Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-12-2024 20:18
Behavioral task
behavioral1
Sample
JaffaCakes118_54c697a6c87bf530998fd17ff51e87b09194bce09cc0647535815ae3ed1872f3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_54c697a6c87bf530998fd17ff51e87b09194bce09cc0647535815ae3ed1872f3.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_54c697a6c87bf530998fd17ff51e87b09194bce09cc0647535815ae3ed1872f3.exe
-
Size
1.3MB
-
MD5
70a3a73630cf2f1b5e514f82589f7c69
-
SHA1
b8eb8c8de83226ef6411be5423cf1bc610b33a11
-
SHA256
54c697a6c87bf530998fd17ff51e87b09194bce09cc0647535815ae3ed1872f3
-
SHA512
183d92e6c120b610f95cfc3b025b0664c7f713b88e3aaff1fec916783566e5c579be9dd2dc504e56d2662a554731ca3a1def0647057df1cbd3bef4955292c895
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 64 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3668 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1236 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 60 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2572 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3728 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4884 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2980 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2260 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3220 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4080 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5108 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1516 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1656 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2468 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2752 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2808 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2868 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2036 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3332 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3392 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4500 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1808 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4048 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2324 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1472 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5012 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5096 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 944 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3208 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3564 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1308 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3676 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 636 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1032 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3096 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1708 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3344 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2420 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2776 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4304 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4140 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2272 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 396 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4920 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3948 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3892 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3756 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3996 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3412 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1900 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1776 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2912 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3720 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1016 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 100 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4924 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 940 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 404 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3764 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4736 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4316 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3984 2848 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1576 2848 schtasks.exe 88 -
resource yara_rule behavioral2/files/0x0007000000023c88-10.dat dcrat behavioral2/memory/3564-13-0x0000000000050000-0x0000000000160000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 26 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4980 powershell.exe 1512 powershell.exe 2360 powershell.exe 220 powershell.exe 1912 powershell.exe 4724 powershell.exe 4996 powershell.exe 1468 powershell.exe 1420 powershell.exe 2740 powershell.exe 3236 powershell.exe 3280 powershell.exe 976 powershell.exe 3280 powershell.exe 5084 powershell.exe 4648 powershell.exe 4468 powershell.exe 3520 powershell.exe 940 powershell.exe 1628 powershell.exe 2012 powershell.exe 5024 powershell.exe 2300 powershell.exe 2940 powershell.exe 4720 powershell.exe 2168 powershell.exe -
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sppsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sppsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sppsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sppsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sppsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sppsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sppsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sppsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sppsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sppsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation JaffaCakes118_54c697a6c87bf530998fd17ff51e87b09194bce09cc0647535815ae3ed1872f3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sppsvc.exe -
Executes dropped EXE 14 IoCs
pid Process 3564 DllCommonsvc.exe 1232 DllCommonsvc.exe 2448 sppsvc.exe 5540 sppsvc.exe 4464 sppsvc.exe 1180 sppsvc.exe 2760 sppsvc.exe 3132 sppsvc.exe 3892 sppsvc.exe 1164 sppsvc.exe 3324 sppsvc.exe 2088 sppsvc.exe 5624 sppsvc.exe 5604 sppsvc.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
flow ioc 53 raw.githubusercontent.com 18 raw.githubusercontent.com 42 raw.githubusercontent.com 43 raw.githubusercontent.com 44 raw.githubusercontent.com 52 raw.githubusercontent.com 51 raw.githubusercontent.com 19 raw.githubusercontent.com 37 raw.githubusercontent.com 38 raw.githubusercontent.com 39 raw.githubusercontent.com 50 raw.githubusercontent.com -
Drops file in Program Files directory 16 IoCs
description ioc Process File created C:\Program Files\Microsoft Office 15\ClientX64\sysmon.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Multimedia Platform\DllCommonsvc.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Multimedia Platform\a76d7bf15d8370 DllCommonsvc.exe File created C:\Program Files\Windows NT\Accessories\ja-JP\ea1d8f6d871115 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\StartMenuExperienceHost.exe DllCommonsvc.exe File created C:\Program Files\Windows Defender\de-DE\taskhostw.exe DllCommonsvc.exe File created C:\Program Files\Microsoft Office 15\ClientX64\121e5b5079f7c0 DllCommonsvc.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\27d1bcfc3c54e0 DllCommonsvc.exe File created C:\Program Files\Windows Defender\de-DE\ea9f0e6c9e2dcd DllCommonsvc.exe File created C:\Program Files (x86)\Windows Photo Viewer\uk-UA\explorer.exe DllCommonsvc.exe File created C:\Program Files\Windows NT\Accessories\ja-JP\upfc.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Multimedia Platform\sysmon.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Photo Viewer\uk-UA\7a0fd90576e088 DllCommonsvc.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\System.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Multimedia Platform\121e5b5079f7c0 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\55b276f4edf653 DllCommonsvc.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\LiveKernelReports\5940a34987c991 DllCommonsvc.exe File created C:\Windows\security\cap\TextInputHost.exe DllCommonsvc.exe File created C:\Windows\security\cap\22eafd247d37c3 DllCommonsvc.exe File created C:\Windows\INF\Idle.exe DllCommonsvc.exe File created C:\Windows\INF\6ccacd8608530f DllCommonsvc.exe File created C:\Windows\LiveKernelReports\dllhost.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_54c697a6c87bf530998fd17ff51e87b09194bce09cc0647535815ae3ed1872f3.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sppsvc.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sppsvc.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sppsvc.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sppsvc.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sppsvc.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings JaffaCakes118_54c697a6c87bf530998fd17ff51e87b09194bce09cc0647535815ae3ed1872f3.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sppsvc.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sppsvc.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sppsvc.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sppsvc.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sppsvc.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sppsvc.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4048 schtasks.exe 2324 schtasks.exe 944 schtasks.exe 3096 schtasks.exe 4304 schtasks.exe 2980 schtasks.exe 2468 schtasks.exe 2868 schtasks.exe 8 schtasks.exe 2260 schtasks.exe 4080 schtasks.exe 1808 schtasks.exe 1032 schtasks.exe 3284 schtasks.exe 3364 schtasks.exe 4684 schtasks.exe 2808 schtasks.exe 4140 schtasks.exe 404 schtasks.exe 112 schtasks.exe 3668 schtasks.exe 3728 schtasks.exe 1656 schtasks.exe 3332 schtasks.exe 3208 schtasks.exe 3412 schtasks.exe 1028 schtasks.exe 2460 schtasks.exe 5108 schtasks.exe 2036 schtasks.exe 4500 schtasks.exe 2272 schtasks.exe 4920 schtasks.exe 1900 schtasks.exe 3676 schtasks.exe 2420 schtasks.exe 3948 schtasks.exe 1776 schtasks.exe 3984 schtasks.exe 552 schtasks.exe 1236 schtasks.exe 3220 schtasks.exe 5012 schtasks.exe 636 schtasks.exe 3892 schtasks.exe 100 schtasks.exe 2912 schtasks.exe 4736 schtasks.exe 60 schtasks.exe 1516 schtasks.exe 3344 schtasks.exe 4316 schtasks.exe 1904 schtasks.exe 5096 schtasks.exe 3564 schtasks.exe 2776 schtasks.exe 3756 schtasks.exe 3996 schtasks.exe 1016 schtasks.exe 1576 schtasks.exe 2572 schtasks.exe 2752 schtasks.exe 1472 schtasks.exe 4924 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3564 DllCommonsvc.exe 3236 powershell.exe 940 powershell.exe 2740 powershell.exe 2740 powershell.exe 1912 powershell.exe 1912 powershell.exe 976 powershell.exe 976 powershell.exe 3280 powershell.exe 3280 powershell.exe 3520 powershell.exe 3520 powershell.exe 220 powershell.exe 220 powershell.exe 3236 powershell.exe 3236 powershell.exe 940 powershell.exe 940 powershell.exe 2740 powershell.exe 1912 powershell.exe 976 powershell.exe 3280 powershell.exe 3520 powershell.exe 220 powershell.exe 1232 DllCommonsvc.exe 1232 DllCommonsvc.exe 1232 DllCommonsvc.exe 1232 DllCommonsvc.exe 1232 DllCommonsvc.exe 1232 DllCommonsvc.exe 1232 DllCommonsvc.exe 1232 DllCommonsvc.exe 1232 DllCommonsvc.exe 4996 powershell.exe 4996 powershell.exe 3280 powershell.exe 3280 powershell.exe 2012 powershell.exe 2012 powershell.exe 1468 powershell.exe 1468 powershell.exe 5024 powershell.exe 5024 powershell.exe 1420 powershell.exe 1420 powershell.exe 4720 powershell.exe 4720 powershell.exe 4648 powershell.exe 4648 powershell.exe 4724 powershell.exe 4724 powershell.exe 5084 powershell.exe 5084 powershell.exe 1512 powershell.exe 1512 powershell.exe 2168 powershell.exe 2168 powershell.exe 1628 powershell.exe 1628 powershell.exe 2940 powershell.exe 2940 powershell.exe 2360 powershell.exe 2360 powershell.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeDebugPrivilege 3564 DllCommonsvc.exe Token: SeDebugPrivilege 3236 powershell.exe Token: SeDebugPrivilege 940 powershell.exe Token: SeDebugPrivilege 2740 powershell.exe Token: SeDebugPrivilege 1912 powershell.exe Token: SeDebugPrivilege 976 powershell.exe Token: SeDebugPrivilege 3280 powershell.exe Token: SeDebugPrivilege 3520 powershell.exe Token: SeDebugPrivilege 220 powershell.exe Token: SeDebugPrivilege 1232 DllCommonsvc.exe Token: SeDebugPrivilege 5084 powershell.exe Token: SeDebugPrivilege 4996 powershell.exe Token: SeDebugPrivilege 3280 powershell.exe Token: SeDebugPrivilege 2012 powershell.exe Token: SeDebugPrivilege 1468 powershell.exe Token: SeDebugPrivilege 5024 powershell.exe Token: SeDebugPrivilege 4980 powershell.exe Token: SeDebugPrivilege 1420 powershell.exe Token: SeDebugPrivilege 4720 powershell.exe Token: SeDebugPrivilege 4648 powershell.exe Token: SeDebugPrivilege 4724 powershell.exe Token: SeDebugPrivilege 1512 powershell.exe Token: SeDebugPrivilege 2168 powershell.exe Token: SeDebugPrivilege 1628 powershell.exe Token: SeDebugPrivilege 2940 powershell.exe Token: SeDebugPrivilege 2360 powershell.exe Token: SeDebugPrivilege 4468 powershell.exe Token: SeDebugPrivilege 2300 powershell.exe Token: SeDebugPrivilege 2448 sppsvc.exe Token: SeDebugPrivilege 5540 sppsvc.exe Token: SeDebugPrivilege 4464 sppsvc.exe Token: SeDebugPrivilege 1180 sppsvc.exe Token: SeDebugPrivilege 2760 sppsvc.exe Token: SeDebugPrivilege 3132 sppsvc.exe Token: SeDebugPrivilege 3892 sppsvc.exe Token: SeDebugPrivilege 1164 sppsvc.exe Token: SeDebugPrivilege 3324 sppsvc.exe Token: SeDebugPrivilege 2088 sppsvc.exe Token: SeDebugPrivilege 5624 sppsvc.exe Token: SeDebugPrivilege 5604 sppsvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 372 wrote to memory of 548 372 JaffaCakes118_54c697a6c87bf530998fd17ff51e87b09194bce09cc0647535815ae3ed1872f3.exe 83 PID 372 wrote to memory of 548 372 JaffaCakes118_54c697a6c87bf530998fd17ff51e87b09194bce09cc0647535815ae3ed1872f3.exe 83 PID 372 wrote to memory of 548 372 JaffaCakes118_54c697a6c87bf530998fd17ff51e87b09194bce09cc0647535815ae3ed1872f3.exe 83 PID 548 wrote to memory of 2776 548 WScript.exe 85 PID 548 wrote to memory of 2776 548 WScript.exe 85 PID 548 wrote to memory of 2776 548 WScript.exe 85 PID 2776 wrote to memory of 3564 2776 cmd.exe 87 PID 2776 wrote to memory of 3564 2776 cmd.exe 87 PID 3564 wrote to memory of 3520 3564 DllCommonsvc.exe 111 PID 3564 wrote to memory of 3520 3564 DllCommonsvc.exe 111 PID 3564 wrote to memory of 220 3564 DllCommonsvc.exe 112 PID 3564 wrote to memory of 220 3564 DllCommonsvc.exe 112 PID 3564 wrote to memory of 1912 3564 DllCommonsvc.exe 113 PID 3564 wrote to memory of 1912 3564 DllCommonsvc.exe 113 PID 3564 wrote to memory of 940 3564 DllCommonsvc.exe 114 PID 3564 wrote to memory of 940 3564 DllCommonsvc.exe 114 PID 3564 wrote to memory of 2740 3564 DllCommonsvc.exe 115 PID 3564 wrote to memory of 2740 3564 DllCommonsvc.exe 115 PID 3564 wrote to memory of 3280 3564 DllCommonsvc.exe 116 PID 3564 wrote to memory of 3280 3564 DllCommonsvc.exe 116 PID 3564 wrote to memory of 976 3564 DllCommonsvc.exe 117 PID 3564 wrote to memory of 976 3564 DllCommonsvc.exe 117 PID 3564 wrote to memory of 3236 3564 DllCommonsvc.exe 118 PID 3564 wrote to memory of 3236 3564 DllCommonsvc.exe 118 PID 3564 wrote to memory of 3188 3564 DllCommonsvc.exe 126 PID 3564 wrote to memory of 3188 3564 DllCommonsvc.exe 126 PID 3188 wrote to memory of 3144 3188 cmd.exe 129 PID 3188 wrote to memory of 3144 3188 cmd.exe 129 PID 3188 wrote to memory of 1232 3188 cmd.exe 137 PID 3188 wrote to memory of 1232 3188 cmd.exe 137 PID 1232 wrote to memory of 4720 1232 DllCommonsvc.exe 191 PID 1232 wrote to memory of 4720 1232 DllCommonsvc.exe 191 PID 1232 wrote to memory of 1628 1232 DllCommonsvc.exe 192 PID 1232 wrote to memory of 1628 1232 DllCommonsvc.exe 192 PID 1232 wrote to memory of 3280 1232 DllCommonsvc.exe 193 PID 1232 wrote to memory of 3280 1232 DllCommonsvc.exe 193 PID 1232 wrote to memory of 2168 1232 DllCommonsvc.exe 194 PID 1232 wrote to memory of 2168 1232 DllCommonsvc.exe 194 PID 1232 wrote to memory of 4724 1232 DllCommonsvc.exe 196 PID 1232 wrote to memory of 4724 1232 DllCommonsvc.exe 196 PID 1232 wrote to memory of 2012 1232 DllCommonsvc.exe 197 PID 1232 wrote to memory of 2012 1232 DllCommonsvc.exe 197 PID 1232 wrote to memory of 5084 1232 DllCommonsvc.exe 198 PID 1232 wrote to memory of 5084 1232 DllCommonsvc.exe 198 PID 1232 wrote to memory of 5024 1232 DllCommonsvc.exe 199 PID 1232 wrote to memory of 5024 1232 DllCommonsvc.exe 199 PID 1232 wrote to memory of 4996 1232 DllCommonsvc.exe 200 PID 1232 wrote to memory of 4996 1232 DllCommonsvc.exe 200 PID 1232 wrote to memory of 1468 1232 DllCommonsvc.exe 201 PID 1232 wrote to memory of 1468 1232 DllCommonsvc.exe 201 PID 1232 wrote to memory of 4648 1232 DllCommonsvc.exe 202 PID 1232 wrote to memory of 4648 1232 DllCommonsvc.exe 202 PID 1232 wrote to memory of 4980 1232 DllCommonsvc.exe 203 PID 1232 wrote to memory of 4980 1232 DllCommonsvc.exe 203 PID 1232 wrote to memory of 1512 1232 DllCommonsvc.exe 204 PID 1232 wrote to memory of 1512 1232 DllCommonsvc.exe 204 PID 1232 wrote to memory of 1420 1232 DllCommonsvc.exe 205 PID 1232 wrote to memory of 1420 1232 DllCommonsvc.exe 205 PID 1232 wrote to memory of 2940 1232 DllCommonsvc.exe 206 PID 1232 wrote to memory of 2940 1232 DllCommonsvc.exe 206 PID 1232 wrote to memory of 2360 1232 DllCommonsvc.exe 207 PID 1232 wrote to memory of 2360 1232 DllCommonsvc.exe 207 PID 1232 wrote to memory of 4468 1232 DllCommonsvc.exe 208 PID 1232 wrote to memory of 4468 1232 DllCommonsvc.exe 208 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54c697a6c87bf530998fd17ff51e87b09194bce09cc0647535815ae3ed1872f3.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54c697a6c87bf530998fd17ff51e87b09194bce09cc0647535815ae3ed1872f3.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3520
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:220
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\de-DE\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:940
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\services.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3280
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:976
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\SetupMetrics\OfficeClickToRun.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3236
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zYtXWXfi3C.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:3144
-
-
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4720
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Desktop\WaaSMedicAgent.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1628
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\explorer.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3280
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\OfficeClickToRun.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2168
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents\Registry.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2012
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\LiveKernelReports\dllhost.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5084
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\DllCommonsvc.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5024
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\lsass.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4996
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Java\Java Update\System.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1468
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\Accessories\ja-JP\upfc.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4648
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Application Data\sppsvc.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4980
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\cap\TextInputHost.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1512
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\sihost.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1420
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\INF\Idle.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2940
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2360
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\sysmon.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\StartMenuExperienceHost.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2300
-
-
C:\Users\All Users\Application Data\sppsvc.exe"C:\Users\All Users\Application Data\sppsvc.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2448 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XkJigN4PJf.bat"8⤵PID:5344
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:5272
-
-
C:\Users\All Users\Application Data\sppsvc.exe"C:\Users\All Users\Application Data\sppsvc.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5540 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vF7CrwxjwX.bat"10⤵PID:5580
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:4948
-
-
C:\Users\All Users\Application Data\sppsvc.exe"C:\Users\All Users\Application Data\sppsvc.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4464 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TmtjCtAJTq.bat"12⤵PID:1344
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:536
-
-
C:\Users\All Users\Application Data\sppsvc.exe"C:\Users\All Users\Application Data\sppsvc.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1180 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3EiKDvRnKw.bat"14⤵PID:5236
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:3096
-
-
C:\Users\All Users\Application Data\sppsvc.exe"C:\Users\All Users\Application Data\sppsvc.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2760 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8xeM6k5O3T.bat"16⤵PID:3796
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:3808
-
-
C:\Users\All Users\Application Data\sppsvc.exe"C:\Users\All Users\Application Data\sppsvc.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3132 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XdxpZ3I66P.bat"18⤵PID:3392
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:6056
-
-
C:\Users\All Users\Application Data\sppsvc.exe"C:\Users\All Users\Application Data\sppsvc.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3892 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mWzz7cjAeP.bat"20⤵PID:6080
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:5176
-
-
C:\Users\All Users\Application Data\sppsvc.exe"C:\Users\All Users\Application Data\sppsvc.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1164 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rZY5mW9Lj2.bat"22⤵PID:5312
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:4904
-
-
C:\Users\All Users\Application Data\sppsvc.exe"C:\Users\All Users\Application Data\sppsvc.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3324 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NpgWdIWSbT.bat"24⤵PID:1960
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:4408
-
-
C:\Users\All Users\Application Data\sppsvc.exe"C:\Users\All Users\Application Data\sppsvc.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2088 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wRcBAgH7Mb.bat"26⤵PID:2604
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:5772
-
-
C:\Users\All Users\Application Data\sppsvc.exe"C:\Users\All Users\Application Data\sppsvc.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5624 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nGW3UwTeX7.bat"28⤵PID:5800
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:4328
-
-
C:\Users\All Users\Application Data\sppsvc.exe"C:\Users\All Users\Application Data\sppsvc.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\providercommon\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1236
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:60
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Defender\de-DE\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2572
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\de-DE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\de-DE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:4884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Desktop\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\Desktop\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Desktop\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1516
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\All Users\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\providercommon\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3332
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:3392
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4500
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Desktop\WaaSMedicAgent.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Users\Default\Desktop\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Desktop\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5096
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:944
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3208
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\providercommon\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3564
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:1308
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3676
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Documents\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Admin\Documents\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Documents\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3096
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Windows\LiveKernelReports\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
PID:1708
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3344
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\LiveKernelReports\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\DllCommonsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4304
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4140
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Users\Public\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Public\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Users\Public\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\Java\Java Update\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Java\Java Update\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Java\Java Update\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3756
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\Accessories\ja-JP\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3996
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\ja-JP\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\Accessories\ja-JP\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1900
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Application Data\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1776
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Application Data\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:3720
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Windows\security\cap\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1016
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\security\cap\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:100
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Windows\security\cap\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4924
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\sihost.exe'" /f1⤵
- Process spawned unexpected child process
PID:940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default User\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:3764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Windows\INF\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\INF\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Windows\INF\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3984
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\providercommon\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:552
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\sysmon.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:3364
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\sysmon.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:4684
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\sysmon.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:3284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\StartMenuExperienceHost.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57f3c0ae41f0d9ae10a8985a2c327b8fb
SHA1d58622bf6b5071beacf3b35bb505bde2000983e3
SHA256519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900
SHA5128a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
232B
MD5c92dae945bc627064f25a220310fa7f2
SHA12e40f30c198b30f2b4e71c790f212903c785b1fd
SHA256ba49530dbcde89cae3429cad93d894829c0bf305f0e014ba55df514d1b8b9f5a
SHA5125338b071626ccdff5ed1f892f4bf20c0e6d9c232683cef3a0482f7544f452a85094ce044395eff65438e41a0c51999ff652b50220b9f4e7d77464575045cf5d5
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD53f709e445b23cd8ccc0f58cf0a03c29b
SHA141a7686ad7918155770db630e47a447edba520a2
SHA2568587f24144e8bc85dc291f96255a2db6c1b3994f1754df97f7f1f2291eba3dba
SHA5123ac79066089fc10bcce52d58262afbf3faeff0979a3cd87ac27a4436be35fa0b298cd58503e4cb8f33996723d201d073ec9757b786aa339427f51c814d7943fe
-
Filesize
944B
MD5dd0716df5ff6e2ed8bfa08e271d64dd8
SHA1c342bbe936058ea27843d5dbe5eb434f926612f7
SHA25615ea3598b422f0d7705405688a174b98789b623154d4ccf3f3148f7c10bafdd8
SHA5127e6dc8f9ad269ca3969e7b1284399f16f59559d5a4232537147fb7edcba86932474eff26921c09472894d55ee045dd3e371dcfce65d358785166742582e0b8a4
-
Filesize
944B
MD5be95052f298019b83e11336567f385fc
SHA1556e6abda268afaeeec5e1ee65adc01660b70534
SHA256ebc004fe961bed86adc4025cdbe3349699a5a1fc328cc3a37f3ff055e7e82027
SHA512233df172f37f85d34448901057ff19f20792d6e139579a1235165d5f6056a2075c19c85bc9115a6bb74c9c949aebd7bb5391e2ae9f7b1af69e5c4aca3a48cff5
-
Filesize
944B
MD5c65338524586fc00cf00e679a7d4a1f4
SHA162abf26bfb979dcbf7c7649cf8a681c2a8c7c9ae
SHA256faa246e6b356f55ad8b18cea908dbf9035f67feaa06f8259d934306e13e88bf6
SHA512c6721362afa4998c60ff60225a7b7571aaf1dbc8cb624ad7557b365a37df26e629763fa052dc31904b3175587e940d7e0630362620870c2c7351960a14c29310
-
Filesize
944B
MD521f5d3ab1d5d4c21a30ef164958c17cf
SHA1bf1250e3d9fbff360df4fb0309265d4d7e9bd82d
SHA256660dc0d677d560b86af0dbd19467419cacbba7d005cac2c8347e50b5f29ce5bd
SHA5122a742ba0a4590db7215945ef8db3f0ec2ac5f69f05a3057638e8d2b2260b05902bda19502d1bb9c9945299cb1054910b11f57c19626bd9b191f6a6a4c9e6e4bf
-
Filesize
944B
MD54005826b3da3d8f757d23831ac54fccf
SHA1c6d46a83683b6f578e8f5c1b068b8ea1d10ff07e
SHA256a91b6046ec90a9f56a3e9c633557752c8a6987d13e2b48639a5df1c7d9598865
SHA512056b6af50e597f9ebd68c90740bbca863a0619cae551f0374034f044dc6e89508478b6d7e4c6a6be75a747821437034da4a74f840a42f72b0c16c37d83786520
-
Filesize
944B
MD56b4e39689cee6c9a38f5a03b68b3df72
SHA1af6cc92ac1532a1059151831885c2929d83f8107
SHA25601bd20c1140847c1d579ca92531850535e5b0aaddfce3c8648716dc1cb811f8d
SHA5129fb0e8c8ebd43525f8364eff0d18c02a34c044d14558cfbea351d283f03df9b84e3e32453e296b2cd844b785dcefef75adfeaff401d80462959104033fe7ba02
-
Filesize
944B
MD5745dbfca83673359eb764bd7d2c1c645
SHA1fb5059d796b76420eb14d4add12e48a725f814ce
SHA25669fdb3e3e2f5b69594961928bbc026842ea22f5a5a387847ea28fdaca2689e60
SHA512494dd0908479d5da9a454d0d8da13c7b4fc073f1f168e040b2409f0867b83c100e350af806f8efaa5f15101498a9d6fa698e7966758974f27c10fc8c2bb7b02d
-
Filesize
211B
MD501d72edc215bb90b21c74c1f1f5243bf
SHA1bb355ed2bb7dd7026a8709d8092da8bc3a80adfa
SHA256ab09f1e890b0b1828a551c0a00ceeae9c2f7a3f991b42d0428bd24e623e745ea
SHA51286b99acaf4140cc04e1b2a6efc44ddc271c8e42dc9439c31c9fc5ddaed458fc573da90033b44ffa3e879fd4a6da8daa4aaa9c67c3bccb789f455c8a03ac6e2b7
-
Filesize
211B
MD55b0fee3577653bed0e84658430d996c4
SHA144e11ecd12b600f0691258de8e569d42d37104ae
SHA256f3c1dca49cc4e6cc3b04865c2634a8b0027414d250692092df9c462d6f67e8e0
SHA5123ca9a8bdb5ef7106d336c8100bd82eedef976e092bf9ae3a80c0fe1050557433827ad5674b632e29adab9d02efb4f2b6aadd6a46cde504e11a2c31a9b3063b31
-
Filesize
211B
MD5ca7cc9e02ef380b5bc819a9b5db91441
SHA17d051e9fc9c3cd8d50ff711d5850b617210526ef
SHA2561b6bfa9d172a033480b5a609d3e3073deff6174578ffacbffcb3f0afc7ddfdf7
SHA512ee400ab14a2180dee51e50e0dca47d4d1f276b75770c09cb17343bc7fba24c3864e2ce1a1836e7a467a6861364e2ecc77d36a0f29f000d7142f6711ccf59bf95
-
Filesize
211B
MD5d6863ff0d8d4724d97ad459202ebfb63
SHA16739a16d23ab4ea16cf27dae1c4c6d31f760b461
SHA256314d769d5c474d428905084e5e0da4bdec7a4929234a5f1cc6cb298b4801ef04
SHA512370fe27a3657431fe229d7e1e9e75785e7365f9945d9b90589c7262a6e09852ff0e3fda0e6e8b86ea53340f83fe4097f1ed5136dd00cea1123bfcaef7b34bf04
-
Filesize
211B
MD5c4c4dac3dc26d7377f5b107c65f5be62
SHA1444b776083d6a72bb83c7c026a0643c21f9aa40b
SHA256dfca93b813e57f1e2bb7d2e78ab99fa4e22415ff7481e5f0750c2d0f789d23f1
SHA51247f1846d415457165c06df105229b1019899c8c05216298269782972d4aad843b7350506851a8894e542eb23a46f433e14980dc48757c5b6a48ac4bc7f63ba28
-
Filesize
211B
MD57830b5dee7a106aa1c8a04da6d240aa6
SHA15389d46ac3de19a3f72c310851b9e26aea625590
SHA2561ca88280a75c5a00026149084e0a1ef5eeeabf444635765f04ec0be61c581ec1
SHA5128c00204f21001d34f9ac4a3f87e239a4e0a611514473de3cdd225b38c88f2fa09aab8b70fe6bb34f0cea375febbd2a2e759c85cb79c2566e865cdab8e806e7e4
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
211B
MD553a3467d97a45d52dadeb0ffe9647f94
SHA163cb0d694b9edb50944f8f68833ead663d400f78
SHA256a77a9ddfb960b8ae34219465d9c5cfe969af0e4ddf8f9febeacfddd54092cdd2
SHA5127312bd614fa88396674cabf627a0dc1a17396d3c054a1206899926e50420b1d18a2d9a6ec77f630b815ceb719fdbe6637660a9df319b7655eef5ae9cd9e5bc26
-
Filesize
211B
MD53c31404e7fb7a1913809fced709ed4b9
SHA1c71ec0b755f657ae7c176d16638f72bef4603c59
SHA25639f5e638965b61761538c3fb778d37caa69631ad122978fdf5d6ec4c3dea134e
SHA512202c02ff9ea6999db9447d82e5c42f23ec5e7a1551f46b2e39c05869986e3953425737a302c8368285ccc98807ce3373fda43cffe595e7b892ac0549773a4dbd
-
Filesize
211B
MD5ab0c3903620532063a422342c4ce4b50
SHA1323de37d6daf7e3e83935484edbd23d3ae7f1767
SHA25679fc24621f44f7c505c6f175c98223165e384889e288d396153f63e06439907a
SHA5127db106b941947f139120bed5825a8ffbbd671cca8ac4cfa29089ad9441d5116b6440f1596fd3cd64b5d5c97314ab9a6c8bb9ab8987892923fadac2b3e9dd0268
-
Filesize
211B
MD5aa4513b018b671086ea93ce24cef8484
SHA1011efe2b8899b2180e9ad1c59d2542ee7cccde76
SHA25637dd962a039d2c0dbf59ca6168279d36fbe95294d19aac96d5cf4c07809e04d7
SHA512dfe6fcb53cdf17d2281f0fa878ff78ccd221a5484d280c49e71e6186a6bda92d6877cd1da82afe36864dfc9e49539a709294b07501f5bd91891f2d22c976be84
-
Filesize
211B
MD5774bfab8662fe70ecf5022314d185597
SHA1b585c54cf887d17f1723a4ee4064f9c629ca4ca0
SHA2568ec4b620e1b822a46b10926db1cedfc3fea36e6ad58a49ba330b9e3b3148343e
SHA512c87a4f905ea4de019dc3966fb6456fc1b29c60027205c6162db573b3d62c88a9c1d443a459fb37d867877edbe92ae75f7f87f0dba96b32a1160f9e5c739e7345
-
Filesize
199B
MD5538a7f9864781a16213707f937a63a31
SHA185699a1ffbfc74988c686bdf954dcdc6e580a5e5
SHA256e32de488641b88a84303fec20893f3a3c0341998fdfad50f7fb44358a62410cc
SHA51288c11263c2fbb7080a2202b817df723f0d09807e3d6ff7140a1ccf5c4fb1600648314709db481e9a6d0ecaaccff7d92cec9a428e4b6a132e014485d56817e4dd
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
336B
MD566791f13f2b5e53b7f3cc0f01dbc8aa3
SHA1c1336aa9d2fde99a29c38bdeab5997bed3a99d85
SHA256e9afabac4ed2813db4a7898ba501044c9c85a836e3762f4072b56f1551bbe19a
SHA5129114f287641e1905bb9aac3e88c5d7daacf6739847021641ebabcdd2f4716dd01acc3adfaa6adef5bec1e4d46103a52e1a1394a990d19ee06c95dd21d8e7f8b6
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478