory of 3948 832 WScript.exe 84 PID 3948 wrote to memory of 3412 3948 cmd.exe 86 PID 3948 wrote to memory of 3412 3948 cmd.exe 86 PID 3412 wrote to memory of 404 3412 DllCommonsvc.exe 113 PID 3412 wrote to memory of 404 3412 DllCommonsvc.exe 113 PID 3412 wrote to memory of 4768 3412 DllCommonsvc.exe 114 PID 3412 wrote to memory of 4768 3412 DllCommonsvc.exe 114 PID 3412 wrote to memory of 452 3412 DllCommonsvc.exe 115 PID 3412 wrote to memory of 452 3412 DllCommonsvc.exe 115 PID 3412 wrote to memory of 1492 3412 DllCommonsvc.exe 116 PID 3412 wrote to memory of 1492 3412 DllCommonsvc.exe 116 PID 3412 wrote to memory of 1552 3412 DllCommonsvc.exe 117 PID 3412 wrote to memory of 1552 3412 DllCommonsvc.exe 117 PID 3412 wrote to memory of 4452 3412 DllCommonsvc.exe 118 PID 3412 wrote to memory of 4452 3412 DllCommonsvc.exe 118 PID 3412 wrote to memory of 940 3412 DllCommonsvc.exe 119 PID 3412 wrote to memory of 940 3412 DllCommonsvc.exe 119 PID 3412 wrote to memory of 1220 3412 DllCommonsvc.exe 120 PID 3412 wrote to memory of 1220 3412 DllCommonsvc.exe 120 PID 3412 wrote to memory of 1960 3412 DllCommonsvc.exe 122 PID 3412 wrote to memory of 1960 3412 DllCommonsvc.exe 122 PID 3412 wrote to memory of 2704 3412 DllCommonsvc.exe 131 PID 3412 wrote to memory of 2704 3412 DllCommonsvc.exe 131 PID 2704 wrote to memory of 4160 2704 cmd.exe 133 PID 2704 wrote to memory of 4160 2704 cmd.exe 133 PID 2704 wrote to memory of 2588 2704 cmd.exe 134 PID 2704 wrote to memory of 2588 2704 cmd.exe 134 PID 2588 wrote to memory of 4860 2588 wininit.exe 136 PID 2588 wrote to memory of 4860 2588 wininit.exe 136 PID 4860 wrote to memory of 4184 4860 cmd.exe 138 PID 4860 wrote to memory of 4184 4860 cmd.exe 138 PID 4860 wrote to memory of 1680 4860 cmd.exe 145 PID 4860 wrote to memory of 1680 4860 cmd.exe 145 PID 1680 wrote to memory of 4744 1680 wininit.exe 149 PID 1680 wrote to memory of 4744 1680 wininit.exe 149 PID 4744 wrote to memory of 5068 4744 cmd.exe 152 PID 4744 wrote to memory of 5068 4744 cmd.exe 152 PID 4744 wrote to memory of 404 4744 cmd.exe 156 PID 4744 wrote to memory of 404 4744 cmd.exe 156 PID 404 wrote to memory of 2932 404 wininit.exe 159 PID 404 wrote to memory of 2932 404 wininit.exe 159 PID 2932 wrote to memory of 2116 2932 cmd.exe 162 PID 2932 wrote to memory of 2116 2932 cmd.exe 162 PID 2932 wrote to memory of 4812 2932 cmd.exe 164 PID 2932 wrote to memory of 4812 2932 cmd.exe 164 PID 4812 wrote to memory of 832 4812 wininit.exe 166 PID 4812 wrote to memory of 832 4812 wininit.exe 166 PID 832 wrote to memory of 4224 832 cmd.exe 168 PID 832 wrote to memory of 4224 832 cmd.exe 168 PID 832 wrote to memory of 1112 832 cmd.exe 170 PID 832 wrote to memory of 1112 832 cmd.exe 170 PID 1112 wrote to memory of 3460 1112 wininit.exe 172 PID 1112 wrote to memory of 3460 1112 wininit.exe 172 PID 3460 wrote to memory of 3376 3460 cmd.exe 174 PID 3460 wrote to memory of 3376 3460 cmd.exe 174 PID 3460 wrote to memory of 1924 3460 cmd.exe 176 PID 3460 wrote to memory of 1924 3460 cmd.exe 176 PID 1924 wrote to memory of 2460 1924 wininit.exe 178 PID 1924 wrote to memory of 2460 1924 wininit.exe 178 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_89a8b7765c165c59acd848f57da879077286dd77ec92317345f6746196b21b6e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_89a8b7765c165c59acd848f57da879077286dd77ec92317345f6746196b21b6e.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:404
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:452
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\sihost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1552
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\Framework\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:940
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellExperiences\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1960
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SIudWAHyct.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:4160
-
-
C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\peQnm3nkJb.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:4184
-
-
C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dnlY2uCtHd.bat"9⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:5068
-
-
C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V9nTU0UPEK.bat"11⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:2116
-
-
C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\H7eFR6a9mI.bat"13⤵
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:4224
-
-
C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IJ9EkrtYDM.bat"15⤵
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:3376
-
-
C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2U51WDObLZ.bat"17⤵PID:2460
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:1972
-
-
C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4900 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\M53DwaTFc6.bat"19⤵PID:840
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:2072
-
-
C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4644 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b3FUfZROOv.bat"21⤵PID:4580
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:2928
-
-
C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2168 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ATgAsDsfjz.bat"23⤵PID:3636
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:2580
-
-
C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2552 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\H7eFR6a9mI.bat"25⤵PID:3688
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:2380
-
-
C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4520 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qpvm5o68kg.bat"27⤵PID:2132
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:228⤵PID:4000
-
-
C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4640 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hfpeQ4JfvC.bat"29⤵PID:4900
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:230⤵PID:2020
-
-
C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:348 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R8cJcUuQgj.bat"31⤵PID:4024
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:232⤵PID:2116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3732
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\providercommon\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3560
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3712
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3172
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1224
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Windows\SystemResources\Windows.UI.SettingsAppThreshold\SystemSettings\Assets\Fonts\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Libraries\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3844
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Public\Libraries\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Libraries\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3564
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Music\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\Music\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1104
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Music\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 9 /tr "'C:\Windows\ShellExperiences\DllCommonsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2176
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\Windows\ShellExperiences\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD5e448fe0d240184c6597a31d3be2ced58
SHA1372b8d8c19246d3e38cd3ba123cc0f56070f03cd
SHA256c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391
SHA5120b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4
-
Filesize
240B
MD50d32601c464185c935a1f5b26a814ea1
SHA12d48ee477b6d728719dee2056b9b303c499e97b7
SHA2565f0cf4c7adebceed1f8755207b79501122f722764775e8feaae5c2f4b1db905d
SHA51221f559fe712678c07e1353dccb29102ee018cc104168594f935bbacadef81b5876a98853d1307cd570d0cab3c02bb94f6c678fa351e2ca1d646b53f9cbbc83ab
-
Filesize
263B
MD5d694b308ded76024c53e8a29be3e8111
SHA1d29cec03a1eb24ccef15ef4bc704a47aeeb7ab85
SHA2560970587310727c3aceecb91b75990df060b9c2702f3140ba7f3b6640c3f7a117
SHA512304b86457686268bafa430679f8e1721a791842267cdf341012123afed28cfcaf74e9a38bb1d3612a8b3b13d6a6431194745f1ea617b5f2d16f7463007fa4171
-
Filesize
263B
MD5605ef79481ab3a623454a002c28062cf
SHA17e381a7a07b48afc006fc0d71771e0f23735bce4
SHA2562a4fb2fa5483fa2fbccca4d05e44514239a7f3b89edbf364f0e0a4b02f43c1a8
SHA512ece28ead64d63ec4b3cf272514424420d379adaeace4e54d3a7206fefa86da2f895d35ba881e1f48c20174597ce9bc4b2795911fd08457c6c1244c2a0ac0fc09
-
Filesize
263B
MD5ae9faf0c099bbdaa6626f7eb8b3fc768
SHA1cee5871b3239cbb96e52412b34e2af0f12d1b16f
SHA256353faa848e3fad6a02078a7c8543d5c7019e9653ae9047a51419098f4bc8a57d
SHA512d5f472ee928533ebcc12c8a4514bb42b2b207ad449db2623e9589a67ed634158e80eb1234c9a10a13af9ec61a4713ce3eb4e63a4629d70741fa9220af1306daa
-
Filesize
263B
MD5e0190be8469dad481a0aabd80ca33f26
SHA176b4ea04dc695036aa947f3c3a887a00825acfdd
SHA2565e772834c76eafb0deef2dfc88a6918cdec8f4fbfd3dead79f5865ec2f844675
SHA512cee01ffc7b74fbcc37a181af592ec4842f13b23c1d68dac5b2d09c1491fab406565fc10cb12e02a74740033d4055fa8c6598eb85be8da95fb82d92af74ca3040
-
Filesize
263B
MD5e41bfd235246fb1339351973ff51dc2c
SHA16b01e716e128ffdcdf35dddad79963074617e5d1
SHA2566754b79a23482b496321bff539bc973f94f64ee2d253341af7c9cd9cc9fc0dc4
SHA512b6c323e60157bafe7baca45ee7952f157298338141b8bf1c2a442d56e5cc594ee4a1224a01e1ed4628e049d92b47c5685757ac3544c52f20feefa809c30ba95f
-
Filesize
263B
MD525c3f5f5792fa31f36e2cedcc3dc07c6
SHA1737f91044ea9f534dfea2fb74b3c1bb828997b51
SHA2563d43b3b13c0adc4378d0931a77481ebc076c2bff639c0dbd759d42806b985113
SHA5127ea545f6a3c2b499cee25a7b87719bbfc97ed9cfdbc1a248457686e6030a34df97f7e4d5ff2353a272773f2bcf41915a0aacd55d84f9e4836f61a64ec08ef654
-
Filesize
263B
MD5e7c1934d2757e6cdc51d556c99a512db
SHA19a6c15f42e46bfd7c2f880478676a728fdf31884
SHA256d5e7834a5237b5e07ab4cb08e2d366eec8e11900d6707a575e957262d352d8ef
SHA512faaa071d49748d3d2a34f398fbd1d756ada752abc78ea6e0034819d04dfb8eb3a2871ee0528d7c706e877c2f361585274bfde946823376419cb1b8bb67ae59a8
-
Filesize
263B
MD5b6bee73a5f0f7cd0a2209265a6aa664c
SHA175cdd986d58be3d29ce81fedcf952e8a39e2536d
SHA25630cf500d0bd3a9872d049dd4eb73b4a86a490930b331f87f7e651098edfeff0b
SHA512fd9deca13adb13bef5efdabe3691a00e69827013f89e6a646a129961f05847801a7c79d40382dc1a96fc740698c55c7f997963fe7645dabfa1bd7d68db8e5f97
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
263B
MD5073f2ce94acd8ddedf5465b0ae777f99
SHA1b7de430b7ab1bfa7651795c07a2aa64055bc253d
SHA256194bed981febed19a952b9eabee8fcb0bd9155087ae0f201578e9b02f873c1a8
SHA51261de4ec0adec4b773fc05716199ddc6c2fea808d949927c2e4b350ba78539efb917460ec3635ad9c6c0aa9721d9c2b0cea99bc90c4d8b69a3784e9957e0b9773
-
Filesize
263B
MD58b1e38309295475913470ebefbb5c8a9
SHA14ad428eb5854cebece547c62ae4618fcc13b293a
SHA256eeb120460c091d50027924183b27a71414c5ff79c17d1c57297b8358b2f7f84a
SHA5126a116067943729047530a3b28349c2cb1751fb53830c96137f607c13f2cd66751a8643c2a3dd90037f8e8c859014a38bbcd3a3f09670c2ba94094083dbf7be57
-
Filesize
263B
MD5b97603ccc1264335358b9be348ff22f3
SHA1bb89b3c8d235f06348eaf749fb863b75b9395baa
SHA2561152bbc1e739e34e355f487741a0936dc0ef1f4c13a9cc58566bef2822a77296
SHA512439ebc59e895765521ab4924386368970fc73672e11a36f7b82f42f3755dc7f124c1e5ce2ba0ff6d8b593de10cec399b2008aa6c74dc1bd9650471b8258af763
-
Filesize
263B
MD590b158d6473776134eae01964317e573
SHA1266dd503dfa68bee91f51b6fda2cdf7f4bff8c31
SHA256b4a6430b6a9c0351c672a3025d915fe8194ea3a63f2fefe0e0d9ff262444110e
SHA512dbcb489c613f66487a49ef479ed403728e4711f7a609003a7db06ca5f56fb390b7c1bfe2667ff4266437f20624dc4bbb310934ed2147510a0e562e409d639d82
-
Filesize
263B
MD5d808ce869664a748b060ab56d19334ff
SHA1c88bbded7218cc95251c526908d478460e942974
SHA2569944f071c010c85e9093b21adf8888ada5dcb78cb64d702079b85ad3166e2d27
SHA512c629778483b447635b352572715f290ee9315688cd29dec250c33bbcff5dc6ac8b3a33cdd3c096e31433692e2def6b1abfe12d2af978d9cdf5b71c51ad023bf7
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478