Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 01:49
Behavioral task
behavioral1
Sample
JaffaCakes118_38529abe4880de3780b945a4015d6f8a6da474d300f55e72dcfcdc9765dd9c04.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
JaffaCakes118_38529abe4880de3780b945a4015d6f8a6da474d300f55e72dcfcdc9765dd9c04.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_38529abe4880de3780b945a4015d6f8a6da474d300f55e72dcfcdc9765dd9c04.exe
-
Size
1.3MB
-
MD5
31cd6d1e3ad6e1f663f58cde4001cb19
-
SHA1
e685f9a44bb921e0f4c34338b1a22dd3fd2230b2
-
SHA256
38529abe4880de3780b945a4015d6f8a6da474d300f55e72dcfcdc9765dd9c04
-
SHA512
70cf2ca610f251d94a98f06d358d2a1af31ba01836e7f2761bb1ff2c3b605035966d9c0d312f0575e67e6625f7e36bce3a8b3f1d54c17fcb6d1a16706d29aeca
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 24 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3076 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1616 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4244 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2804 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4588 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1992 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3100 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3156 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4144 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2900 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2436 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1624 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2944 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3152 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2544 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2904 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4028 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3520 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1464 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3236 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3680 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1376 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3272 4328 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3676 4328 schtasks.exe 86 -
resource yara_rule behavioral2/files/0x0007000000023c88-9.dat dcrat behavioral2/memory/5116-13-0x0000000000AB0000-0x0000000000BC0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3976 powershell.exe 4000 powershell.exe 3576 powershell.exe 1300 powershell.exe 1784 powershell.exe 656 powershell.exe 2972 powershell.exe 4992 powershell.exe 4872 powershell.exe -
Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation JaffaCakes118_38529abe4880de3780b945a4015d6f8a6da474d300f55e72dcfcdc9765dd9c04.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation conhost.exe -
Executes dropped EXE 13 IoCs
pid Process 5116 DllCommonsvc.exe 4224 conhost.exe 3324 conhost.exe 4024 conhost.exe 4420 conhost.exe 4348 conhost.exe 2972 conhost.exe 892 conhost.exe 4152 conhost.exe 2764 conhost.exe 4020 conhost.exe 1616 conhost.exe 3164 conhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
flow ioc 13 raw.githubusercontent.com 45 raw.githubusercontent.com 48 raw.githubusercontent.com 49 raw.githubusercontent.com 50 raw.githubusercontent.com 14 raw.githubusercontent.com 29 raw.githubusercontent.com 36 raw.githubusercontent.com 37 raw.githubusercontent.com 41 raw.githubusercontent.com 42 raw.githubusercontent.com 51 raw.githubusercontent.com -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\System\fr-FR\TextInputHost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Common Files\System\fr-FR\22eafd247d37c3 DllCommonsvc.exe File created C:\Program Files\Windows Photo Viewer\it-IT\spoolsv.exe DllCommonsvc.exe File created C:\Program Files\Windows Photo Viewer\it-IT\f3b6ecef712a24 DllCommonsvc.exe File created C:\Program Files\Windows Multimedia Platform\smss.exe DllCommonsvc.exe File created C:\Program Files\Windows Multimedia Platform\69ddcba757bf72 DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\explorer.exe DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\7a0fd90576e088 DllCommonsvc.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\OCR\ja-jp\OfficeClickToRun.exe DllCommonsvc.exe File created C:\Windows\CbsTemp\explorer.exe DllCommonsvc.exe File created C:\Windows\CbsTemp\7a0fd90576e088 DllCommonsvc.exe File created C:\Windows\security\audit\services.exe DllCommonsvc.exe File opened for modification C:\Windows\security\audit\services.exe DllCommonsvc.exe File created C:\Windows\security\audit\c5b4cb5e9653cc DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_38529abe4880de3780b945a4015d6f8a6da474d300f55e72dcfcdc9765dd9c04.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings JaffaCakes118_38529abe4880de3780b945a4015d6f8a6da474d300f55e72dcfcdc9765dd9c04.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings conhost.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings conhost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1616 schtasks.exe 1992 schtasks.exe 3156 schtasks.exe 2900 schtasks.exe 2436 schtasks.exe 1624 schtasks.exe 3236 schtasks.exe 3680 schtasks.exe 3076 schtasks.exe 4244 schtasks.exe 3100 schtasks.exe 2904 schtasks.exe 3520 schtasks.exe 1376 schtasks.exe 4588 schtasks.exe 2544 schtasks.exe 4028 schtasks.exe 1464 schtasks.exe 2804 schtasks.exe 4144 schtasks.exe 2944 schtasks.exe 3152 schtasks.exe 3272 schtasks.exe 3676 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 5116 DllCommonsvc.exe 5116 DllCommonsvc.exe 5116 DllCommonsvc.exe 5116 DllCommonsvc.exe 5116 DllCommonsvc.exe 5116 DllCommonsvc.exe 5116 DllCommonsvc.exe 5116 DllCommonsvc.exe 5116 DllCommonsvc.exe 5116 DllCommonsvc.exe 5116 DllCommonsvc.exe 4992 powershell.exe 4000 powershell.exe 656 powershell.exe 4872 powershell.exe 4872 powershell.exe 1784 powershell.exe 2972 powershell.exe 2972 powershell.exe 3976 powershell.exe 3976 powershell.exe 1300 powershell.exe 1300 powershell.exe 656 powershell.exe 656 powershell.exe 3576 powershell.exe 3576 powershell.exe 4224 conhost.exe 4224 conhost.exe 4000 powershell.exe 4000 powershell.exe 4992 powershell.exe 4992 powershell.exe 4872 powershell.exe 1784 powershell.exe 1784 powershell.exe 1300 powershell.exe 3976 powershell.exe 2972 powershell.exe 3576 powershell.exe 3324 conhost.exe 4024 conhost.exe 4420 conhost.exe 4348 conhost.exe 2972 conhost.exe 892 conhost.exe 4152 conhost.exe 2764 conhost.exe 4020 conhost.exe 1616 conhost.exe 3164 conhost.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 5116 DllCommonsvc.exe Token: SeDebugPrivilege 4992 powershell.exe Token: SeDebugPrivilege 4000 powershell.exe Token: SeDebugPrivilege 656 powershell.exe Token: SeDebugPrivilege 4872 powershell.exe Token: SeDebugPrivilege 1784 powershell.exe Token: SeDebugPrivilege 2972 powershell.exe Token: SeDebugPrivilege 3976 powershell.exe Token: SeDebugPrivilege 1300 powershell.exe Token: SeDebugPrivilege 3576 powershell.exe Token: SeDebugPrivilege 4224 conhost.exe Token: SeDebugPrivilege 3324 conhost.exe Token: SeDebugPrivilege 4024 conhost.exe Token: SeDebugPrivilege 4420 conhost.exe Token: SeDebugPrivilege 4348 conhost.exe Token: SeDebugPrivilege 2972 conhost.exe Token: SeDebugPrivilege 892 conhost.exe Token: SeDebugPrivilege 4152 conhost.exe Token: SeDebugPrivilege 2764 conhost.exe Token: SeDebugPrivilege 4020 conhost.exe Token: SeDebugPrivilege 1616 conhost.exe Token: SeDebugPrivilege 3164 conhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3232 wrote to memory of 1652 3232 JaffaCakes118_38529abe4880de3780b945a4015d6f8a6da474d300f55e72dcfcdc9765dd9c04.exe 82 PID 3232 wrote to memory of 1652 3232 JaffaCakes118_38529abe4880de3780b945a4015d6f8a6da474d300f55e72dcfcdc9765dd9c04.exe 82 PID 3232 wrote to memory of 1652 3232 JaffaCakes118_38529abe4880de3780b945a4015d6f8a6da474d300f55e72dcfcdc9765dd9c04.exe 82 PID 1652 wrote to memory of 2248 1652 WScript.exe 83 PID 1652 wrote to memory of 2248 1652 WScript.exe 83 PID 1652 wrote to memory of 2248 1652 WScript.exe 83 PID 2248 wrote to memory of 5116 2248 cmd.exe 85 PID 2248 wrote to memory of 5116 2248 cmd.exe 85 PID 5116 wrote to memory of 3576 5116 DllCommonsvc.exe 111 PID 5116 wrote to memory of 3576 5116 DllCommonsvc.exe 111 PID 5116 wrote to memory of 4000 5116 DllCommonsvc.exe 112 PID 5116 wrote to memory of 4000 5116 DllCommonsvc.exe 112 PID 5116 wrote to memory of 2972 5116 DllCommonsvc.exe 113 PID 5116 wrote to memory of 2972 5116 DllCommonsvc.exe 113 PID 5116 wrote to memory of 3976 5116 DllCommonsvc.exe 114 PID 5116 wrote to memory of 3976 5116 DllCommonsvc.exe 114 PID 5116 wrote to memory of 656 5116 DllCommonsvc.exe 115 PID 5116 wrote to memory of 656 5116 DllCommonsvc.exe 115 PID 5116 wrote to memory of 1784 5116 DllCommonsvc.exe 117 PID 5116 wrote to memory of 1784 5116 DllCommonsvc.exe 117 PID 5116 wrote to memory of 4872 5116 DllCommonsvc.exe 118 PID 5116 wrote to memory of 4872 5116 DllCommonsvc.exe 118 PID 5116 wrote to memory of 4992 5116 DllCommonsvc.exe 120 PID 5116 wrote to memory of 4992 5116 DllCommonsvc.exe 120 PID 5116 wrote to memory of 1300 5116 DllCommonsvc.exe 121 PID 5116 wrote to memory of 1300 5116 DllCommonsvc.exe 121 PID 5116 wrote to memory of 4224 5116 DllCommonsvc.exe 129 PID 5116 wrote to memory of 4224 5116 DllCommonsvc.exe 129 PID 4224 wrote to memory of 4644 4224 conhost.exe 130 PID 4224 wrote to memory of 4644 4224 conhost.exe 130 PID 4644 wrote to memory of 4148 4644 cmd.exe 132 PID 4644 wrote to memory of 4148 4644 cmd.exe 132 PID 4644 wrote to memory of 3324 4644 cmd.exe 137 PID 4644 wrote to memory of 3324 4644 cmd.exe 137 PID 3324 wrote to memory of 336 3324 conhost.exe 141 PID 3324 wrote to memory of 336 3324 conhost.exe 141 PID 336 wrote to memory of 4976 336 cmd.exe 143 PID 336 wrote to memory of 4976 336 cmd.exe 143 PID 336 wrote to memory of 4024 336 cmd.exe 145 PID 336 wrote to memory of 4024 336 cmd.exe 145 PID 4024 wrote to memory of 2796 4024 conhost.exe 146 PID 4024 wrote to memory of 2796 4024 conhost.exe 146 PID 2796 wrote to memory of 2996 2796 cmd.exe 148 PID 2796 wrote to memory of 2996 2796 cmd.exe 148 PID 2796 wrote to memory of 4420 2796 cmd.exe 149 PID 2796 wrote to memory of 4420 2796 cmd.exe 149 PID 4420 wrote to memory of 948 4420 conhost.exe 150 PID 4420 wrote to memory of 948 4420 conhost.exe 150 PID 948 wrote to memory of 3100 948 cmd.exe 152 PID 948 wrote to memory of 3100 948 cmd.exe 152 PID 948 wrote to memory of 4348 948 cmd.exe 153 PID 948 wrote to memory of 4348 948 cmd.exe 153 PID 4348 wrote to memory of 4652 4348 conhost.exe 154 PID 4348 wrote to memory of 4652 4348 conhost.exe 154 PID 4652 wrote to memory of 548 4652 cmd.exe 156 PID 4652 wrote to memory of 548 4652 cmd.exe 156 PID 4652 wrote to memory of 2972 4652 cmd.exe 157 PID 4652 wrote to memory of 2972 4652 cmd.exe 157 PID 2972 wrote to memory of 2060 2972 conhost.exe 158 PID 2972 wrote to memory of 2060 2972 conhost.exe 158 PID 2060 wrote to memory of 3632 2060 cmd.exe 160 PID 2060 wrote to memory of 3632 2060 cmd.exe 160 PID 2060 wrote to memory of 892 2060 cmd.exe 161 PID 2060 wrote to memory of 892 2060 cmd.exe 161 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_38529abe4880de3780b945a4015d6f8a6da474d300f55e72dcfcdc9765dd9c04.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_38529abe4880de3780b945a4015d6f8a6da474d300f55e72dcfcdc9765dd9c04.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3576
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\audit\services.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4000
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\RedistList\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2972
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\System\fr-FR\TextInputHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3976
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\it-IT\spoolsv.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:656
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4872
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1300
-
-
C:\providercommon\conhost.exe"C:\providercommon\conhost.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jFXOGCU6Cq.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:4148
-
-
C:\providercommon\conhost.exe"C:\providercommon\conhost.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KYEunsIO9t.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:4976
-
-
C:\providercommon\conhost.exe"C:\providercommon\conhost.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7hZg3igX7v.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:2996
-
-
C:\providercommon\conhost.exe"C:\providercommon\conhost.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HcCr6nEVp7.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:3100
-
-
C:\providercommon\conhost.exe"C:\providercommon\conhost.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QUR8LTwG0H.bat"14⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:548
-
-
C:\providercommon\conhost.exe"C:\providercommon\conhost.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tpXWVAFTZv.bat"16⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:3632
-
-
C:\providercommon\conhost.exe"C:\providercommon\conhost.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:892 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YKuCD7w8Ue.bat"18⤵PID:4028
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:3724
-
-
C:\providercommon\conhost.exe"C:\providercommon\conhost.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4152 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oxTQ808hvM.bat"20⤵PID:3380
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:4876
-
-
C:\providercommon\conhost.exe"C:\providercommon\conhost.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m1RNSv4oba.bat"22⤵PID:540
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:3644
-
-
C:\providercommon\conhost.exe"C:\providercommon\conhost.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4020 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9minE9DcLk.bat"24⤵PID:5068
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:536
-
-
C:\providercommon\conhost.exe"C:\providercommon\conhost.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tpXWVAFTZv.bat"26⤵PID:4032
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:1016
-
-
C:\providercommon\conhost.exe"C:\providercommon\conhost.exe"27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3164
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\security\audit\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3076
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\security\audit\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Windows\security\audit\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4244
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4588
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\System\fr-FR\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3100
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System\fr-FR\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3156
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\System\fr-FR\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4144
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\it-IT\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\it-IT\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\it-IT\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Multimedia Platform\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3152
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Multimedia Platform\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\providercommon\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Windows\CbsTemp\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\CbsTemp\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3236
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Windows\CbsTemp\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3680
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1376
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3676
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
194B
MD5270162444fdc5e4dc7a952c9cde14e08
SHA166cbe2c029a20e1dc6f4e89a7d739648a6b4fc53
SHA25643255271a31471dbef19f9405fb16398113ba115ffae1b66dd9a45dccbde31ff
SHA5124be304e7f3322a7088ede2a2401b101b355458d0d34368e2302c4c72b564a9d8bd51e900b3aa72927ea7c9d87fc116e310b31488119a65d3928f2621295e6d6f
-
Filesize
194B
MD5286c235ba7d5a29c868b6856173d38e6
SHA1bb2230127f6a1e571675e82e28017ca3ef1de8da
SHA25634a3f5a74f122d92897509e9fbd49936a252799938dc07bc02fb7d2dd4626091
SHA512dbafa17cca1b91b5253b23d007044f9af826b804955f0f927b71c29bcef1e250b4330378d01168a64dee7f3f3f2c733b0d168f4eff858cad802163c9fe331081
-
Filesize
194B
MD52ce6fe662832cdddcbbdff44646414f8
SHA1d6f427689a6ba957bc1ce9318d6b76a9241dab07
SHA2565cb36ddbab6d9a2a6168164675e507438c053f732d1340c451c8b9dfc6099612
SHA51292d59d853898b7bfaeda3194221439fc0f3068c25d7145adb894e06d3af6275c09c0357beb45575ced9695c9c6560354863ba99f398b34a7a55e467352d6cdc0
-
Filesize
194B
MD51a3d939ba875788b3431eb0faeca2d14
SHA1b50668667fd84d02a0533f658e3650dba92c2fe1
SHA256a007b2ad26e815356dcd48375eb211327a33aa80880b6fafc6f7f41a07d5e8db
SHA512d772fec4819e34f0e3fccaedf2ae45f18201b52018358d5ff3794aac7b8b57fbbe59a8894b958092986eabfaa991b2d9e777c679f044a882593cf325c1816063
-
Filesize
194B
MD5279ad3a80809c8181ed38dc009eb1302
SHA17ac6aa57f3e91e5898beb0dc2d2fbed2e99d1d25
SHA256bc526d51eb6d14806a6a0cb2e73b025fe2f4f3af15695ba42b96cc3a334ad273
SHA5120e8568a08c00f1ffb192643b4617419983edaa3585d71202e982cdf6e7ffbd9d1098253b4430898052c0f4bacdb1c232f680d39c64f09047ff3256890741a7d7
-
Filesize
194B
MD5980d79a212b8efcc13ae73aa20079ce7
SHA1d6bdc0b686d0a38ef435db1e059285779f76ff4f
SHA25683abf9d29084236a0bd7e3119dfd9ca811f44fc3ebab42af53c8fd52a4e61b7d
SHA5124250f38a256895da99858575cf21e2680b846d8dcf3e79af9d879b535a47f66a277dc8b5d39738658542a006a33e7847773e92782e6b3f762a95c41c5b9e16f2
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
194B
MD5ae384fb1482269377812c3e1882b2cb1
SHA10577182c38e2b1c9ee27a9fde67678d30d6cbc75
SHA256cc7c052f4ee57918058d69dbf0212bdacef0f2decf41aebd4a8fb2dd0b253eaf
SHA512849885aebbf0e521b2b1fa6b35478bfeac77ad58ce7e19a74640fb0e47afea735fa7c459fefcdd193fcfcadccd9074f043ca27ba4f77422af3c4f1990985fd2c
-
Filesize
194B
MD516c6331c595996aa5dad7afafca4931b
SHA1d96e8c86859d2e5096d3456e307f120b26aed0f6
SHA25658407d15ca525e5d0152a101f422df4004efe8635d62e2cf6b56792fba1e874c
SHA512ffc74b170132486cb062e86b241cfe110e0eac1a08770ebb81dcc0c61b182296223d8fa95304aa09dfbb3cf036c94150e0f9e2ea78c9218453e8b01bf4d861c1
-
Filesize
194B
MD5ab3a016fe579f0fa0fc91cb3dae5d0f5
SHA1f86899db7fe2183c02ed1d2f8878de0c4c4a9b87
SHA2561b7074ac3d537e9bccdfb70e08f1209012c0f503e2b2688e6092cf4a4110dd58
SHA512ea7c513853298186ad5f0896689b3b88357b0ea180927187449696003764a8a77f4b8d257861c8aa6e21e6af574601cbc95a6292868ae8ec7d794681f50705a3
-
Filesize
194B
MD54227dae00cead819ccd068d52feed121
SHA16cf220ad3b4f5fa989f0a7d2039fb16efab9e154
SHA256c6441d4a49cd406d71dcb17687cc6cdef61c17053177dfa49008548110293389
SHA51230cc362b897d2c9c330d5a4e786ee387e7ab74f56f9ca7187af22220da3836b6dc0254aa9228ff3c2e98b79ba38e49c338a2cf4ef0d2d8dcf3d1ef887e2e2f2a
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478