Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 02:02
Behavioral task
behavioral1
Sample
JaffaCakes118_30cb004eae1bdb1d9613d1586c363bef8d1c4f3fc926812d2de2ec6325707367.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_30cb004eae1bdb1d9613d1586c363bef8d1c4f3fc926812d2de2ec6325707367.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_30cb004eae1bdb1d9613d1586c363bef8d1c4f3fc926812d2de2ec6325707367.exe
-
Size
1.3MB
-
MD5
9d6a6c835223becab287987d7c1aae59
-
SHA1
f2428e81d4d2a67fb5de23ca65a45254a0e6acc8
-
SHA256
30cb004eae1bdb1d9613d1586c363bef8d1c4f3fc926812d2de2ec6325707367
-
SHA512
bfc8861b5b4cdc2facca5b0564bd7a07ed827b6b0d1584c31036e59254d48b51bc6d9ed21183895f902d77e7bb5e57692ba645ed6d95cea67709e6e0722fd1ff
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 30 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4360 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5036 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3032 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2268 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1020 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1596 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2240 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4132 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2108 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2308 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3024 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4060 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1736 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1884 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4048 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2316 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2940 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2236 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 628 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2692 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 860 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4972 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2616 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3216 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2860 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3436 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4964 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4412 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 424 1340 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1692 1340 schtasks.exe 86 -
resource yara_rule behavioral2/files/0x000a000000023b8a-10.dat dcrat behavioral2/memory/4516-13-0x0000000000660000-0x0000000000770000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4544 powershell.exe 5100 powershell.exe 3596 powershell.exe 3976 powershell.exe 4140 powershell.exe 4420 powershell.exe 5096 powershell.exe 4564 powershell.exe 2392 powershell.exe 1168 powershell.exe 3668 powershell.exe -
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation JaffaCakes118_30cb004eae1bdb1d9613d1586c363bef8d1c4f3fc926812d2de2ec6325707367.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation OfficeClickToRun.exe -
Executes dropped EXE 13 IoCs
pid Process 4516 DllCommonsvc.exe 4880 OfficeClickToRun.exe 112 OfficeClickToRun.exe 4520 OfficeClickToRun.exe 4452 OfficeClickToRun.exe 2720 OfficeClickToRun.exe 3896 OfficeClickToRun.exe 3224 OfficeClickToRun.exe 1368 OfficeClickToRun.exe 996 OfficeClickToRun.exe 1692 OfficeClickToRun.exe 1312 OfficeClickToRun.exe 4792 OfficeClickToRun.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
flow ioc 50 raw.githubusercontent.com 52 raw.githubusercontent.com 19 raw.githubusercontent.com 22 raw.githubusercontent.com 42 raw.githubusercontent.com 49 raw.githubusercontent.com 48 raw.githubusercontent.com 51 raw.githubusercontent.com 53 raw.githubusercontent.com 20 raw.githubusercontent.com 36 raw.githubusercontent.com 37 raw.githubusercontent.com 41 raw.githubusercontent.com -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\es-ES\winlogon.exe DllCommonsvc.exe -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\sihost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\66fc9ff0ee96c2 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Defender\es-ES\9e8d7a4ca61bd9 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\sysmon.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\121e5b5079f7c0 DllCommonsvc.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\Globalization\ICU\6203df4a6bafc7 DllCommonsvc.exe File created C:\Windows\security\fontdrvhost.exe DllCommonsvc.exe File created C:\Windows\security\5b884080fd4f94 DllCommonsvc.exe File created C:\Windows\Sun\Java\OfficeClickToRun.exe DllCommonsvc.exe File created C:\Windows\Sun\Java\e6c9b481da804f DllCommonsvc.exe File created C:\Windows\Globalization\ICU\lsass.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_30cb004eae1bdb1d9613d1586c363bef8d1c4f3fc926812d2de2ec6325707367.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings JaffaCakes118_30cb004eae1bdb1d9613d1586c363bef8d1c4f3fc926812d2de2ec6325707367.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings OfficeClickToRun.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2108 schtasks.exe 4060 schtasks.exe 4964 schtasks.exe 2240 schtasks.exe 4048 schtasks.exe 2692 schtasks.exe 2616 schtasks.exe 2268 schtasks.exe 3024 schtasks.exe 1884 schtasks.exe 2236 schtasks.exe 5036 schtasks.exe 2860 schtasks.exe 4360 schtasks.exe 628 schtasks.exe 4972 schtasks.exe 1692 schtasks.exe 1596 schtasks.exe 4132 schtasks.exe 860 schtasks.exe 3216 schtasks.exe 1020 schtasks.exe 2308 schtasks.exe 2316 schtasks.exe 4412 schtasks.exe 3032 schtasks.exe 1736 schtasks.exe 2940 schtasks.exe 3436 schtasks.exe 424 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 4516 DllCommonsvc.exe 4516 DllCommonsvc.exe 4516 DllCommonsvc.exe 4516 DllCommonsvc.exe 4516 DllCommonsvc.exe 3668 powershell.exe 3668 powershell.exe 4140 powershell.exe 4140 powershell.exe 3596 powershell.exe 3596 powershell.exe 4544 powershell.exe 4544 powershell.exe 4420 powershell.exe 4420 powershell.exe 5096 powershell.exe 5096 powershell.exe 5100 powershell.exe 5100 powershell.exe 3976 powershell.exe 3976 powershell.exe 2392 powershell.exe 2392 powershell.exe 1168 powershell.exe 1168 powershell.exe 4564 powershell.exe 4564 powershell.exe 5100 powershell.exe 1168 powershell.exe 4880 OfficeClickToRun.exe 4880 OfficeClickToRun.exe 4564 powershell.exe 5096 powershell.exe 3596 powershell.exe 4544 powershell.exe 4140 powershell.exe 4420 powershell.exe 3668 powershell.exe 2392 powershell.exe 3976 powershell.exe 112 OfficeClickToRun.exe 4520 OfficeClickToRun.exe 4452 OfficeClickToRun.exe 2720 OfficeClickToRun.exe 3896 OfficeClickToRun.exe 3224 OfficeClickToRun.exe 1368 OfficeClickToRun.exe 996 OfficeClickToRun.exe 1692 OfficeClickToRun.exe 1312 OfficeClickToRun.exe 4792 OfficeClickToRun.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 4516 DllCommonsvc.exe Token: SeDebugPrivilege 5096 powershell.exe Token: SeDebugPrivilege 4140 powershell.exe Token: SeDebugPrivilege 3668 powershell.exe Token: SeDebugPrivilege 3596 powershell.exe Token: SeDebugPrivilege 4544 powershell.exe Token: SeDebugPrivilege 4420 powershell.exe Token: SeDebugPrivilege 1168 powershell.exe Token: SeDebugPrivilege 5100 powershell.exe Token: SeDebugPrivilege 3976 powershell.exe Token: SeDebugPrivilege 4880 OfficeClickToRun.exe Token: SeDebugPrivilege 2392 powershell.exe Token: SeDebugPrivilege 4564 powershell.exe Token: SeDebugPrivilege 112 OfficeClickToRun.exe Token: SeDebugPrivilege 4520 OfficeClickToRun.exe Token: SeDebugPrivilege 4452 OfficeClickToRun.exe Token: SeDebugPrivilege 2720 OfficeClickToRun.exe Token: SeDebugPrivilege 3896 OfficeClickToRun.exe Token: SeDebugPrivilege 3224 OfficeClickToRun.exe Token: SeDebugPrivilege 1368 OfficeClickToRun.exe Token: SeDebugPrivilege 996 OfficeClickToRun.exe Token: SeDebugPrivilege 1692 OfficeClickToRun.exe Token: SeDebugPrivilege 1312 OfficeClickToRun.exe Token: SeDebugPrivilege 4792 OfficeClickToRun.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3336 wrote to memory of 1788 3336 JaffaCakes118_30cb004eae1bdb1d9613d1586c363bef8d1c4f3fc926812d2de2ec6325707367.exe 82 PID 3336 wrote to memory of 1788 3336 JaffaCakes118_30cb004eae1bdb1d9613d1586c363bef8d1c4f3fc926812d2de2ec6325707367.exe 82 PID 3336 wrote to memory of 1788 3336 JaffaCakes118_30cb004eae1bdb1d9613d1586c363bef8d1c4f3fc926812d2de2ec6325707367.exe 82 PID 1788 wrote to memory of 2980 1788 WScript.exe 87 PID 1788 wrote to memory of 2980 1788 WScript.exe 87 PID 1788 wrote to memory of 2980 1788 WScript.exe 87 PID 2980 wrote to memory of 4516 2980 cmd.exe 89 PID 2980 wrote to memory of 4516 2980 cmd.exe 89 PID 4516 wrote to memory of 4564 4516 DllCommonsvc.exe 120 PID 4516 wrote to memory of 4564 4516 DllCommonsvc.exe 120 PID 4516 wrote to memory of 4544 4516 DllCommonsvc.exe 121 PID 4516 wrote to memory of 4544 4516 DllCommonsvc.exe 121 PID 4516 wrote to memory of 5100 4516 DllCommonsvc.exe 122 PID 4516 wrote to memory of 5100 4516 DllCommonsvc.exe 122 PID 4516 wrote to memory of 3668 4516 DllCommonsvc.exe 123 PID 4516 wrote to memory of 3668 4516 DllCommonsvc.exe 123 PID 4516 wrote to memory of 3596 4516 DllCommonsvc.exe 124 PID 4516 wrote to memory of 3596 4516 DllCommonsvc.exe 124 PID 4516 wrote to memory of 3976 4516 DllCommonsvc.exe 125 PID 4516 wrote to memory of 3976 4516 DllCommonsvc.exe 125 PID 4516 wrote to memory of 1168 4516 DllCommonsvc.exe 126 PID 4516 wrote to memory of 1168 4516 DllCommonsvc.exe 126 PID 4516 wrote to memory of 4140 4516 DllCommonsvc.exe 127 PID 4516 wrote to memory of 4140 4516 DllCommonsvc.exe 127 PID 4516 wrote to memory of 4420 4516 DllCommonsvc.exe 128 PID 4516 wrote to memory of 4420 4516 DllCommonsvc.exe 128 PID 4516 wrote to memory of 5096 4516 DllCommonsvc.exe 129 PID 4516 wrote to memory of 5096 4516 DllCommonsvc.exe 129 PID 4516 wrote to memory of 2392 4516 DllCommonsvc.exe 130 PID 4516 wrote to memory of 2392 4516 DllCommonsvc.exe 130 PID 4516 wrote to memory of 4880 4516 DllCommonsvc.exe 141 PID 4516 wrote to memory of 4880 4516 DllCommonsvc.exe 141 PID 4880 wrote to memory of 3024 4880 OfficeClickToRun.exe 146 PID 4880 wrote to memory of 3024 4880 OfficeClickToRun.exe 146 PID 3024 wrote to memory of 1104 3024 cmd.exe 148 PID 3024 wrote to memory of 1104 3024 cmd.exe 148 PID 3024 wrote to memory of 112 3024 cmd.exe 149 PID 3024 wrote to memory of 112 3024 cmd.exe 149 PID 112 wrote to memory of 1624 112 OfficeClickToRun.exe 150 PID 112 wrote to memory of 1624 112 OfficeClickToRun.exe 150 PID 1624 wrote to memory of 2108 1624 cmd.exe 152 PID 1624 wrote to memory of 2108 1624 cmd.exe 152 PID 1624 wrote to memory of 4520 1624 cmd.exe 155 PID 1624 wrote to memory of 4520 1624 cmd.exe 155 PID 4520 wrote to memory of 4572 4520 OfficeClickToRun.exe 156 PID 4520 wrote to memory of 4572 4520 OfficeClickToRun.exe 156 PID 4572 wrote to memory of 2768 4572 cmd.exe 158 PID 4572 wrote to memory of 2768 4572 cmd.exe 158 PID 4572 wrote to memory of 4452 4572 cmd.exe 159 PID 4572 wrote to memory of 4452 4572 cmd.exe 159 PID 4452 wrote to memory of 1952 4452 OfficeClickToRun.exe 160 PID 4452 wrote to memory of 1952 4452 OfficeClickToRun.exe 160 PID 1952 wrote to memory of 2688 1952 cmd.exe 162 PID 1952 wrote to memory of 2688 1952 cmd.exe 162 PID 1952 wrote to memory of 2720 1952 cmd.exe 163 PID 1952 wrote to memory of 2720 1952 cmd.exe 163 PID 2720 wrote to memory of 4160 2720 OfficeClickToRun.exe 164 PID 2720 wrote to memory of 4160 2720 OfficeClickToRun.exe 164 PID 4160 wrote to memory of 760 4160 cmd.exe 166 PID 4160 wrote to memory of 760 4160 cmd.exe 166 PID 4160 wrote to memory of 3896 4160 cmd.exe 167 PID 4160 wrote to memory of 3896 4160 cmd.exe 167 PID 3896 wrote to memory of 1112 3896 OfficeClickToRun.exe 168 PID 3896 wrote to memory of 1112 3896 OfficeClickToRun.exe 168 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_30cb004eae1bdb1d9613d1586c363bef8d1c4f3fc926812d2de2ec6325707367.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_30cb004eae1bdb1d9613d1586c363bef8d1c4f3fc926812d2de2ec6325707367.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4564
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4544
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\wininit.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Globalization\ICU\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3596
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\upfc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3976
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Sun\Java\OfficeClickToRun.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1168
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4140
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4420
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\sihost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2392
-
-
C:\Windows\Sun\Java\OfficeClickToRun.exe"C:\Windows\Sun\Java\OfficeClickToRun.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\E3sOpJujjE.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:1104
-
-
C:\Windows\Sun\Java\OfficeClickToRun.exe"C:\Windows\Sun\Java\OfficeClickToRun.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0LMDaVm4bI.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:2108
-
-
C:\Windows\Sun\Java\OfficeClickToRun.exe"C:\Windows\Sun\Java\OfficeClickToRun.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\64IFTJQeKo.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:2768
-
-
C:\Windows\Sun\Java\OfficeClickToRun.exe"C:\Windows\Sun\Java\OfficeClickToRun.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\79RMekxjZd.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:2688
-
-
C:\Windows\Sun\Java\OfficeClickToRun.exe"C:\Windows\Sun\Java\OfficeClickToRun.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sNl5EWIzDs.bat"14⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:760
-
-
C:\Windows\Sun\Java\OfficeClickToRun.exe"C:\Windows\Sun\Java\OfficeClickToRun.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wNwF62sylT.bat"16⤵PID:1112
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:1040
-
-
C:\Windows\Sun\Java\OfficeClickToRun.exe"C:\Windows\Sun\Java\OfficeClickToRun.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3224 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cYhs0sn2L6.bat"18⤵PID:2540
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:4712
-
-
C:\Windows\Sun\Java\OfficeClickToRun.exe"C:\Windows\Sun\Java\OfficeClickToRun.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1368 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\79RMekxjZd.bat"20⤵PID:1476
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:3156
-
-
C:\Windows\Sun\Java\OfficeClickToRun.exe"C:\Windows\Sun\Java\OfficeClickToRun.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:996 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0LMDaVm4bI.bat"22⤵PID:4900
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:1456
-
-
C:\Windows\Sun\Java\OfficeClickToRun.exe"C:\Windows\Sun\Java\OfficeClickToRun.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1692 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yJyIm7wr5G.bat"24⤵PID:3596
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:4468
-
-
C:\Windows\Sun\Java\OfficeClickToRun.exe"C:\Windows\Sun\Java\OfficeClickToRun.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1312 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oVhzrLBDaJ.bat"26⤵PID:3196
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:1236
-
-
C:\Windows\Sun\Java\OfficeClickToRun.exe"C:\Windows\Sun\Java\OfficeClickToRun.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4792 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\da4noHdFs8.bat"28⤵PID:1064
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:3316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Videos\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4360
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\Videos\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Videos\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1020
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1596
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\Globalization\ICU\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Globalization\ICU\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4132
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\Globalization\ICU\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Windows\security\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\security\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Windows\security\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\providercommon\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Windows\Sun\Java\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\Sun\Java\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Windows\Sun\Java\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:628
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:860
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4972
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:424
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
205B
MD546874f4fd2d3c07a7fbf56b35298b93d
SHA1e46cf99d8e07aa634d4241c7c0bb6677279cbee7
SHA256ab2b66296cb0c361eb8b82d9840860c341e404b443fae7595e171cb01103f048
SHA51263a7167a358158fa29ca178625b6ea756ea87a988bc43e1a6d5f863b03a53c4a01e9bc320b3409758c1e9137d9851a6ad7129cd0b3e60c344fc968afe6f56690
-
Filesize
205B
MD5c7efe4cc74860af20e4bf37ccc826867
SHA11bcd24a232b515352bfa855e9e7c10e72903d02a
SHA256139386b87430d464b4cdb66b49f198e8bf813bde30e6d859366b229866ef2a50
SHA5124fd1f27145b7b7002ebaa3ec174f8ff93d759be41b651df827910048a3ac7ed78f88607dce0a2221a80569f2695e44a197a7750e86ac1eae97ca2a60905e0bad
-
Filesize
205B
MD5f92b67352648a08505778d247f5eaf21
SHA10778f02e60fbe8ee14d6fec689a1225063d3bc09
SHA256f068af212123e3e9d0956d530de67343ff5287410a0834afddca0ee41a341768
SHA5122f4c5edc60d37ff76a31f12b15c961f0325a259ac4c5421f99f5a393092d761f0f82e9c14825feb3c69d14940b0ded756137a893dd1bd413a08e1a8038936c4a
-
Filesize
205B
MD5bf211b04ff2e9960362afdf1ba899a82
SHA1d6fad029c3126bc29845120f5c144d9bc01a9e5d
SHA256bab87dee53d1131bf290b2a5a1641e0647e54b70bebd9221923bb2ede450040f
SHA51249d36a8893875536a52e1a67e238d5c7990471edd5c964c74d3b545d1450fcc03da7823acb3b01ba90209b3480aced649c8710305ce21f9f4d63bfadc4664931
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
205B
MD5f44ecc9646fb7dc76ff7de10f81cfeae
SHA1e51df951349176dc0bdf990b0879f7a7dce34deb
SHA2566d00c06848064e7bd89252bf867fc357898ab5540707c7b812667ba944c5f07c
SHA512f00ed2e04132dc624478d0d8f901fa32a5816f6ae42ed9b414175590a6e61cb5b03d369810c1b40e766fdf0a05c2663cf092b49343c383f56a2dc078fef2ce59
-
Filesize
205B
MD56eba6f9c7ac51edcbad49d9d70a35f3f
SHA12653cb12df6086762fb6f5ccdba13e45a1b3912e
SHA256a6cfa422d900a399921758d358ebf9019daf06cd7acc2ef0942be806221064f5
SHA51215329d0a5b19d55ca8d7324f966115064c9d19b7f8e7afef76672b790e01fde3b08d3310b1da612db3070ff7176208daafbccca62669d17aaf76e860b562c29c
-
Filesize
205B
MD5ac82df82e4d1ecf472f741c9f8bb8263
SHA1780f755dbce1ee2512c17013dde8715c835379cc
SHA2562aa8556205d6cedb26fe22a293e7f70ed5117718c8453f6ad27fecfdf8022ab2
SHA5129e5d46fea672dd34e673db2fd5e2852e9aa28adf62bf27b59bacd675a4dda9609b110c36b63b645ddff40f51cb4b468eda50421fd18fee52ed9170189c5d3c2f
-
Filesize
205B
MD588dd49d4ec82994eafe850768685844d
SHA10734ed447211d1fcf392619a2237016800f2e87c
SHA256d827809b8647b77f0998170fc99f46ec291987cec50cef487917c26b09f7c664
SHA512b9349e576b291539abf8d1c33d2e399c5614de7962779c26be57ffec695e16b0bd4795e080e9255bfe65ed84a5a5ace7db4b4b779102c494327820b7833515ff
-
Filesize
205B
MD510f722bc5758bb57d0af7d993d9edb3a
SHA129f134ec5eb20e7b1cc6174c5569fdba24288f15
SHA256d376c876278d51e438c5c0a93bb2d73de2af144a05e69ea36f91ffb7db9eb3eb
SHA512955b3e2c00eb58949a6de29d053ab63b46ba4ab99b1a175b2cfbd652acd8c3dfd4251ac1e2e5fd8c2a86623fe851e87a4952f835852c7b6df79eb1c04da9a498
-
Filesize
205B
MD50eb03b8d22aca0a60020f56e4d6f6b4f
SHA18f56fb3f025f3d4f44313157d60581c8ed6afb1e
SHA2566e7e6d2d98be19c554ffd5952ffca57847dce83eae9f67d953a1387f5479fed2
SHA5123c0e583aaf9a8961e8c009f208222baa5c5b480accdcacee55fb4fc0737ca99b35f72a3dfccdfdb1ca8516eaa5a8b4f4c73b3889da54575cc920878af8fc589b
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478