Analysis
-
max time kernel
148s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-12-2024 20:39
Behavioral task
behavioral1
Sample
JaffaCakes118_74923c5d4bbc06b927e307c7685ba04375ccde9a565da6be0f0bd2b8dc167247.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_74923c5d4bbc06b927e307c7685ba04375ccde9a565da6be0f0bd2b8dc167247.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_74923c5d4bbc06b927e307c7685ba04375ccde9a565da6be0f0bd2b8dc167247.exe
-
Size
1.3MB
-
MD5
529a45efc155aaa872854d4c33effc8c
-
SHA1
48cee4c8a3cd4009aeb3c3e072e08427c1b88715
-
SHA256
74923c5d4bbc06b927e307c7685ba04375ccde9a565da6be0f0bd2b8dc167247
-
SHA512
e04c122507b00a93e9f30884c927ac5f71f2a50cc136c4bcd505a36e80ff86f1be6fd3a9e0a3d3c757f01cf815d6e81c2007463c78ab8a5b358cf5d44558843f
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 51 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3736 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3660 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3728 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2740 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2180 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 868 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1000 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 888 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1484 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2352 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 388 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2776 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3520 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 244 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2568 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 320 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1980 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3928 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1156 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3528 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3588 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5052 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 856 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3064 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4832 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2464 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3628 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4768 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1764 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4516 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 740 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 212 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5072 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3836 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3400 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4284 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1548 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3324 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 748 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4520 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4072 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 764 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 376 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2736 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2564 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1684 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4488 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3316 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3216 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3272 3712 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3268 3712 schtasks.exe 86 -
resource yara_rule behavioral2/files/0x000a000000023b6d-10.dat dcrat behavioral2/memory/2372-13-0x00000000001A0000-0x00000000002B0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2056 powershell.exe 1880 powershell.exe 1512 powershell.exe 5008 powershell.exe 1068 powershell.exe 3456 powershell.exe 2124 powershell.exe 3984 powershell.exe 5044 powershell.exe 3412 powershell.exe 2092 powershell.exe 452 powershell.exe 3960 powershell.exe 3172 powershell.exe 3888 powershell.exe 432 powershell.exe 2112 powershell.exe 1864 powershell.exe -
Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation JaffaCakes118_74923c5d4bbc06b927e307c7685ba04375ccde9a565da6be0f0bd2b8dc167247.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation dllhost.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation dllhost.exe -
Executes dropped EXE 13 IoCs
pid Process 2372 DllCommonsvc.exe 5376 dllhost.exe 5996 dllhost.exe 2144 dllhost.exe 5040 dllhost.exe 856 dllhost.exe 4484 dllhost.exe 3100 dllhost.exe 3352 dllhost.exe 5280 dllhost.exe 116 dllhost.exe 5812 dllhost.exe 6000 dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
flow ioc 49 raw.githubusercontent.com 51 raw.githubusercontent.com 53 raw.githubusercontent.com 17 raw.githubusercontent.com 18 raw.githubusercontent.com 39 raw.githubusercontent.com 40 raw.githubusercontent.com 44 raw.githubusercontent.com 54 raw.githubusercontent.com 31 raw.githubusercontent.com 45 raw.githubusercontent.com 52 raw.githubusercontent.com -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Photo Viewer\e6c9b481da804f DllCommonsvc.exe File created C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\66fc9ff0ee96c2 DllCommonsvc.exe File created C:\Program Files (x86)\Google\Idle.exe DllCommonsvc.exe File created C:\Program Files\WindowsPowerShell\9e8d7a4ca61bd9 DllCommonsvc.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\9e8d7a4ca61bd9 DllCommonsvc.exe File created C:\Program Files\Windows Media Player\22eafd247d37c3 DllCommonsvc.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\RuntimeBroker.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Photo Viewer\OfficeClickToRun.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows NT\Accessories\en-US\5940a34987c991 DllCommonsvc.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\sihost.exe DllCommonsvc.exe File created C:\Program Files\Windows Security\BrowserCore\en-US\DllCommonsvc.exe DllCommonsvc.exe File created C:\Program Files\Windows Security\BrowserCore\en-US\a76d7bf15d8370 DllCommonsvc.exe File created C:\Program Files (x86)\Google\6ccacd8608530f DllCommonsvc.exe File created C:\Program Files\WindowsPowerShell\RuntimeBroker.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\fr-FR\taskhostw.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\fr-FR\ea9f0e6c9e2dcd DllCommonsvc.exe File created C:\Program Files\Windows Media Player\TextInputHost.exe DllCommonsvc.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\IdentityCRL\production\dwm.exe DllCommonsvc.exe File opened for modification C:\Windows\IdentityCRL\production\dwm.exe DllCommonsvc.exe File created C:\Windows\IdentityCRL\production\6cb0b6c459d5d3 DllCommonsvc.exe File created C:\Windows\Provisioning\Packages\services.exe DllCommonsvc.exe File created C:\Windows\Provisioning\Packages\c5b4cb5e9653cc DllCommonsvc.exe File created C:\Windows\TAPI\dllhost.exe DllCommonsvc.exe File created C:\Windows\TAPI\5940a34987c991 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_74923c5d4bbc06b927e307c7685ba04375ccde9a565da6be0f0bd2b8dc167247.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings JaffaCakes118_74923c5d4bbc06b927e307c7685ba04375ccde9a565da6be0f0bd2b8dc167247.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings dllhost.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings dllhost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3064 schtasks.exe 740 schtasks.exe 1548 schtasks.exe 4072 schtasks.exe 4488 schtasks.exe 3272 schtasks.exe 1484 schtasks.exe 244 schtasks.exe 1000 schtasks.exe 3928 schtasks.exe 5052 schtasks.exe 2464 schtasks.exe 3628 schtasks.exe 212 schtasks.exe 3736 schtasks.exe 2180 schtasks.exe 764 schtasks.exe 3216 schtasks.exe 3520 schtasks.exe 2568 schtasks.exe 1980 schtasks.exe 1764 schtasks.exe 3324 schtasks.exe 2736 schtasks.exe 3660 schtasks.exe 868 schtasks.exe 4516 schtasks.exe 3836 schtasks.exe 2564 schtasks.exe 2352 schtasks.exe 3588 schtasks.exe 4832 schtasks.exe 3316 schtasks.exe 3400 schtasks.exe 376 schtasks.exe 1684 schtasks.exe 388 schtasks.exe 856 schtasks.exe 5072 schtasks.exe 4520 schtasks.exe 2740 schtasks.exe 888 schtasks.exe 320 schtasks.exe 1156 schtasks.exe 3528 schtasks.exe 4768 schtasks.exe 4284 schtasks.exe 748 schtasks.exe 3728 schtasks.exe 2776 schtasks.exe 3268 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2372 DllCommonsvc.exe 2372 DllCommonsvc.exe 2372 DllCommonsvc.exe 1512 powershell.exe 1512 powershell.exe 2056 powershell.exe 2056 powershell.exe 3172 powershell.exe 3172 powershell.exe 3960 powershell.exe 3960 powershell.exe 5044 powershell.exe 5044 powershell.exe 2124 powershell.exe 2124 powershell.exe 1068 powershell.exe 1068 powershell.exe 3412 powershell.exe 3412 powershell.exe 452 powershell.exe 452 powershell.exe 2112 powershell.exe 2112 powershell.exe 3456 powershell.exe 3456 powershell.exe 432 powershell.exe 432 powershell.exe 1880 powershell.exe 1880 powershell.exe 3984 powershell.exe 3984 powershell.exe 2092 powershell.exe 2092 powershell.exe 1864 powershell.exe 1864 powershell.exe 2056 powershell.exe 3960 powershell.exe 5008 powershell.exe 5008 powershell.exe 3888 powershell.exe 3888 powershell.exe 1068 powershell.exe 432 powershell.exe 3412 powershell.exe 1512 powershell.exe 1512 powershell.exe 3172 powershell.exe 5044 powershell.exe 3456 powershell.exe 2124 powershell.exe 2112 powershell.exe 2092 powershell.exe 1880 powershell.exe 3984 powershell.exe 1864 powershell.exe 452 powershell.exe 5008 powershell.exe 3888 powershell.exe 5376 dllhost.exe 5996 dllhost.exe 2144 dllhost.exe 5040 dllhost.exe 856 dllhost.exe 4484 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 2372 DllCommonsvc.exe Token: SeDebugPrivilege 1512 powershell.exe Token: SeDebugPrivilege 2056 powershell.exe Token: SeDebugPrivilege 3172 powershell.exe Token: SeDebugPrivilege 3960 powershell.exe Token: SeDebugPrivilege 3456 powershell.exe Token: SeDebugPrivilege 5044 powershell.exe Token: SeDebugPrivilege 2124 powershell.exe Token: SeDebugPrivilege 1068 powershell.exe Token: SeDebugPrivilege 3412 powershell.exe Token: SeDebugPrivilege 452 powershell.exe Token: SeDebugPrivilege 5008 powershell.exe Token: SeDebugPrivilege 1864 powershell.exe Token: SeDebugPrivilege 2092 powershell.exe Token: SeDebugPrivilege 2112 powershell.exe Token: SeDebugPrivilege 432 powershell.exe Token: SeDebugPrivilege 1880 powershell.exe Token: SeDebugPrivilege 3984 powershell.exe Token: SeDebugPrivilege 3888 powershell.exe Token: SeDebugPrivilege 5376 dllhost.exe Token: SeDebugPrivilege 5996 dllhost.exe Token: SeDebugPrivilege 2144 dllhost.exe Token: SeDebugPrivilege 5040 dllhost.exe Token: SeDebugPrivilege 856 dllhost.exe Token: SeDebugPrivilege 4484 dllhost.exe Token: SeDebugPrivilege 3100 dllhost.exe Token: SeDebugPrivilege 3352 dllhost.exe Token: SeDebugPrivilege 5280 dllhost.exe Token: SeDebugPrivilege 116 dllhost.exe Token: SeDebugPrivilege 5812 dllhost.exe Token: SeDebugPrivilege 6000 dllhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3432 wrote to memory of 1396 3432 JaffaCakes118_74923c5d4bbc06b927e307c7685ba04375ccde9a565da6be0f0bd2b8dc167247.exe 82 PID 3432 wrote to memory of 1396 3432 JaffaCakes118_74923c5d4bbc06b927e307c7685ba04375ccde9a565da6be0f0bd2b8dc167247.exe 82 PID 3432 wrote to memory of 1396 3432 JaffaCakes118_74923c5d4bbc06b927e307c7685ba04375ccde9a565da6be0f0bd2b8dc167247.exe 82 PID 1396 wrote to memory of 1964 1396 WScript.exe 83 PID 1396 wrote to memory of 1964 1396 WScript.exe 83 PID 1396 wrote to memory of 1964 1396 WScript.exe 83 PID 1964 wrote to memory of 2372 1964 cmd.exe 85 PID 1964 wrote to memory of 2372 1964 cmd.exe 85 PID 2372 wrote to memory of 3888 2372 DllCommonsvc.exe 138 PID 2372 wrote to memory of 3888 2372 DllCommonsvc.exe 138 PID 2372 wrote to memory of 3172 2372 DllCommonsvc.exe 139 PID 2372 wrote to memory of 3172 2372 DllCommonsvc.exe 139 PID 2372 wrote to memory of 3960 2372 DllCommonsvc.exe 140 PID 2372 wrote to memory of 3960 2372 DllCommonsvc.exe 140 PID 2372 wrote to memory of 1512 2372 DllCommonsvc.exe 141 PID 2372 wrote to memory of 1512 2372 DllCommonsvc.exe 141 PID 2372 wrote to memory of 1864 2372 DllCommonsvc.exe 142 PID 2372 wrote to memory of 1864 2372 DllCommonsvc.exe 142 PID 2372 wrote to memory of 1880 2372 DllCommonsvc.exe 143 PID 2372 wrote to memory of 1880 2372 DllCommonsvc.exe 143 PID 2372 wrote to memory of 1068 2372 DllCommonsvc.exe 145 PID 2372 wrote to memory of 1068 2372 DllCommonsvc.exe 145 PID 2372 wrote to memory of 5008 2372 DllCommonsvc.exe 146 PID 2372 wrote to memory of 5008 2372 DllCommonsvc.exe 146 PID 2372 wrote to memory of 2056 2372 DllCommonsvc.exe 148 PID 2372 wrote to memory of 2056 2372 DllCommonsvc.exe 148 PID 2372 wrote to memory of 5044 2372 DllCommonsvc.exe 149 PID 2372 wrote to memory of 5044 2372 DllCommonsvc.exe 149 PID 2372 wrote to memory of 2112 2372 DllCommonsvc.exe 150 PID 2372 wrote to memory of 2112 2372 DllCommonsvc.exe 150 PID 2372 wrote to memory of 3984 2372 DllCommonsvc.exe 151 PID 2372 wrote to memory of 3984 2372 DllCommonsvc.exe 151 PID 2372 wrote to memory of 452 2372 DllCommonsvc.exe 152 PID 2372 wrote to memory of 452 2372 DllCommonsvc.exe 152 PID 2372 wrote to memory of 2092 2372 DllCommonsvc.exe 153 PID 2372 wrote to memory of 2092 2372 DllCommonsvc.exe 153 PID 2372 wrote to memory of 2124 2372 DllCommonsvc.exe 154 PID 2372 wrote to memory of 2124 2372 DllCommonsvc.exe 154 PID 2372 wrote to memory of 3456 2372 DllCommonsvc.exe 155 PID 2372 wrote to memory of 3456 2372 DllCommonsvc.exe 155 PID 2372 wrote to memory of 3412 2372 DllCommonsvc.exe 156 PID 2372 wrote to memory of 3412 2372 DllCommonsvc.exe 156 PID 2372 wrote to memory of 432 2372 DllCommonsvc.exe 167 PID 2372 wrote to memory of 432 2372 DllCommonsvc.exe 167 PID 2372 wrote to memory of 952 2372 DllCommonsvc.exe 173 PID 2372 wrote to memory of 952 2372 DllCommonsvc.exe 173 PID 952 wrote to memory of 3968 952 cmd.exe 176 PID 952 wrote to memory of 3968 952 cmd.exe 176 PID 952 wrote to memory of 5376 952 cmd.exe 177 PID 952 wrote to memory of 5376 952 cmd.exe 177 PID 5376 wrote to memory of 5780 5376 dllhost.exe 182 PID 5376 wrote to memory of 5780 5376 dllhost.exe 182 PID 5780 wrote to memory of 5840 5780 cmd.exe 184 PID 5780 wrote to memory of 5840 5780 cmd.exe 184 PID 5780 wrote to memory of 5996 5780 cmd.exe 187 PID 5780 wrote to memory of 5996 5780 cmd.exe 187 PID 5996 wrote to memory of 224 5996 dllhost.exe 189 PID 5996 wrote to memory of 224 5996 dllhost.exe 189 PID 224 wrote to memory of 1960 224 cmd.exe 191 PID 224 wrote to memory of 1960 224 cmd.exe 191 PID 224 wrote to memory of 2144 224 cmd.exe 193 PID 224 wrote to memory of 2144 224 cmd.exe 193 PID 2144 wrote to memory of 4240 2144 dllhost.exe 194 PID 2144 wrote to memory of 4240 2144 dllhost.exe 194 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74923c5d4bbc06b927e307c7685ba04375ccde9a565da6be0f0bd2b8dc167247.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74923c5d4bbc06b927e307c7685ba04375ccde9a565da6be0f0bd2b8dc167247.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3888
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IdentityCRL\production\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3172
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\OfficeClickToRun.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1512
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1880
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1068
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\StartMenuExperienceHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5008
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\en-US\sihost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2056
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Provisioning\Packages\services.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5044
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\BrowserCore\en-US\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2112
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3984
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Start Menu\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:452
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\123.0.6312.123\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\fr-FR\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3456
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\TextInputHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:432
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FDF0FUyXE1.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:3968
-
-
C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VF9LbKHiRa.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:5840
-
-
C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qpvm5o68kg.bat"9⤵
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:1960
-
-
C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4WSxKcEorb.bat"11⤵PID:4240
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:5080
-
-
C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5040 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PCaGvPqXNx.bat"13⤵PID:2056
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:4772
-
-
C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:856 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GN7B3lpeta.bat"15⤵PID:3792
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:912
-
-
C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4484 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\h6oaLUsZTY.bat"17⤵PID:1608
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:5276
-
-
C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3100 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9Z120WfzwF.bat"19⤵PID:1744
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:3736
-
-
C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3352 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vhzsSyDvNE.bat"21⤵PID:5264
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:3756
-
-
C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5280 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iqKdioc4MG.bat"23⤵PID:3064
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:5296
-
-
C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:116 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rgoiaSdxpd.bat"25⤵PID:5800
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:5412
-
-
C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5812 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\h6oaLUsZTY.bat"27⤵PID:6048
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:228⤵PID:464
-
-
C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Windows\IdentityCRL\production\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\production\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3660
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Windows\IdentityCRL\production\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1000
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:888
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:388
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\providercommon\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:244
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:320
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3928
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Admin\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3588
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5052
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Windows\Provisioning\Packages\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4832
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Provisioning\Packages\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Windows\Provisioning\Packages\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3628
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\DllCommonsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4768
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4516
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Start Menu\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3400
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Start Menu\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1548
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3324
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\WindowsPowerShell\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:748
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4072
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:376
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Windows\TAPI\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\TAPI\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\TAPI\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Media Player\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3268
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD57fbcdf14d94ee311bc918616be08d881
SHA161b782b49310650c92cab5865cb7df1c8c4480ee
SHA256411aa8e5ac695391cae3e706a317f7872f2df070b09331d82166ff6bf15734af
SHA512b2e48c05a63a0a3c5ac88c88f7dadce21b0529ecce0462875b93e819ab61eb2f7a56dda8449d516bb0fd8ef525c63dfed25143004cd7a4e10a0552fdc499889b
-
Filesize
944B
MD55b35d9054fe064d79c6690c1d08435e9
SHA1c9c0073dfc0570dc64cfada8b57dc3d575f18672
SHA2562f234140cb2c3c46569220479bb9302a9403677b35cd7e84a3690c90dac0676b
SHA5128d054de79974020bc520326608aff75ae3de024a046381c447347cbbab0ee747ae83b8b2ce9a134073bf9de8d2561ee44417de317853c781ded119c3f923a8c4
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD56c47b3f4e68eebd47e9332eebfd2dd4e
SHA167f0b143336d7db7b281ed3de5e877fa87261834
SHA2568c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c
SHA5120acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
228B
MD5744719576616db1f15af69ade7880062
SHA1b26ecc81449ded6a40add1a0f02cfb429ef3a0f5
SHA2560b717b21c8f738af91dd458454a086f971f3b7da0ce98e60c0fc6c4683a8def7
SHA5129a395c67013f9b4bd6ec28a2b273a55ed90a4ee5ee3be1a0e25cbae205359b3e1f4fbb42b447b96b212a45540017763c37170be9cb3ac5e84c2db9b124e3a690
-
Filesize
228B
MD5662e45f12ee2e390f51bd48225cd9127
SHA1ad4b884abed2b01d9557b77c644f691cd14e5824
SHA25634ba86800ba1efe7a5795ef1e7136b1e6f8f03c434bd2fd0fd2298cfa1101780
SHA51276a56f722fc159e257b60e83665bcf2d5fd34021fa4d119cf0f2f6966f967c614e1ad22183fea68691e43cf6ec41bc09cd9544fd896b7f29e6b8709cdaeec05f
-
Filesize
228B
MD5969789ea7da245c239212b9d25144d5b
SHA1881a94204b0f1e2741b53190cfed9ab38119d8da
SHA2566f053f34e674d582b0352f39407be40d48bb4897b315f588d311cf653755ec33
SHA5127874c8281a6918b9d077f75afe99e9aceb5148cc964c1511766c6d44f10aa4e4731fc0c827e37e33c3ec7ef78b3a95ab23d57c357941f201383abfa71c6ec162
-
Filesize
228B
MD5a9a58622d604270137133578c555d876
SHA185a46916a1c054082c5bb158aadc437767b96f5d
SHA256a55382192ac9604a9b22bea12fd416b6ceb7b5450bf90af15b74130347bd029f
SHA5127a51775d421dd629f3f181b611b49e710cbb71dd4fec398c7c9cfdfbd584f75d301a839fb76e6028ad4645d331bbf276a7bb08b49d04bdc61d9e703b26831369
-
Filesize
228B
MD590973ae88f03e70d560cfc5a72ace48b
SHA135c22d459d70c7ca4157f4b0ea8238ffca7d74e8
SHA256f583ca58b0abdd925199b2e1e5ba8cef93ce49b49231268fad2c1098f7e1549d
SHA51254d469d787a2f06fe1b1d8dfddd3940c15f9f20a71b283fb6bfeb53fae821cc5ba341444cf58939a91412370c37f6e54ab4d8a86c4e2c31d0055f2ff7fe58e0d
-
Filesize
228B
MD5ba938f7c2a089bbe7f264c678722a415
SHA1196a13b8cdde43bc21e8f1c9d7dbcac5311cea85
SHA256fc13a566458622c6fc8269bbd2a6224bd72e7c87fa695e91d5c31c6166c56a64
SHA51245b50ada45a2a908419fea9255bb22d41d5e284c707b052f51866f2a29a0eac7dbaac2bdcea8599c571982c3585e95335f3ba2660d9068192dacd5210d8219a0
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
228B
MD5444ba2b87001ec5a391ed006fa370573
SHA14f26e8f5325c1db919de237eafaa3a2cfb55d112
SHA256ce9de3d78ff64a9976ee560fcd989fb96feb25fe01142dd86e0ebdd20be86a6a
SHA512548a5db74965785b1f0bcc14873e0f59737a8888bb70cc10eab3402a2d8d16451a9949fe51bea05075158edc0490b966afaa90dc1287c09a54ee6709362669cc
-
Filesize
228B
MD5148c588d7f7de91cf25baf4cc88720b2
SHA1c279e30c2cf4b66da4f0e01f91029423e3bfcf87
SHA2567cfb1a4f934872bac6213eea549ed0a1324f85d7f5841b4610cd2563ea23100d
SHA5125a9278d05c2f1d5b69632e6b3445fb54ff8ea84fd4f05e4cee12e0b0b68cfaff15d6d719a0d1c1c42b3302a887c8fa23ddbb784478019c936950ba9be0a6fa31
-
Filesize
228B
MD5a43044c5819d8612b2c7bbb4374451ed
SHA14431df1b4d0dc2f0abaff25669cbc5243a89c3a8
SHA2568bd5d14f861031b96cc79720b39b1e4ea2b4be4a5b20c7084718a310f434ef69
SHA51278d56c6f235908bcbd857974f1d794cccef10422b0107af13cefbcbba67761be651d000834eb6ab97e60dc24048fa743034c6e858fc3d7f911a49544ed54b31b
-
Filesize
228B
MD559710e624bf9d4cc2803364c1e4ecce7
SHA1a712dd6c8eb597c26b867a90659cacfdae30d1bf
SHA2564b687add3f25fd3f93938cdc27c0322fa32388a13f8c5b2246b273f297ee7bcc
SHA512a840ef1bcefb99f54ea676605a6661337e0f4238fd3c91f4faa033474493d8c0872af4e80e46370bb1849a7c1c370e0d13d9c8165691a80e33bd7d462e671b45
-
Filesize
228B
MD57e45ea3e18c14a715b90a361485f6018
SHA1cd8b30d6c28b017f90436802700bd74e25ddc9ff
SHA256ed8900899124aa72bfd090338037e2cf15fb87ab9ad4a2d052d87f9ee8e91540
SHA51259e1d86c90f48eb1d105c4a1f9ab4945072a224c23465ff83e2148d7f55446fdfa810eca8c1b23ae9c953e3782f4df0016f7cb800b0bd7f944093b9b03a3d34c
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478