Analysis

  • max time kernel
    142s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-08-2024 13:50

General

  • Target

    935a1fe3fa5654672f08e6f1d1fd0c2d_JaffaCakes118.exe

  • Size

    111KB

  • MD5

    935a1fe3fa5654672f08e6f1d1fd0c2d

  • SHA1

    d7cf2d5f345da2da2eb75c0e47df9437a0a5a870

  • SHA256

    9349d0a5761fa8d56d766f2cd4b04a424d30c42f35a54b4404bc160626a57d10

  • SHA512

    67fdd65b4977d4113a00c08070ccca8cd6474be43079c99d545be71aec035bd5fda4cf0f718f35126a48a42c491dd988bd64b60695426974147f0b25a4f1ad36

  • SSDEEP

    1536:3tdnSFdm3D22UwhiqQ1q3BhNL782aLpFtVlNlMHCu9jOM6m2:3TkM6whtoEBhN3kLpFtciuA

Malware Config

Signatures

  • Possible privilege escalation attempt 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Drops file in System32 directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of UnmapMainImage 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:808
    • C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
      2⤵
        PID:1628
      • C:\Windows\System32\mousocoreworker.exe
        C:\Windows\System32\mousocoreworker.exe -Embedding
        2⤵
          PID:1904
        • C:\Windows\system32\backgroundTaskHost.exe
          "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
          2⤵
            PID:3396
          • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
            C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
            2⤵
              PID:4876
            • C:\Windows\system32\backgroundTaskHost.exe
              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
              2⤵
                PID:1564
              • C:\Windows\system32\backgroundTaskHost.exe
                "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                2⤵
                  PID:4500
                • C:\Windows\system32\BackgroundTransferHost.exe
                  "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                  2⤵
                    PID:2716
                  • C:\Windows\system32\BackgroundTransferHost.exe
                    "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                    2⤵
                      PID:3808
                    • C:\Windows\system32\backgroundTaskHost.exe
                      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                      2⤵
                        PID:1808
                      • C:\Windows\system32\BackgroundTransferHost.exe
                        "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                        2⤵
                          PID:2636
                        • C:\Windows\system32\BackgroundTransferHost.exe
                          "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                          2⤵
                            PID:2044
                          • C:\Windows\system32\DllHost.exe
                            C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                            2⤵
                              PID:4552
                            • C:\Windows\system32\backgroundTaskHost.exe
                              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                              2⤵
                                PID:1372
                              • C:\Windows\system32\BackgroundTaskHost.exe
                                "C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
                                2⤵
                                  PID:5036
                                • C:\Windows\System32\RuntimeBroker.exe
                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                  2⤵
                                    PID:4752
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k RPCSS -p
                                  1⤵
                                    PID:920
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                                    1⤵
                                      PID:968
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                                      1⤵
                                        PID:428
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                                        1⤵
                                          PID:1044
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                                          1⤵
                                            PID:1052
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                            1⤵
                                              PID:1132
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                                              1⤵
                                                PID:1140
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                                                1⤵
                                                • Drops file in System32 directory
                                                PID:1180
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                                                1⤵
                                                • Indicator Removal: Clear Windows Event Logs
                                                PID:1220
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                                                1⤵
                                                  PID:1260
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                                                  1⤵
                                                    PID:1328
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                                                    1⤵
                                                      PID:1360
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                                      1⤵
                                                        PID:1424
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                                        1⤵
                                                          PID:1508
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                                          1⤵
                                                            PID:1532
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                                            1⤵
                                                              PID:1552
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                                              1⤵
                                                                PID:1668
                                                              • C:\Windows\System32\svchost.exe
                                                                C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                                                1⤵
                                                                  PID:1692
                                                                • C:\Windows\System32\svchost.exe
                                                                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                                                  1⤵
                                                                    PID:1728
                                                                  • C:\Windows\System32\svchost.exe
                                                                    C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                                                    1⤵
                                                                      PID:1812
                                                                    • C:\Windows\System32\svchost.exe
                                                                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                      1⤵
                                                                        PID:1828
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                                        1⤵
                                                                          PID:1952
                                                                        • C:\Windows\System32\svchost.exe
                                                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                          1⤵
                                                                            PID:1960
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                                            1⤵
                                                                              PID:1968
                                                                            • C:\Windows\System32\svchost.exe
                                                                              C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                                              1⤵
                                                                                PID:1036
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
                                                                                1⤵
                                                                                  PID:2104
                                                                                • C:\Windows\System32\svchost.exe
                                                                                  C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                                                  1⤵
                                                                                    PID:2172
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                                    1⤵
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:2208
                                                                                  • C:\Windows\System32\svchost.exe
                                                                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                                    1⤵
                                                                                      PID:2284
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                                      1⤵
                                                                                        PID:2432
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                                        1⤵
                                                                                          PID:2440
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                                          1⤵
                                                                                            PID:2648
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                                            1⤵
                                                                                            • Drops file in System32 directory
                                                                                            • Suspicious use of UnmapMainImage
                                                                                            PID:2704
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                                            1⤵
                                                                                            • Enumerates connected drives
                                                                                            PID:2768
                                                                                          • C:\Windows\System32\svchost.exe
                                                                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                                            1⤵
                                                                                              PID:2836
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                                              1⤵
                                                                                                PID:2844
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                                                1⤵
                                                                                                  PID:3032
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                                  1⤵
                                                                                                    PID:3348
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                    1⤵
                                                                                                      PID:3540
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                      1⤵
                                                                                                      • Modifies data under HKEY_USERS
                                                                                                      PID:3716
                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                      1⤵
                                                                                                        PID:5108
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                        1⤵
                                                                                                          PID:632
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                          1⤵
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          PID:4640
                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                          C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                          1⤵
                                                                                                            PID:3840
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                            1⤵
                                                                                                              PID:680
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\935a1fe3fa5654672f08e6f1d1fd0c2d_JaffaCakes118.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\935a1fe3fa5654672f08e6f1d1fd0c2d_JaffaCakes118.exe"
                                                                                                              1⤵
                                                                                                              • Checks computer location settings
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1856
                                                                                                              • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                "C:\Windows\system32\regsvr32.exe" /s C:\Users\Admin\AppData\Local\Temp\~~e578368.tmp ,C:\Users\Admin\AppData\Local\Temp\935a1fe3fa5654672f08e6f1d1fd0c2d_JaffaCakes118.exe
                                                                                                                2⤵
                                                                                                                • Deletes itself
                                                                                                                • Loads dropped DLL
                                                                                                                • Drops file in System32 directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3060
                                                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                                                  takeown /f "C:\Windows\system32\rpcss.dll"
                                                                                                                  3⤵
                                                                                                                  • Possible privilege escalation attempt
                                                                                                                  • Modifies file permissions
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:4448
                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                  icacls "C:\Windows\system32\rpcss.dll" /grant administrators:F
                                                                                                                  3⤵
                                                                                                                  • Possible privilege escalation attempt
                                                                                                                  • Modifies file permissions
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:4824
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  cmd /c del %%SystemRoot%%\system32\rpcss.dll~*
                                                                                                                  3⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:884

                                                                                                            Network

                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                                                                                                              Filesize

                                                                                                              338B

                                                                                                              MD5

                                                                                                              c470e52b2d29120d94013e68fe7e2b40

                                                                                                              SHA1

                                                                                                              2aa85d3186db1c929802a78b6c3cda7176a38887

                                                                                                              SHA256

                                                                                                              62bb947a4cba34be4b9272eaa533c4152a104e473bf6237429886644b2a7bb1e

                                                                                                              SHA512

                                                                                                              41acca96eadb9d1aa62ebd14799b56caee3d04b72559c102540b051f585554e146e10b15087677843ef10651a2122d0fe9a56b01ab3206fc673df7456a9a9d53

                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

                                                                                                              Filesize

                                                                                                              404B

                                                                                                              MD5

                                                                                                              ebeb702d3def1143c9b69bff6bfbce5f

                                                                                                              SHA1

                                                                                                              790f4530187216139ee31c60f1f9ad0afee1e85e

                                                                                                              SHA256

                                                                                                              971d3f8ab4f3689192b480c3e912b447617769e73387efc2454fed77edac5ccf

                                                                                                              SHA512

                                                                                                              13a5754d472df560606af432b4fd3861747c0ee2d1170d2102b00c4779f1258f59910cca52d1336ad1b93f1223df20b630b554b981d7d894af5532d5308cb5e3

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                              Filesize

                                                                                                              328B

                                                                                                              MD5

                                                                                                              60d009af914d6156e5d97b6bb523e613

                                                                                                              SHA1

                                                                                                              edc2f2ccb81f4217bb9a771f5737c3fa55869ab0

                                                                                                              SHA256

                                                                                                              d3736a33c4227d940993b248e6c2117145939d20f447179f4f2cd4abf59c93e3

                                                                                                              SHA512

                                                                                                              c8167e491d82614688d349e85807f985757f165f478e11d3d06f979be75a36020dd8115bc5bb7fe80c5aed0e0fbb6870ee6a25919ec6b1a2d89978903b9d37af

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

                                                                                                              Filesize

                                                                                                              330B

                                                                                                              MD5

                                                                                                              2e8cbcdc68c523a64f45e85de558334a

                                                                                                              SHA1

                                                                                                              b022762ead1bcd6d9f6e9910060de5743e86e96a

                                                                                                              SHA256

                                                                                                              eaf1faf3e2a6924bbd308a927c9ce6e1e795a3526a2b0233ca5bfccbfbf7c5e5

                                                                                                              SHA512

                                                                                                              18c3f62215861d0a6f8be8c87ce079015f9fa91db921124288d1d353d9adf4dc63ae8f93b5181ebd64a4c2d25f34a6da98301c905fd6f54f850846bb7a36cedf

                                                                                                            • C:\Users\Admin\AppData\Local\Temp\~~e578368.tmp

                                                                                                              Filesize

                                                                                                              1.0MB

                                                                                                              MD5

                                                                                                              8292db8bf40e3996e858197b04a8eac9

                                                                                                              SHA1

                                                                                                              4168dda0b52b441e743be70e6bc4bff88a52cfc2

                                                                                                              SHA256

                                                                                                              e96a1f5c55c9876b39725dbe3d712d075fdd1d8b407e91bdebdda2ef53d97a14

                                                                                                              SHA512

                                                                                                              8f8ab169d25c4fa134f995af51c572fcfe79de1ddc01dedea2d8401ba283b02390180572aa1f8b8ead4d6ab8b865fc631e7551e329106b211c8e77ffe4a335a5

                                                                                                            • C:\Windows\SysWOW64\apa.dll

                                                                                                              Filesize

                                                                                                              233B

                                                                                                              MD5

                                                                                                              819af57393a9f8ef7f22fb812ae5abde

                                                                                                              SHA1

                                                                                                              4f3c6d3fbe22ddf39faa4bc722801f5c74b72a49

                                                                                                              SHA256

                                                                                                              958a1d73cc679fb5c53963bd9d415268d6020333ce24d6fb53bc4a5d0b4d3eac

                                                                                                              SHA512

                                                                                                              de8d8f18d38477b5093a9ccfe3e48b570737875fd07eb16b1f156a439f65056e7bcbb70481686aac9eaac453db37b505f9413e61b007fdec2a55b336ea400a78

                                                                                                            • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                              Filesize

                                                                                                              2KB

                                                                                                              MD5

                                                                                                              8abf2d6067c6f3191a015f84aa9b6efe

                                                                                                              SHA1

                                                                                                              98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                                                                                              SHA256

                                                                                                              ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                                                                                              SHA512

                                                                                                              c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                                                                                            • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                              Filesize

                                                                                                              2KB

                                                                                                              MD5

                                                                                                              f313c5b4f95605026428425586317353

                                                                                                              SHA1

                                                                                                              06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                              SHA256

                                                                                                              129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                              SHA512

                                                                                                              b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                            • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                              Filesize

                                                                                                              2KB

                                                                                                              MD5

                                                                                                              ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                              SHA1

                                                                                                              a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                              SHA256

                                                                                                              98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                              SHA512

                                                                                                              1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                            • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                              Filesize

                                                                                                              2KB

                                                                                                              MD5

                                                                                                              7d612892b20e70250dbd00d0cdd4f09b

                                                                                                              SHA1

                                                                                                              63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                              SHA256

                                                                                                              727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                              SHA512

                                                                                                              f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                            • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                              Filesize

                                                                                                              2KB

                                                                                                              MD5

                                                                                                              0b990e24f1e839462c0ac35fef1d119e

                                                                                                              SHA1

                                                                                                              9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                              SHA256

                                                                                                              a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                              SHA512

                                                                                                              c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                            • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                              Filesize

                                                                                                              2KB

                                                                                                              MD5

                                                                                                              1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                              SHA1

                                                                                                              5fd0a67671430f66237f483eef39ff599b892272

                                                                                                              SHA256

                                                                                                              55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                              SHA512

                                                                                                              5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6