Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 17:41
Behavioral task
behavioral1
Sample
JaffaCakes118_91adb63135fe2e2165feef8f8a1a4971041d2efa716fbb1bd751da90221cba9f.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_91adb63135fe2e2165feef8f8a1a4971041d2efa716fbb1bd751da90221cba9f.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_91adb63135fe2e2165feef8f8a1a4971041d2efa716fbb1bd751da90221cba9f.exe
-
Size
1.3MB
-
MD5
e9333bf2ebbc0f4f0dfa3117c0d8defb
-
SHA1
b78aad289bcee2c69187810a7f7b498167ce0833
-
SHA256
91adb63135fe2e2165feef8f8a1a4971041d2efa716fbb1bd751da90221cba9f
-
SHA512
f01d52a39fb56db397bfc3f40ca320b5d7931b2195c263ef615a7484c69388f74a2fee1af1109e35abfc1221d1e89cfbc03316390e595e276489d78cebb20375
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 27 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1404 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1332 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3592 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1740 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1228 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3348 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4760 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4060 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3260 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4584 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1108 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5072 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3800 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1780 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1288 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2124 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4992 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3104 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1552 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4212 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4756 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 976 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5008 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3100 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2684 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1948 5040 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5028 5040 schtasks.exe 88 -
resource yara_rule behavioral2/files/0x0008000000023c50-10.dat dcrat behavioral2/memory/1748-13-0x0000000000300000-0x0000000000410000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 384 powershell.exe 3968 powershell.exe 4568 powershell.exe 2380 powershell.exe 3944 powershell.exe 4576 powershell.exe 2984 powershell.exe 4900 powershell.exe 4516 powershell.exe 4816 powershell.exe -
Checks computer location settings 2 TTPs 17 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation JaffaCakes118_91adb63135fe2e2165feef8f8a1a4971041d2efa716fbb1bd751da90221cba9f.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 15 IoCs
pid Process 1748 DllCommonsvc.exe 4368 cmd.exe 3764 cmd.exe 2732 cmd.exe 2084 cmd.exe 3500 cmd.exe 1048 cmd.exe 1728 cmd.exe 5076 cmd.exe 3484 cmd.exe 2488 cmd.exe 2728 cmd.exe 768 cmd.exe 3940 cmd.exe 2900 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs
flow ioc 61 raw.githubusercontent.com 18 raw.githubusercontent.com 28 raw.githubusercontent.com 59 raw.githubusercontent.com 58 raw.githubusercontent.com 60 raw.githubusercontent.com 17 raw.githubusercontent.com 49 raw.githubusercontent.com 55 raw.githubusercontent.com 48 raw.githubusercontent.com 56 raw.githubusercontent.com 57 raw.githubusercontent.com 42 raw.githubusercontent.com 43 raw.githubusercontent.com 44 raw.githubusercontent.com -
Drops file in Program Files directory 7 IoCs
description ioc Process File created C:\Program Files (x86)\Windows NT\Accessories\en-US\sppsvc.exe DllCommonsvc.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\en-US\sppsvc.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows NT\Accessories\en-US\0a1fd5f707cd16 DllCommonsvc.exe File created C:\Program Files\MSBuild\Microsoft\StartMenuExperienceHost.exe DllCommonsvc.exe File created C:\Program Files\MSBuild\Microsoft\55b276f4edf653 DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\cmd.exe DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\ebf1f9fa8afd6d DllCommonsvc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Registration\CRMLog\sihost.exe DllCommonsvc.exe File created C:\Windows\Registration\CRMLog\66fc9ff0ee96c2 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_91adb63135fe2e2165feef8f8a1a4971041d2efa716fbb1bd751da90221cba9f.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings JaffaCakes118_91adb63135fe2e2165feef8f8a1a4971041d2efa716fbb1bd751da90221cba9f.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3800 schtasks.exe 1332 schtasks.exe 3100 schtasks.exe 4992 schtasks.exe 1740 schtasks.exe 1108 schtasks.exe 4060 schtasks.exe 4756 schtasks.exe 5008 schtasks.exe 2684 schtasks.exe 5028 schtasks.exe 3104 schtasks.exe 976 schtasks.exe 3592 schtasks.exe 3348 schtasks.exe 4760 schtasks.exe 5072 schtasks.exe 1948 schtasks.exe 4212 schtasks.exe 1404 schtasks.exe 1228 schtasks.exe 3260 schtasks.exe 1780 schtasks.exe 1288 schtasks.exe 2124 schtasks.exe 4584 schtasks.exe 1552 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 61 IoCs
pid Process 1748 DllCommonsvc.exe 1748 DllCommonsvc.exe 1748 DllCommonsvc.exe 1748 DllCommonsvc.exe 1748 DllCommonsvc.exe 1748 DllCommonsvc.exe 1748 DllCommonsvc.exe 1748 DllCommonsvc.exe 1748 DllCommonsvc.exe 1748 DllCommonsvc.exe 1748 DllCommonsvc.exe 1748 DllCommonsvc.exe 1748 DllCommonsvc.exe 1748 DllCommonsvc.exe 1748 DllCommonsvc.exe 1748 DllCommonsvc.exe 2380 powershell.exe 2380 powershell.exe 4568 powershell.exe 4568 powershell.exe 3944 powershell.exe 3944 powershell.exe 4816 powershell.exe 4816 powershell.exe 4900 powershell.exe 4900 powershell.exe 2984 powershell.exe 2984 powershell.exe 384 powershell.exe 384 powershell.exe 4576 powershell.exe 4576 powershell.exe 4516 powershell.exe 4516 powershell.exe 3968 powershell.exe 3968 powershell.exe 384 powershell.exe 2984 powershell.exe 4516 powershell.exe 4368 cmd.exe 4368 cmd.exe 4900 powershell.exe 3944 powershell.exe 3968 powershell.exe 4568 powershell.exe 4576 powershell.exe 2380 powershell.exe 4816 powershell.exe 3764 cmd.exe 2732 cmd.exe 2084 cmd.exe 3500 cmd.exe 1048 cmd.exe 1728 cmd.exe 5076 cmd.exe 3484 cmd.exe 2488 cmd.exe 2728 cmd.exe 768 cmd.exe 3940 cmd.exe 2900 cmd.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 1748 DllCommonsvc.exe Token: SeDebugPrivilege 2380 powershell.exe Token: SeDebugPrivilege 4568 powershell.exe Token: SeDebugPrivilege 3944 powershell.exe Token: SeDebugPrivilege 4900 powershell.exe Token: SeDebugPrivilege 3968 powershell.exe Token: SeDebugPrivilege 4816 powershell.exe Token: SeDebugPrivilege 2984 powershell.exe Token: SeDebugPrivilege 4576 powershell.exe Token: SeDebugPrivilege 384 powershell.exe Token: SeDebugPrivilege 4516 powershell.exe Token: SeDebugPrivilege 4368 cmd.exe Token: SeDebugPrivilege 3764 cmd.exe Token: SeDebugPrivilege 2732 cmd.exe Token: SeDebugPrivilege 2084 cmd.exe Token: SeDebugPrivilege 3500 cmd.exe Token: SeDebugPrivilege 1048 cmd.exe Token: SeDebugPrivilege 1728 cmd.exe Token: SeDebugPrivilege 5076 cmd.exe Token: SeDebugPrivilege 3484 cmd.exe Token: SeDebugPrivilege 2488 cmd.exe Token: SeDebugPrivilege 2728 cmd.exe Token: SeDebugPrivilege 768 cmd.exe Token: SeDebugPrivilege 3940 cmd.exe Token: SeDebugPrivilege 2900 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4072 wrote to memory of 2112 4072 JaffaCakes118_91adb63135fe2e2165feef8f8a1a4971041d2efa716fbb1bd751da90221cba9f.exe 83 PID 4072 wrote to memory of 2112 4072 JaffaCakes118_91adb63135fe2e2165feef8f8a1a4971041d2efa716fbb1bd751da90221cba9f.exe 83 PID 4072 wrote to memory of 2112 4072 JaffaCakes118_91adb63135fe2e2165feef8f8a1a4971041d2efa716fbb1bd751da90221cba9f.exe 83 PID 2112 wrote to memory of 4636 2112 WScript.exe 85 PID 2112 wrote to memory of 4636 2112 WScript.exe 85 PID 2112 wrote to memory of 4636 2112 WScript.exe 85 PID 4636 wrote to memory of 1748 4636 cmd.exe 87 PID 4636 wrote to memory of 1748 4636 cmd.exe 87 PID 1748 wrote to memory of 4516 1748 DllCommonsvc.exe 117 PID 1748 wrote to memory of 4516 1748 DllCommonsvc.exe 117 PID 1748 wrote to memory of 4900 1748 DllCommonsvc.exe 118 PID 1748 wrote to memory of 4900 1748 DllCommonsvc.exe 118 PID 1748 wrote to memory of 384 1748 DllCommonsvc.exe 119 PID 1748 wrote to memory of 384 1748 DllCommonsvc.exe 119 PID 1748 wrote to memory of 3968 1748 DllCommonsvc.exe 120 PID 1748 wrote to memory of 3968 1748 DllCommonsvc.exe 120 PID 1748 wrote to memory of 2984 1748 DllCommonsvc.exe 121 PID 1748 wrote to memory of 2984 1748 DllCommonsvc.exe 121 PID 1748 wrote to memory of 4576 1748 DllCommonsvc.exe 122 PID 1748 wrote to memory of 4576 1748 DllCommonsvc.exe 122 PID 1748 wrote to memory of 4568 1748 DllCommonsvc.exe 124 PID 1748 wrote to memory of 4568 1748 DllCommonsvc.exe 124 PID 1748 wrote to memory of 2380 1748 DllCommonsvc.exe 125 PID 1748 wrote to memory of 2380 1748 DllCommonsvc.exe 125 PID 1748 wrote to memory of 3944 1748 DllCommonsvc.exe 126 PID 1748 wrote to memory of 3944 1748 DllCommonsvc.exe 126 PID 1748 wrote to memory of 4816 1748 DllCommonsvc.exe 127 PID 1748 wrote to memory of 4816 1748 DllCommonsvc.exe 127 PID 1748 wrote to memory of 4368 1748 DllCommonsvc.exe 137 PID 1748 wrote to memory of 4368 1748 DllCommonsvc.exe 137 PID 4368 wrote to memory of 4016 4368 cmd.exe 146 PID 4368 wrote to memory of 4016 4368 cmd.exe 146 PID 4016 wrote to memory of 3532 4016 cmd.exe 148 PID 4016 wrote to memory of 3532 4016 cmd.exe 148 PID 4016 wrote to memory of 3764 4016 cmd.exe 154 PID 4016 wrote to memory of 3764 4016 cmd.exe 154 PID 3764 wrote to memory of 4756 3764 cmd.exe 156 PID 3764 wrote to memory of 4756 3764 cmd.exe 156 PID 4756 wrote to memory of 1548 4756 cmd.exe 158 PID 4756 wrote to memory of 1548 4756 cmd.exe 158 PID 4756 wrote to memory of 2732 4756 cmd.exe 162 PID 4756 wrote to memory of 2732 4756 cmd.exe 162 PID 2732 wrote to memory of 3064 2732 cmd.exe 165 PID 2732 wrote to memory of 3064 2732 cmd.exe 165 PID 3064 wrote to memory of 1500 3064 cmd.exe 167 PID 3064 wrote to memory of 1500 3064 cmd.exe 167 PID 3064 wrote to memory of 2084 3064 cmd.exe 169 PID 3064 wrote to memory of 2084 3064 cmd.exe 169 PID 2084 wrote to memory of 3860 2084 cmd.exe 171 PID 2084 wrote to memory of 3860 2084 cmd.exe 171 PID 3860 wrote to memory of 3708 3860 cmd.exe 173 PID 3860 wrote to memory of 3708 3860 cmd.exe 173 PID 3860 wrote to memory of 3500 3860 cmd.exe 175 PID 3860 wrote to memory of 3500 3860 cmd.exe 175 PID 3500 wrote to memory of 1520 3500 cmd.exe 177 PID 3500 wrote to memory of 1520 3500 cmd.exe 177 PID 1520 wrote to memory of 2392 1520 cmd.exe 179 PID 1520 wrote to memory of 2392 1520 cmd.exe 179 PID 1520 wrote to memory of 1048 1520 cmd.exe 182 PID 1520 wrote to memory of 1048 1520 cmd.exe 182 PID 1048 wrote to memory of 4884 1048 cmd.exe 184 PID 1048 wrote to memory of 4884 1048 cmd.exe 184 PID 4884 wrote to memory of 548 4884 cmd.exe 186 PID 4884 wrote to memory of 548 4884 cmd.exe 186 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91adb63135fe2e2165feef8f8a1a4971041d2efa716fbb1bd751da90221cba9f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91adb63135fe2e2165feef8f8a1a4971041d2efa716fbb1bd751da90221cba9f.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4516
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\en-US\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4900
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\StartMenuExperienceHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:384
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\wininit.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3968
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2984
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\RedistList\cmd.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4576
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Registration\CRMLog\sihost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4568
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Documents\My Videos\cmd.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2380
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3944
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\unsecapp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4816
-
-
C:\Users\Default\Documents\My Videos\cmd.exe"C:\Users\Default\Documents\My Videos\cmd.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\o0FbW2pZd9.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:3532
-
-
C:\Users\Default\Documents\My Videos\cmd.exe"C:\Users\Default\Documents\My Videos\cmd.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KRs2fZV4we.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:1548
-
-
C:\Users\Default\Documents\My Videos\cmd.exe"C:\Users\Default\Documents\My Videos\cmd.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3dopRv074r.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:1500
-
-
C:\Users\Default\Documents\My Videos\cmd.exe"C:\Users\Default\Documents\My Videos\cmd.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uugdhbmYnk.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:3708
-
-
C:\Users\Default\Documents\My Videos\cmd.exe"C:\Users\Default\Documents\My Videos\cmd.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\l4DYpxlgJN.bat"14⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:2392
-
-
C:\Users\Default\Documents\My Videos\cmd.exe"C:\Users\Default\Documents\My Videos\cmd.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rm9ahlPG2t.bat"16⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:548
-
-
C:\Users\Default\Documents\My Videos\cmd.exe"C:\Users\Default\Documents\My Videos\cmd.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1728 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QO5FEA9wo1.bat"18⤵PID:1924
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:1948
-
-
C:\Users\Default\Documents\My Videos\cmd.exe"C:\Users\Default\Documents\My Videos\cmd.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ixgWq8OOYW.bat"20⤵PID:3952
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:4256
-
-
C:\Users\Default\Documents\My Videos\cmd.exe"C:\Users\Default\Documents\My Videos\cmd.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3484 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4oJokgKWVw.bat"22⤵PID:3256
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:3268
-
-
C:\Users\Default\Documents\My Videos\cmd.exe"C:\Users\Default\Documents\My Videos\cmd.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2488 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Y23Kn3rQqK.bat"24⤵PID:8
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:1520
-
-
C:\Users\Default\Documents\My Videos\cmd.exe"C:\Users\Default\Documents\My Videos\cmd.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SK7IuFDp7o.bat"26⤵PID:1616
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:4024
-
-
C:\Users\Default\Documents\My Videos\cmd.exe"C:\Users\Default\Documents\My Videos\cmd.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:768 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uugdhbmYnk.bat"28⤵PID:2512
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:4516
-
-
C:\Users\Default\Documents\My Videos\cmd.exe"C:\Users\Default\Documents\My Videos\cmd.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PJw82jcrZC.bat"30⤵PID:4628
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵PID:3048
-
-
C:\Users\Default\Documents\My Videos\cmd.exe"C:\Users\Default\Documents\My Videos\cmd.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2900 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\c0TJHXkWh8.bat"32⤵PID:3708
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:233⤵PID:1108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1332
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3592
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Program Files\MSBuild\Microsoft\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1228
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3348
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Users\Default\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\Default\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3260
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\providercommon\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4584
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3800
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Windows\Registration\CRMLog\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4992
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Windows\Registration\CRMLog\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3104
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Documents\My Videos\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default\Documents\My Videos\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Documents\My Videos\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4756
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:976
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Admin\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3100
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5028
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
209B
MD5a70b4c1188cb3e8174c2a501fc925636
SHA1668bd3766da7019b1bf9f45109f6fbb66c4677dc
SHA256ce997816ca15a30ae636c63401c90ded3cf65b1206f5b58d1f7a23fe0e4b1fb9
SHA5121ecc4d091e717371bc36b9ab89b14ae59b82d82bb7b65e617742f0816e0f83a8c004c78c403a2b058bc203d091e2cf1c98ade68f835a9ae5d994a351393f0071
-
Filesize
209B
MD549deed557c1315590d5cd05a80090546
SHA17a6c6dc56fab946a94a883a2eda0ba7e36d2f4c0
SHA256e23bb47cb34b6c8888b3f0d6b5eb1eabef5dc94ce7ddee5bef3ef2468acc584d
SHA512078404b2ce099da79b78a66f9967db4ddbf77dad7c1c75c6083c34b8449eafe9aec9f14489c380ca839b93954ac481f4834946f031e76908b1cc465b4e2450ae
-
Filesize
209B
MD5e7c8c16b7e363c6e93ddb2acb6334dfe
SHA1a8f5f3c32bd090c04067e89794f2615e98b2f04b
SHA256638838b323f0f225b0cea7d3357b9c9cccea276dee2a8035433d77506fc9ecf1
SHA51295e9e5aa6518baa689896125e6ba50fffc64ec2190c3919abd0b10716e30ab01430aa6401f2572cff6a1017acfcedcb77cdc27f1da37b0fb3cb24d62fdac29d5
-
Filesize
209B
MD5abc1a467416810212b726f1be7bd6aaa
SHA198750c60ae91d84d4a8116f8e634fda0c8dbb3cf
SHA256de2585ab8b3c9294b4ada06ee913c55b6359758630c3d2f73f0484938a65e791
SHA512d93c9d6912eaf3f03735829d797d6b8068c5dac9a3601bd1737fc1bc6801e88ce7372f6c2f8a548854be549f1217b953edc1656e3df8465b65726ba06e787a84
-
Filesize
209B
MD5a044669517dea07dcef55748b394355d
SHA190996fa7be272f307b926016bdecc1b161b156fb
SHA256ff75718391b22ab9bf54fa8d2d01dabd924f73d21cbdc29ba3ba560c98172abd
SHA512712c664e6d9a964346c8965531eaf2cc17bbe9893c79fe4f64942641189d92875df97c687a2c1ff901403dd5a5cc00f147315d7ac140b62a0ae3a0862034b4ce
-
Filesize
209B
MD597bb59281d36475a43b4b64bbeaae3d6
SHA1a2f107fe9c995bec143286d67f3c3dff1a4bba18
SHA256edfb547c70c160684128802d47f1f660484695e0910c81cbb8771158a82f3188
SHA512e2b05f1e2ce64a161ea560b03f29f656f82c9493352dab382f0821cfa6b035bd261bf46035b467daeba9a96cb3683d7bc420427d4c38cfc93302c856a04ce6c1
-
Filesize
209B
MD51b284bf2b4ebd640f966815efba3d621
SHA144cd46fa40daab12f41d9539faf10015c63a7070
SHA256fa3a3e703a32d0c3a3ad3563eecf316ce39b7e93e6dd6750478f8531e9cbcc2a
SHA512c197ce549efd72c9ac7f7730367f87b2054116d3d92dabd3975939b617e54f715c3e54aee4cd4e013e53212317a6edef979c47e3c49d483aa35e37be0f2e682b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
209B
MD5e0b11e9ef9e04eb45acaf683668d96fc
SHA1cf39822d09d4a0d6605d06975a2bd40d648edf40
SHA256a6975e5c046670262915710d6b9fe73efb63ce6ce825397f3cff3ca1971ca258
SHA5125e47399734e0c41478fe8830b103b3bdf23afe61db2837298e7fce5ec2941ba5377cf279ab403bd415f8f687829eaa949d45c4d5161af08721830eb781dbe4d6
-
Filesize
209B
MD5c24bfbc266228c31608d09e5aaa1b2b8
SHA1fa33639b9e07729a283f4ee452b1b9fbf16c7ff2
SHA25630e543fd94aebbd865148913859d89e2afe81c1446cd0d12ae91805c82f4fa45
SHA51289c1a5874c49c55c68e2a85fc925a62da787992a68bda28805833a888ad71cfa97b81cd463862305ba62aa9bb294eaec9b85f8e8b72a1e04a517362b0b59c437
-
Filesize
209B
MD5da2dff7279d5118e58540b644111d642
SHA19d85b9ac5bf84ed887924f2e2d8ddf73fecc0cc7
SHA25620d77629e931019e576b261be53b9f3c16113f47fb0a619d65c417cd06f92af4
SHA512c1e9876a2c6187eb0472edb7e9bec3a0a9769f64e672b8e5edfc9f1a4d01c73a4b0fbdade300e97353d30aadff1d73df68a3b1ca6007ec315b6a5556060cd917
-
Filesize
209B
MD5f25b976ac68cfeca921719c326186be1
SHA117b772a61d3417e15705742db668e13fc56f778e
SHA2567fa777efd57b02bb6b4dded1c70d7541af0376e0a945369575a95481d1fd677f
SHA51209f18c11b1136432ec0c331d9292bb2815870dd1695e3b0476d15abb9f92598fb1df87d586009962b5cd7208e522529e83cceea07421bd5edfd746e7662fd56f
-
Filesize
209B
MD53badf7ab622429c4d5bec60e0ead82da
SHA1a0b3bbff39ee17aaae0d3252fc472e6f322597d3
SHA25602c40bd3cfc92cf5f31fb6db70fef7571e1106dd4536cde5a31d76b5e8b68082
SHA512f76c185fcab4d04d336ef5fed1c4d3b4699b90b5453be66450790d21fcd3b263c445e84589238e0c6f396f1384f89b536e847ca9277bec20b78ce4706e38a9c5
-
Filesize
209B
MD53b6245a62a38f75e888c49e323d3ba82
SHA1519c25aa1212e12bbef870cea5668855502791db
SHA2562fe24dcccfd3c961d0f03b1e89065bf63f3f967edbde0c70ef163960e9e6942e
SHA512134e9f1567faf03ef37597458e23f1f31da2bcb6eaf112ff7b86e88279b1ac6bad17820e64e7c7903c0a942daba4092a929ff0fbce9d2525e2d5bee59829c856
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478