Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 02:38
Behavioral task
behavioral1
Sample
JaffaCakes118_8ed3c435a085a49c78c91b1c0dd3a44304aae2bef1a74771961d7fb3eb8cf4d7.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_8ed3c435a085a49c78c91b1c0dd3a44304aae2bef1a74771961d7fb3eb8cf4d7.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_8ed3c435a085a49c78c91b1c0dd3a44304aae2bef1a74771961d7fb3eb8cf4d7.exe
-
Size
1.3MB
-
MD5
0e91f0e752ae2f3a5cf20b889cbea1e7
-
SHA1
289b9baa8dbc9d464eb5a149f95c7f0f52f935ae
-
SHA256
8ed3c435a085a49c78c91b1c0dd3a44304aae2bef1a74771961d7fb3eb8cf4d7
-
SHA512
1a913604da1216c4d0ac31a3df5324799fae4e084bfbf88ecbc361a28cd256b597930089c49e282ee610bec53d4183d952202a40dcc26437a0fcd4dce1a1e6a0
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 30 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5032 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1608 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 396 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4428 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4568 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2184 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1988 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 536 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2820 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1548 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1960 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4452 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1804 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1016 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2216 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4140 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 752 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1684 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2640 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4132 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3992 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3796 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3320 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 704 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2460 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4496 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4624 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4008 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2104 2144 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3856 2144 schtasks.exe 86 -
resource yara_rule behavioral2/files/0x0007000000023c7e-10.dat dcrat behavioral2/memory/2084-13-0x00000000006A0000-0x00000000007B0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2960 powershell.exe 1308 powershell.exe 3012 powershell.exe 5052 powershell.exe 4924 powershell.exe 2752 powershell.exe 3032 powershell.exe 4104 powershell.exe 4572 powershell.exe 4048 powershell.exe 2612 powershell.exe -
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation csrss.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation csrss.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation csrss.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation csrss.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation csrss.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation csrss.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation csrss.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation csrss.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation csrss.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation JaffaCakes118_8ed3c435a085a49c78c91b1c0dd3a44304aae2bef1a74771961d7fb3eb8cf4d7.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation csrss.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation csrss.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation csrss.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation csrss.exe -
Executes dropped EXE 15 IoCs
pid Process 2084 DllCommonsvc.exe 2524 csrss.exe 4852 csrss.exe 1184 csrss.exe 752 csrss.exe 4540 csrss.exe 3968 csrss.exe 4756 csrss.exe 32 csrss.exe 4440 csrss.exe 4836 csrss.exe 4520 csrss.exe 1848 csrss.exe 2104 csrss.exe 756 csrss.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
flow ioc 22 raw.githubusercontent.com 49 raw.githubusercontent.com 52 raw.githubusercontent.com 53 raw.githubusercontent.com 15 raw.githubusercontent.com 37 raw.githubusercontent.com 50 raw.githubusercontent.com 14 raw.githubusercontent.com 42 raw.githubusercontent.com 28 raw.githubusercontent.com 38 raw.githubusercontent.com 41 raw.githubusercontent.com 43 raw.githubusercontent.com 51 raw.githubusercontent.com -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\WindowsPowerShell\RuntimeBroker.exe DllCommonsvc.exe File created C:\Program Files (x86)\WindowsPowerShell\9e8d7a4ca61bd9 DllCommonsvc.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\ShellComponents\csrss.exe DllCommonsvc.exe File created C:\Windows\ShellComponents\886983d96e3d3e DllCommonsvc.exe File created C:\Windows\Fonts\sysmon.exe DllCommonsvc.exe File created C:\Windows\Fonts\121e5b5079f7c0 DllCommonsvc.exe File created C:\Windows\TAPI\dwm.exe DllCommonsvc.exe File created C:\Windows\TAPI\6cb0b6c459d5d3 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_8ed3c435a085a49c78c91b1c0dd3a44304aae2bef1a74771961d7fb3eb8cf4d7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings JaffaCakes118_8ed3c435a085a49c78c91b1c0dd3a44304aae2bef1a74771961d7fb3eb8cf4d7.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings csrss.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings csrss.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings csrss.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings csrss.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings csrss.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings csrss.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings csrss.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings csrss.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings csrss.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings csrss.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings csrss.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings csrss.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings csrss.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4428 schtasks.exe 1960 schtasks.exe 2216 schtasks.exe 4008 schtasks.exe 4496 schtasks.exe 2104 schtasks.exe 5032 schtasks.exe 1988 schtasks.exe 3796 schtasks.exe 2184 schtasks.exe 4452 schtasks.exe 1804 schtasks.exe 1684 schtasks.exe 3320 schtasks.exe 704 schtasks.exe 3856 schtasks.exe 396 schtasks.exe 4140 schtasks.exe 752 schtasks.exe 1548 schtasks.exe 3992 schtasks.exe 2460 schtasks.exe 4132 schtasks.exe 4624 schtasks.exe 4568 schtasks.exe 536 schtasks.exe 2640 schtasks.exe 1608 schtasks.exe 2820 schtasks.exe 1016 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 2084 DllCommonsvc.exe 2084 DllCommonsvc.exe 2084 DllCommonsvc.exe 2084 DllCommonsvc.exe 2084 DllCommonsvc.exe 4572 powershell.exe 4572 powershell.exe 3032 powershell.exe 3032 powershell.exe 4048 powershell.exe 4048 powershell.exe 5052 powershell.exe 5052 powershell.exe 4104 powershell.exe 4104 powershell.exe 2960 powershell.exe 2960 powershell.exe 1308 powershell.exe 1308 powershell.exe 4924 powershell.exe 4924 powershell.exe 3012 powershell.exe 3012 powershell.exe 2612 powershell.exe 2612 powershell.exe 3012 powershell.exe 2752 powershell.exe 2752 powershell.exe 4572 powershell.exe 5052 powershell.exe 4104 powershell.exe 2960 powershell.exe 3032 powershell.exe 4048 powershell.exe 4924 powershell.exe 1308 powershell.exe 2612 powershell.exe 2752 powershell.exe 2524 csrss.exe 4852 csrss.exe 1184 csrss.exe 752 csrss.exe 4540 csrss.exe 3968 csrss.exe 4756 csrss.exe 32 csrss.exe 4440 csrss.exe 4836 csrss.exe 4520 csrss.exe 1848 csrss.exe 2104 csrss.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: SeDebugPrivilege 2084 DllCommonsvc.exe Token: SeDebugPrivilege 4572 powershell.exe Token: SeDebugPrivilege 4104 powershell.exe Token: SeDebugPrivilege 5052 powershell.exe Token: SeDebugPrivilege 3032 powershell.exe Token: SeDebugPrivilege 3012 powershell.exe Token: SeDebugPrivilege 4048 powershell.exe Token: SeDebugPrivilege 2960 powershell.exe Token: SeDebugPrivilege 1308 powershell.exe Token: SeDebugPrivilege 4924 powershell.exe Token: SeDebugPrivilege 2612 powershell.exe Token: SeDebugPrivilege 2752 powershell.exe Token: SeDebugPrivilege 2524 csrss.exe Token: SeDebugPrivilege 4852 csrss.exe Token: SeDebugPrivilege 1184 csrss.exe Token: SeDebugPrivilege 752 csrss.exe Token: SeDebugPrivilege 4540 csrss.exe Token: SeDebugPrivilege 3968 csrss.exe Token: SeDebugPrivilege 4756 csrss.exe Token: SeDebugPrivilege 32 csrss.exe Token: SeDebugPrivilege 4440 csrss.exe Token: SeDebugPrivilege 4836 csrss.exe Token: SeDebugPrivilege 4520 csrss.exe Token: SeDebugPrivilege 1848 csrss.exe Token: SeDebugPrivilege 2104 csrss.exe Token: SeDebugPrivilege 756 csrss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2372 wrote to memory of 3764 2372 JaffaCakes118_8ed3c435a085a49c78c91b1c0dd3a44304aae2bef1a74771961d7fb3eb8cf4d7.exe 82 PID 2372 wrote to memory of 3764 2372 JaffaCakes118_8ed3c435a085a49c78c91b1c0dd3a44304aae2bef1a74771961d7fb3eb8cf4d7.exe 82 PID 2372 wrote to memory of 3764 2372 JaffaCakes118_8ed3c435a085a49c78c91b1c0dd3a44304aae2bef1a74771961d7fb3eb8cf4d7.exe 82 PID 3764 wrote to memory of 372 3764 WScript.exe 83 PID 3764 wrote to memory of 372 3764 WScript.exe 83 PID 3764 wrote to memory of 372 3764 WScript.exe 83 PID 372 wrote to memory of 2084 372 cmd.exe 85 PID 372 wrote to memory of 2084 372 cmd.exe 85 PID 2084 wrote to memory of 2752 2084 DllCommonsvc.exe 117 PID 2084 wrote to memory of 2752 2084 DllCommonsvc.exe 117 PID 2084 wrote to memory of 2960 2084 DllCommonsvc.exe 118 PID 2084 wrote to memory of 2960 2084 DllCommonsvc.exe 118 PID 2084 wrote to memory of 2612 2084 DllCommonsvc.exe 119 PID 2084 wrote to memory of 2612 2084 DllCommonsvc.exe 119 PID 2084 wrote to memory of 3032 2084 DllCommonsvc.exe 120 PID 2084 wrote to memory of 3032 2084 DllCommonsvc.exe 120 PID 2084 wrote to memory of 1308 2084 DllCommonsvc.exe 121 PID 2084 wrote to memory of 1308 2084 DllCommonsvc.exe 121 PID 2084 wrote to memory of 4104 2084 DllCommonsvc.exe 122 PID 2084 wrote to memory of 4104 2084 DllCommonsvc.exe 122 PID 2084 wrote to memory of 4572 2084 DllCommonsvc.exe 123 PID 2084 wrote to memory of 4572 2084 DllCommonsvc.exe 123 PID 2084 wrote to memory of 3012 2084 DllCommonsvc.exe 124 PID 2084 wrote to memory of 3012 2084 DllCommonsvc.exe 124 PID 2084 wrote to memory of 5052 2084 DllCommonsvc.exe 125 PID 2084 wrote to memory of 5052 2084 DllCommonsvc.exe 125 PID 2084 wrote to memory of 4048 2084 DllCommonsvc.exe 126 PID 2084 wrote to memory of 4048 2084 DllCommonsvc.exe 126 PID 2084 wrote to memory of 4924 2084 DllCommonsvc.exe 127 PID 2084 wrote to memory of 4924 2084 DllCommonsvc.exe 127 PID 2084 wrote to memory of 3732 2084 DllCommonsvc.exe 139 PID 2084 wrote to memory of 3732 2084 DllCommonsvc.exe 139 PID 3732 wrote to memory of 1528 3732 cmd.exe 141 PID 3732 wrote to memory of 1528 3732 cmd.exe 141 PID 3732 wrote to memory of 2524 3732 cmd.exe 145 PID 3732 wrote to memory of 2524 3732 cmd.exe 145 PID 2524 wrote to memory of 32 2524 csrss.exe 147 PID 2524 wrote to memory of 32 2524 csrss.exe 147 PID 32 wrote to memory of 2184 32 cmd.exe 149 PID 32 wrote to memory of 2184 32 cmd.exe 149 PID 32 wrote to memory of 4852 32 cmd.exe 152 PID 32 wrote to memory of 4852 32 cmd.exe 152 PID 4852 wrote to memory of 1580 4852 csrss.exe 153 PID 4852 wrote to memory of 1580 4852 csrss.exe 153 PID 1580 wrote to memory of 3140 1580 cmd.exe 155 PID 1580 wrote to memory of 3140 1580 cmd.exe 155 PID 1580 wrote to memory of 1184 1580 cmd.exe 156 PID 1580 wrote to memory of 1184 1580 cmd.exe 156 PID 1184 wrote to memory of 3464 1184 csrss.exe 158 PID 1184 wrote to memory of 3464 1184 csrss.exe 158 PID 3464 wrote to memory of 3540 3464 cmd.exe 160 PID 3464 wrote to memory of 3540 3464 cmd.exe 160 PID 3464 wrote to memory of 752 3464 cmd.exe 162 PID 3464 wrote to memory of 752 3464 cmd.exe 162 PID 752 wrote to memory of 944 752 csrss.exe 163 PID 752 wrote to memory of 944 752 csrss.exe 163 PID 944 wrote to memory of 2620 944 cmd.exe 165 PID 944 wrote to memory of 2620 944 cmd.exe 165 PID 944 wrote to memory of 4540 944 cmd.exe 166 PID 944 wrote to memory of 4540 944 cmd.exe 166 PID 4540 wrote to memory of 2460 4540 csrss.exe 167 PID 4540 wrote to memory of 2460 4540 csrss.exe 167 PID 2460 wrote to memory of 2372 2460 cmd.exe 169 PID 2460 wrote to memory of 2372 2460 cmd.exe 169 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ed3c435a085a49c78c91b1c0dd3a44304aae2bef1a74771961d7fb3eb8cf4d7.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ed3c435a085a49c78c91b1c0dd3a44304aae2bef1a74771961d7fb3eb8cf4d7.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:372 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Fonts\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4104
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4572
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3012
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellComponents\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5052
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4048
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\ssh\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4924
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yKCCmDsefo.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:1528
-
-
C:\Windows\ShellComponents\csrss.exe"C:\Windows\ShellComponents\csrss.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\onYrHPGvDe.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:2184
-
-
C:\Windows\ShellComponents\csrss.exe"C:\Windows\ShellComponents\csrss.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pgCyA6Uc1O.bat"9⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:3140
-
-
C:\Windows\ShellComponents\csrss.exe"C:\Windows\ShellComponents\csrss.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YpMZYQImRp.bat"11⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:3540
-
-
C:\Windows\ShellComponents\csrss.exe"C:\Windows\ShellComponents\csrss.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AMKHlt6LWj.bat"13⤵
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:2620
-
-
C:\Windows\ShellComponents\csrss.exe"C:\Windows\ShellComponents\csrss.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\onYrHPGvDe.bat"15⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:2372
-
-
C:\Windows\ShellComponents\csrss.exe"C:\Windows\ShellComponents\csrss.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3968 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Fb5uY85DH.bat"17⤵PID:4956
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:4380
-
-
C:\Windows\ShellComponents\csrss.exe"C:\Windows\ShellComponents\csrss.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4756 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lg1oIatdTn.bat"19⤵PID:2124
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:412
-
-
C:\Windows\ShellComponents\csrss.exe"C:\Windows\ShellComponents\csrss.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:32 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yWf31kVUUl.bat"21⤵PID:232
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:4364
-
-
C:\Windows\ShellComponents\csrss.exe"C:\Windows\ShellComponents\csrss.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4440 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\I1IMKnnpZ2.bat"23⤵PID:3292
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:3852
-
-
C:\Windows\ShellComponents\csrss.exe"C:\Windows\ShellComponents\csrss.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4836 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4JlC5zfAS6.bat"25⤵PID:3196
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:3032
-
-
C:\Windows\ShellComponents\csrss.exe"C:\Windows\ShellComponents\csrss.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4520 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\I1IMKnnpZ2.bat"27⤵PID:1140
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:228⤵PID:804
-
-
C:\Windows\ShellComponents\csrss.exe"C:\Windows\ShellComponents\csrss.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1848 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0Sh6ipYOoX.bat"29⤵PID:1504
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:230⤵PID:4280
-
-
C:\Windows\ShellComponents\csrss.exe"C:\Windows\ShellComponents\csrss.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uP802u8Cku.bat"31⤵PID:216
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:232⤵PID:612
-
-
C:\Windows\ShellComponents\csrss.exe"C:\Windows\ShellComponents\csrss.exe"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4568
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\WindowsPowerShell\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\providercommon\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1548
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4452
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Windows\Fonts\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\Fonts\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1016
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Windows\Fonts\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\TAPI\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4140
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\TAPI\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:752
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\TAPI\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4132
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3992
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\ShellComponents\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3796
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\ShellComponents\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3320
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\ShellComponents\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:704
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\ssh\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\All Users\ssh\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\ssh\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
201B
MD58222302e8ee41dca39df768d81aaed9f
SHA1bbefdab870aa60d61e02ac95c35cfa854ae674f1
SHA256c424ecfd5c1c556e1d3ad461ca41d70d49151a16af727872ab5c75f74c2f6528
SHA512e0d9dff15efb676a2ea1b1069a448cbbadacab915b27b5ddbb6b1db86b05f05ed6143857635325425af3f5bb710dcfed98b1e1586be3738c72c02a00fa9dc9b5
-
Filesize
201B
MD593b25262a69501a3e2ed65031c678cf4
SHA1a54a2a4ecee20b5bcb6f5f108e47f0d8a90418f7
SHA2567a0237f1334dcbe25c2fd3ee298076d1502a35112563b643736100dd20cc21e9
SHA5122be9fcabf1369dfe6e443f9bd842fdb10cd852c9932dba413fe5f9f01c0fc1a089012fc6b8cf7d447428d28f2e89ba030e811c2070d16ad0fef828bc73e58075
-
Filesize
201B
MD5cb54b3bdd1c7a37b7a2c0215f9e9bf4b
SHA10678c91de3736319f395681fb952a08a321c7503
SHA256e6bafa06ccac598d64fd8c8f049ed3d9dfaaeada14b1468b9b41f202be9e040b
SHA51208fb85e2eba34f39c0713dbe9232d8b61e5fe8eb8644eb5b13d9775b1c13c386c147035bdf4a26ae9c1656628e1cb3706355c33baa703b9bff92a3024bfad912
-
Filesize
201B
MD5a5957450fe1e8f6ba411b6d3b0ea0654
SHA177865c7f41b4ba6020d22ef91a83fe5a7428fe5a
SHA2563e5ee21aef662cce018e7fedebd36627abfe88883208157663b410ff25b48855
SHA512ea34b853fe624b65357ee4b7946c65442413893160a749de8bb4bf9fd29dc6adbb0c42f89adff98b441ead7e1db4a42b1e1b9ba09616a2116e56945757720880
-
Filesize
201B
MD51190a6c7526fe3fccea5c8e645057d38
SHA153e75afc0df08e72e378bfb312f81ee257c0f7f5
SHA256020c8811b552298efa7205d4c4a296a6a3e32515bc2660be92ef0b700e62a502
SHA512076de4e9056e0f57578c5060e5738e1fe37982e36a9f68ad4cb266d1c387eebcd153f4257647bb3c2ba64879f70358755a73112cc4ab57878c1a194bb68c6256
-
Filesize
201B
MD54609f3f4c40f769a1f620f0a92440f11
SHA15007c8400cb0acd386cab35c699aca320b42c51a
SHA256bc68f070ee124832972628c18a6f5ca6d0bbfa6a461e06646072c77e45e492f8
SHA5123bc5f9f58329ae24514a35924b3da8c94598f7cdfdacfaaa35c5fd9ad8c7340e9035186fd6c99b8d8578719990d9887cc5a887c22047646f76ecca738867e319
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
201B
MD56b2f095677130ea865c7ecc0a4b996a1
SHA1ae23e4d6fea9d07eb0631a838a5f76ca9a3d5507
SHA25698b511aefb69362689fb3a885aa61fa9d2841f96255b0e78a70741c7aa159336
SHA512439bab16ab194b7b727ec1d76ce2eb193f09cc33bb3ecba9d2d50b226504adc939bea4cd1b7f9e9ebb7ab7127074089b7f7f8aef5624bbadf91b0c9c4dfebdb0
-
Filesize
201B
MD58ec35756529bf29bf183e2b79b122979
SHA1da5465cc46f1eb0174541f24d0e667db807b2c80
SHA256d7623e08268a21de781169883659dff848d63c1db7631a0f2f8aba0ac63a4ac4
SHA512af9719d92f2c3807623d80e995fe1e2c3335d7550153a70226861aacd31cb1419b326a26257872f77e570733bec1aecfdabba8384cd7907c1ef7851a8b3af30a
-
Filesize
201B
MD5b4bbca7f3b44c40cc745608fec96a1d4
SHA1a1234f735596bc3d284e2336e28ea01404e1daaa
SHA256dedd06186cd8914f7a3703a3194a86ffb48942d2bf265187797df3de815ec802
SHA512965e9a5fbc3efdcb1271659c9cb95be850468d820dc1a0ee4a2ad09bbbfd74cb7a3d5956954f2a05071dfe9c80a90e9c180ad5224f4e47e40873e528d90ab94e
-
Filesize
201B
MD5578fd29b9f521d8193496c1c9e421774
SHA19d3edfb65d8c2444aa19d5f6bc61bba067649218
SHA25639a0af8e04a368765e1dcc9e21637599ae8f841b86e9df943656ac6e76271232
SHA51280787c614e9a9bdf5fd70197ef51cfe3601fef35baadd0f2f577fd7ccfa252292ddd101bd40da01b1eab84c4113bc980b9f35e8b95e4de4f04699e3f2ebc99dc
-
Filesize
201B
MD56e8ebe797a2c07c6bbea358f61d6b047
SHA10698104df4195013085d63a39754d127d7184b02
SHA2560346d2cc3e7d7b11325924bfb315851a83961dc980c7911f4306d42f6c7d35e8
SHA51285f13a81ec8b9ade36d31034d2ce38095011f17d3e4ddeea0634b26e2a48a5186f98ad3e324acf3d1dead167930130008489949f1bb952c9584f01b234f7af57
-
Filesize
201B
MD57c70b8bc6eb8f0673e8461554d5ce948
SHA1cb6eba68933d584dbc22a0ad2667345b6734b130
SHA25619a4c1cff884201b44565a2887c2a1e5891b101f28df16dc199157bff32146f2
SHA51265e58e14d4e89e1e954b1d3d5e71fe8dc2172f1122f6c3b75a001244b4e55d1d0755a54cc635c84049d22968cf8c37a8ac983083263c02562adc35419c806a22
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478