Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/12/2024, 20:47
Behavioral task
behavioral1
Sample
JaffaCakes118_67128e92034a2f427a585b15f1c8883c51b174e6c90afea51797ed91e2b8e9a3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_67128e92034a2f427a585b15f1c8883c51b174e6c90afea51797ed91e2b8e9a3.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_67128e92034a2f427a585b15f1c8883c51b174e6c90afea51797ed91e2b8e9a3.exe
-
Size
1.3MB
-
MD5
40f0e9d4a2fa4beb2b6bbfad4db622c0
-
SHA1
e8c345112ba9f492956dc1cc5d3b5888059f5095
-
SHA256
67128e92034a2f427a585b15f1c8883c51b174e6c90afea51797ed91e2b8e9a3
-
SHA512
ecbd1972978eff67eea2b28d9774bfd9af839c5fbf157d65cf0f5787a5d14feaf814c11fd7e06b85ebd63a136877945862fd29192a40d5bad46bce25beaeeca0
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 57 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3404 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3976 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2884 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2644 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 948 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1316 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4940 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3672 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2240 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3824 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3876 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2672 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4456 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 512 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2512 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3416 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2044 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4660 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1772 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2636 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1908 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4060 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3364 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3668 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1456 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3216 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1592 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4284 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5112 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4916 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4520 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3940 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 788 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2972 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3900 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2592 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1020 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3772 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1712 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2564 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 452 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4016 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4876 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2464 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1724 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4736 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1804 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3208 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4616 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4248 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1096 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4716 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3984 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3784 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4064 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 508 4544 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3760 4544 schtasks.exe 89 -
resource yara_rule behavioral2/files/0x0007000000023c8e-10.dat dcrat behavioral2/memory/2932-13-0x0000000000E90000-0x0000000000FA0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3020 powershell.exe 3700 powershell.exe 4868 powershell.exe 4440 powershell.exe 4432 powershell.exe 1184 powershell.exe 1492 powershell.exe 4148 powershell.exe 4180 powershell.exe 4488 powershell.exe 3644 powershell.exe 1496 powershell.exe 3696 powershell.exe 1840 powershell.exe 3888 powershell.exe 4112 powershell.exe 3116 powershell.exe 4984 powershell.exe 1544 powershell.exe 1396 powershell.exe -
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation JaffaCakes118_67128e92034a2f427a585b15f1c8883c51b174e6c90afea51797ed91e2b8e9a3.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation explorer.exe -
Executes dropped EXE 13 IoCs
pid Process 2932 DllCommonsvc.exe 512 explorer.exe 2752 explorer.exe 2700 explorer.exe 1772 explorer.exe 2080 explorer.exe 3132 explorer.exe 3020 explorer.exe 2108 explorer.exe 4620 explorer.exe 4184 explorer.exe 5940 explorer.exe 5196 explorer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
flow ioc 52 raw.githubusercontent.com 26 raw.githubusercontent.com 38 raw.githubusercontent.com 39 raw.githubusercontent.com 44 raw.githubusercontent.com 45 raw.githubusercontent.com 50 raw.githubusercontent.com 51 raw.githubusercontent.com 16 raw.githubusercontent.com 17 raw.githubusercontent.com 43 raw.githubusercontent.com 53 raw.githubusercontent.com 54 raw.githubusercontent.com -
Drops file in Program Files directory 12 IoCs
description ioc Process File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\cc11b995f2a76d DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\Registry.exe DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\TextInputHost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\9e8d7a4ca61bd9 DllCommonsvc.exe File created C:\Program Files\Mozilla Firefox\services.exe DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\22eafd247d37c3 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\explorer.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\7a0fd90576e088 DllCommonsvc.exe File created C:\Program Files\Mozilla Firefox\c5b4cb5e9653cc DllCommonsvc.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\winlogon.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\ee2ad38f3d4382 DllCommonsvc.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\SystemResources\Windows.UI.SettingsAdminFlowUIThreshold\pris\sppsvc.exe DllCommonsvc.exe File created C:\Windows\SystemResources\Windows.UI.SettingsAdminFlowUIThreshold\pris\0a1fd5f707cd16 DllCommonsvc.exe File created C:\Windows\Tasks\RuntimeBroker.exe DllCommonsvc.exe File created C:\Windows\Tasks\9e8d7a4ca61bd9 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_67128e92034a2f427a585b15f1c8883c51b174e6c90afea51797ed91e2b8e9a3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings JaffaCakes118_67128e92034a2f427a585b15f1c8883c51b174e6c90afea51797ed91e2b8e9a3.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings explorer.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2044 schtasks.exe 2464 schtasks.exe 508 schtasks.exe 3760 schtasks.exe 4940 schtasks.exe 3668 schtasks.exe 3216 schtasks.exe 2564 schtasks.exe 1592 schtasks.exe 2592 schtasks.exe 452 schtasks.exe 4616 schtasks.exe 3784 schtasks.exe 4064 schtasks.exe 3772 schtasks.exe 2644 schtasks.exe 948 schtasks.exe 2240 schtasks.exe 3876 schtasks.exe 2672 schtasks.exe 2636 schtasks.exe 1456 schtasks.exe 4520 schtasks.exe 788 schtasks.exe 3940 schtasks.exe 3364 schtasks.exe 5112 schtasks.exe 4916 schtasks.exe 4248 schtasks.exe 3672 schtasks.exe 4660 schtasks.exe 4060 schtasks.exe 4284 schtasks.exe 2972 schtasks.exe 1712 schtasks.exe 4876 schtasks.exe 1724 schtasks.exe 3900 schtasks.exe 3984 schtasks.exe 3824 schtasks.exe 4736 schtasks.exe 3208 schtasks.exe 3404 schtasks.exe 2512 schtasks.exe 1772 schtasks.exe 3976 schtasks.exe 2884 schtasks.exe 1020 schtasks.exe 3416 schtasks.exe 1908 schtasks.exe 4016 schtasks.exe 1804 schtasks.exe 1096 schtasks.exe 4716 schtasks.exe 1316 schtasks.exe 4456 schtasks.exe 512 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2932 DllCommonsvc.exe 2932 DllCommonsvc.exe 2932 DllCommonsvc.exe 2932 DllCommonsvc.exe 2932 DllCommonsvc.exe 2932 DllCommonsvc.exe 2932 DllCommonsvc.exe 2932 DllCommonsvc.exe 2932 DllCommonsvc.exe 2932 DllCommonsvc.exe 2932 DllCommonsvc.exe 2932 DllCommonsvc.exe 2932 DllCommonsvc.exe 2932 DllCommonsvc.exe 2932 DllCommonsvc.exe 2932 DllCommonsvc.exe 2932 DllCommonsvc.exe 2932 DllCommonsvc.exe 2932 DllCommonsvc.exe 2932 DllCommonsvc.exe 3696 powershell.exe 3696 powershell.exe 1544 powershell.exe 1544 powershell.exe 4432 powershell.exe 4432 powershell.exe 1496 powershell.exe 1496 powershell.exe 4984 powershell.exe 4984 powershell.exe 4868 powershell.exe 4868 powershell.exe 3644 powershell.exe 3644 powershell.exe 1396 powershell.exe 1396 powershell.exe 4488 powershell.exe 4488 powershell.exe 1840 powershell.exe 1840 powershell.exe 1492 powershell.exe 1492 powershell.exe 4180 powershell.exe 4180 powershell.exe 3888 powershell.exe 3888 powershell.exe 4112 powershell.exe 4112 powershell.exe 3116 powershell.exe 3116 powershell.exe 4440 powershell.exe 4440 powershell.exe 3020 powershell.exe 3020 powershell.exe 3700 powershell.exe 3700 powershell.exe 1184 powershell.exe 1184 powershell.exe 3644 powershell.exe 4148 powershell.exe 4148 powershell.exe 3700 powershell.exe 512 explorer.exe 512 explorer.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 2932 DllCommonsvc.exe Token: SeDebugPrivilege 3696 powershell.exe Token: SeDebugPrivilege 1544 powershell.exe Token: SeDebugPrivilege 1496 powershell.exe Token: SeDebugPrivilege 4432 powershell.exe Token: SeDebugPrivilege 3644 powershell.exe Token: SeDebugPrivilege 4984 powershell.exe Token: SeDebugPrivilege 4868 powershell.exe Token: SeDebugPrivilege 1396 powershell.exe Token: SeDebugPrivilege 4488 powershell.exe Token: SeDebugPrivilege 3700 powershell.exe Token: SeDebugPrivilege 1840 powershell.exe Token: SeDebugPrivilege 1492 powershell.exe Token: SeDebugPrivilege 4180 powershell.exe Token: SeDebugPrivilege 3888 powershell.exe Token: SeDebugPrivilege 4112 powershell.exe Token: SeDebugPrivilege 3116 powershell.exe Token: SeDebugPrivilege 4440 powershell.exe Token: SeDebugPrivilege 3020 powershell.exe Token: SeDebugPrivilege 512 explorer.exe Token: SeDebugPrivilege 1184 powershell.exe Token: SeDebugPrivilege 4148 powershell.exe Token: SeDebugPrivilege 2752 explorer.exe Token: SeDebugPrivilege 2700 explorer.exe Token: SeDebugPrivilege 1772 explorer.exe Token: SeDebugPrivilege 2080 explorer.exe Token: SeDebugPrivilege 3132 explorer.exe Token: SeDebugPrivilege 3020 explorer.exe Token: SeDebugPrivilege 2108 explorer.exe Token: SeDebugPrivilege 4620 explorer.exe Token: SeDebugPrivilege 4184 explorer.exe Token: SeDebugPrivilege 5940 explorer.exe Token: SeDebugPrivilege 5196 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2940 wrote to memory of 4804 2940 JaffaCakes118_67128e92034a2f427a585b15f1c8883c51b174e6c90afea51797ed91e2b8e9a3.exe 85 PID 2940 wrote to memory of 4804 2940 JaffaCakes118_67128e92034a2f427a585b15f1c8883c51b174e6c90afea51797ed91e2b8e9a3.exe 85 PID 2940 wrote to memory of 4804 2940 JaffaCakes118_67128e92034a2f427a585b15f1c8883c51b174e6c90afea51797ed91e2b8e9a3.exe 85 PID 4804 wrote to memory of 1816 4804 WScript.exe 86 PID 4804 wrote to memory of 1816 4804 WScript.exe 86 PID 4804 wrote to memory of 1816 4804 WScript.exe 86 PID 1816 wrote to memory of 2932 1816 cmd.exe 88 PID 1816 wrote to memory of 2932 1816 cmd.exe 88 PID 2932 wrote to memory of 4148 2932 DllCommonsvc.exe 148 PID 2932 wrote to memory of 4148 2932 DllCommonsvc.exe 148 PID 2932 wrote to memory of 1544 2932 DllCommonsvc.exe 149 PID 2932 wrote to memory of 1544 2932 DllCommonsvc.exe 149 PID 2932 wrote to memory of 4984 2932 DllCommonsvc.exe 150 PID 2932 wrote to memory of 4984 2932 DllCommonsvc.exe 150 PID 2932 wrote to memory of 3696 2932 DllCommonsvc.exe 151 PID 2932 wrote to memory of 3696 2932 DllCommonsvc.exe 151 PID 2932 wrote to memory of 4868 2932 DllCommonsvc.exe 152 PID 2932 wrote to memory of 4868 2932 DllCommonsvc.exe 152 PID 2932 wrote to memory of 1496 2932 DllCommonsvc.exe 154 PID 2932 wrote to memory of 1496 2932 DllCommonsvc.exe 154 PID 2932 wrote to memory of 3700 2932 DllCommonsvc.exe 156 PID 2932 wrote to memory of 3700 2932 DllCommonsvc.exe 156 PID 2932 wrote to memory of 3020 2932 DllCommonsvc.exe 157 PID 2932 wrote to memory of 3020 2932 DllCommonsvc.exe 157 PID 2932 wrote to memory of 3116 2932 DllCommonsvc.exe 158 PID 2932 wrote to memory of 3116 2932 DllCommonsvc.exe 158 PID 2932 wrote to memory of 4112 2932 DllCommonsvc.exe 159 PID 2932 wrote to memory of 4112 2932 DllCommonsvc.exe 159 PID 2932 wrote to memory of 3644 2932 DllCommonsvc.exe 160 PID 2932 wrote to memory of 3644 2932 DllCommonsvc.exe 160 PID 2932 wrote to memory of 4440 2932 DllCommonsvc.exe 161 PID 2932 wrote to memory of 4440 2932 DllCommonsvc.exe 161 PID 2932 wrote to memory of 4488 2932 DllCommonsvc.exe 163 PID 2932 wrote to memory of 4488 2932 DllCommonsvc.exe 163 PID 2932 wrote to memory of 4432 2932 DllCommonsvc.exe 164 PID 2932 wrote to memory of 4432 2932 DllCommonsvc.exe 164 PID 2932 wrote to memory of 3888 2932 DllCommonsvc.exe 165 PID 2932 wrote to memory of 3888 2932 DllCommonsvc.exe 165 PID 2932 wrote to memory of 1492 2932 DllCommonsvc.exe 167 PID 2932 wrote to memory of 1492 2932 DllCommonsvc.exe 167 PID 2932 wrote to memory of 1184 2932 DllCommonsvc.exe 168 PID 2932 wrote to memory of 1184 2932 DllCommonsvc.exe 168 PID 2932 wrote to memory of 4180 2932 DllCommonsvc.exe 170 PID 2932 wrote to memory of 4180 2932 DllCommonsvc.exe 170 PID 2932 wrote to memory of 1840 2932 DllCommonsvc.exe 171 PID 2932 wrote to memory of 1840 2932 DllCommonsvc.exe 171 PID 2932 wrote to memory of 1396 2932 DllCommonsvc.exe 172 PID 2932 wrote to memory of 1396 2932 DllCommonsvc.exe 172 PID 2932 wrote to memory of 512 2932 DllCommonsvc.exe 188 PID 2932 wrote to memory of 512 2932 DllCommonsvc.exe 188 PID 512 wrote to memory of 636 512 explorer.exe 197 PID 512 wrote to memory of 636 512 explorer.exe 197 PID 636 wrote to memory of 5792 636 cmd.exe 199 PID 636 wrote to memory of 5792 636 cmd.exe 199 PID 636 wrote to memory of 2752 636 cmd.exe 205 PID 636 wrote to memory of 2752 636 cmd.exe 205 PID 2752 wrote to memory of 4716 2752 explorer.exe 209 PID 2752 wrote to memory of 4716 2752 explorer.exe 209 PID 4716 wrote to memory of 2512 4716 cmd.exe 211 PID 4716 wrote to memory of 2512 4716 cmd.exe 211 PID 4716 wrote to memory of 2700 4716 cmd.exe 214 PID 4716 wrote to memory of 2700 4716 cmd.exe 214 PID 2700 wrote to memory of 3876 2700 explorer.exe 216 PID 2700 wrote to memory of 3876 2700 explorer.exe 216 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_67128e92034a2f427a585b15f1c8883c51b174e6c90afea51797ed91e2b8e9a3.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_67128e92034a2f427a585b15f1c8883c51b174e6c90afea51797ed91e2b8e9a3.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Templates\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4984
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3696
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\services.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1496
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\en-US\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3700
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3020
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\Registry.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3116
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\SoftwareDistribution\spoolsv.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3644
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Application Data\sihost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4440
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\SppExtComObj.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4488
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4432
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\TextInputHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3888
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemResources\Windows.UI.SettingsAdminFlowUIThreshold\pris\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1184
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4180
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1840
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Gadgets\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1396
-
-
C:\Users\All Users\Templates\explorer.exe"C:\Users\All Users\Templates\explorer.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tDjG3X7WPV.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:5792
-
-
C:\Users\All Users\Templates\explorer.exe"C:\Users\All Users\Templates\explorer.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cV1vwDPsky.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:2512
-
-
C:\Users\All Users\Templates\explorer.exe"C:\Users\All Users\Templates\explorer.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OoUlhQHDc2.bat"10⤵PID:3876
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:4124
-
-
C:\Users\All Users\Templates\explorer.exe"C:\Users\All Users\Templates\explorer.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1772 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\s2EHkno7yQ.bat"12⤵PID:1172
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:1120
-
-
C:\Users\All Users\Templates\explorer.exe"C:\Users\All Users\Templates\explorer.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2080 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cV1vwDPsky.bat"14⤵PID:3916
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:788
-
-
C:\Users\All Users\Templates\explorer.exe"C:\Users\All Users\Templates\explorer.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3132 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1CKPPXbanu.bat"16⤵PID:5592
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:5676
-
-
C:\Users\All Users\Templates\explorer.exe"C:\Users\All Users\Templates\explorer.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3020 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cOf3pucYXi.bat"18⤵PID:5544
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:5732
-
-
C:\Users\All Users\Templates\explorer.exe"C:\Users\All Users\Templates\explorer.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2108 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Jlvf1Vq2YP.bat"20⤵PID:4188
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:5316
-
-
C:\Users\All Users\Templates\explorer.exe"C:\Users\All Users\Templates\explorer.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4620 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Jlvf1Vq2YP.bat"22⤵PID:4148
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:4052
-
-
C:\Users\All Users\Templates\explorer.exe"C:\Users\All Users\Templates\explorer.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4184 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EtrZeLjFvq.bat"24⤵PID:3488
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:6080
-
-
C:\Users\All Users\Templates\explorer.exe"C:\Users\All Users\Templates\explorer.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5940 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\be8zRZs4e0.bat"26⤵PID:2136
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:5060
-
-
C:\Users\All Users\Templates\explorer.exe"C:\Users\All Users\Templates\explorer.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5196 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\00pP7nIBMq.bat"28⤵PID:4664
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:1400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Templates\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\Templates\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3976
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Templates\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\providercommon\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\providercommon\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:512
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3416
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4660
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\Tasks\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Tasks\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\Tasks\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3364
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\SoftwareDistribution\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\SoftwareDistribution\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4916
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Application Data\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Application Data\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:788
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\providercommon\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3900
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\providercommon\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\providercommon\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1020
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3772
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:452
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4016
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Windows\SystemResources\Windows.UI.SettingsAdminFlowUIThreshold\pris\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\SystemResources\Windows.UI.SettingsAdminFlowUIThreshold\pris\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Windows\SystemResources\Windows.UI.SettingsAdminFlowUIThreshold\pris\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3208
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4616
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4248
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4716
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3984
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3784
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:508
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD5e448fe0d240184c6597a31d3be2ced58
SHA1372b8d8c19246d3e38cd3ba123cc0f56070f03cd
SHA256c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391
SHA5120b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
206B
MD562930e3fa5526bbfbc74fa5c503c02ad
SHA1c723675b50bf12d1d0c662d4655a1cec0434cf65
SHA256f9230b9416e35ca3098765741ff97df0c6aec107a265a402e99f88497cefd677
SHA5127f36011e0b1ced4ccb1ede925f728855a75553b00e74f62dd2127ca94e9a7a6a206623f85e54ede857853c2c0c45dfcdc527870104dbccfddaf00b9c7329b803
-
Filesize
206B
MD52df272f6956dcc52c15164f23e750b3a
SHA191192adb2230401f55998ece1538c025ce71080c
SHA256876e65aa09c49591a047c7ed2bc13c89f4659ff5812008a51306c0df940cf5c7
SHA5127342b7aa7b906a5c986f31adf2bb6b3c6e8a4058d0c47b9610d6903d1ab25785642001d2b3567fa6293f50db152e9c58f93708171ba25767bcfacbb94ab6bc6b
-
Filesize
206B
MD52ab937e194b739db61305c9b29fff838
SHA1d46947b4ef208c9bfceea010601c5df755eb5701
SHA256967bf32760ffd742cb2751f3929db35af29a76b3e0d12d5006b9368035f45e13
SHA5124b1312f899d62c30b169e2347d16179e3ff585433c98b88ed0036850f86ffe1c1089a3c036088ba3e9d1e0e454694a734dc280e1a828574ababa62182bcd59d6
-
Filesize
206B
MD51bae95c9df29dfdeb4b8f85c9f7372cf
SHA13fc3198fdd271afdeb85260f9a050220ea7f2817
SHA25636d53b18d5362c30cda38909d05bbf66d8f26ea42dfcf73d57bb452ef1810e7b
SHA512a15eacdf9739e8b685947ba80704d6c3eb6fc127304a54a21e63c275091e4204cd3566be521fcc6cf331bbbdf1a5e55c490032a87368196d4754fb2d4a443318
-
Filesize
206B
MD5119e2b0f36602e5e49185d6cc5dd0d9d
SHA1f7f6d69080c31d5aa8f2b43601c246d40a86e8fa
SHA25650eca5cfc77703c2f08e864fcbd1bac41fa9a2dcc9c2901f3f031913c1a103ea
SHA51298267fe59690abcd232279245b22b00e97b1727363aecdd65980e3b392d3b4834f03b89940a68bc663c53d2297c0072a39fcd4c92782ace9a31fc2ce19a343ce
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
206B
MD596052e6f0d7fb500f4a9e4d53ebd5498
SHA13bfbf351b33b281cd7db03d02fda1df3a68ec0ca
SHA25611b096ce39758e5f7482f42353d8c52e7b6e411fdfff3fafa4887bf8ff8c73e5
SHA512f0a9b818177d92fcbd2736d2a01f3c784c3fe4e66c9fcbcdf8556f674c7bc10bc478695cfce7a49923a801a50bceb2b76c8d66181e93293b98da27e951e2cd11
-
Filesize
206B
MD55aa9d6dddd85f5585006a6a2239cd722
SHA158d5184218ccd733b6f8c6df76ca7bf83b189e19
SHA2565b6617d9c5ac469c852437137b60fcfa5f26ecec8c511671d16550fa4d415f41
SHA51238022942d9e335df2a2590df121a0a4182f15035b633c6a018c4bb8e38b7f4d182a293e254efd1fb89704f59ac86e4f50959cb1954ba269b9808a9c1316cdc99
-
Filesize
206B
MD5b4643f0388b6b55e45bd69435472fe0e
SHA13c9656f6331c4fff6fe069e14921c8ccdbd716af
SHA25659bcfe1e62916b2526b58b3f90769696b3be4ce28948fe706e3c23a5982d6f64
SHA512f5ad67df44837e3191ea06d5848cd0f68cfe614b7dc0bc8b755475ac136756ebe55c834b6ca0ab8837fccdb9315abf0b5be6c97e7109761586cb285f02b34354
-
Filesize
206B
MD59f229a7a5d590374d631da84d159dde9
SHA1e4bda501791b3b749d0724558253334279654647
SHA2564a5cbfa4c8d80e732e4c2ba2fb67d321cb7013b0572a23877836e15eb760f568
SHA512dc7754ec5f025a9d3a3b9979bda3da9d69017e8fc1cbb6fcaebc87df5c89a60f69cf325aada232f62f3ef776ab624f5802e8aebd2d9719943b4fef8dce0086b4
-
Filesize
206B
MD53b394518f783e019f976145fe87e432f
SHA1f8d303d418d3fe8fb4ec92098b75d02121f54eb2
SHA256372e788a3b47f7dd57248dd84f19430a04367cb3ead9c0eb7f9f9a5a6077f3f5
SHA51219be8bf63b3efa4005f0fdb2e33bda091e77485efe5dc2ea32587aeb5d3f5646131621ff049c192eb62bf89e82a66da9ce89dbbb49a8bb7220e4b3f257158f27
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478