Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/12/2024, 10:54
Behavioral task
behavioral1
Sample
JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe
-
Size
1.3MB
-
MD5
b1d7cd07cae2eb6aba7cf2f227c5003d
-
SHA1
9172f04fb782a2a927a496bc3c83124ff289dad7
-
SHA256
f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6
-
SHA512
e20f021c663f601a9888ed1e9ff76b644c1014f059995fd45a4796aa1842887fd6f7c52bdaa1707470acd41ca7f7dfadd248ac7bd5b1eaaf10780b48cd90834c
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 54 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2708 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2792 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2612 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2680 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1416 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3056 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1332 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 848 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1304 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2132 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1224 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1800 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 900 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2796 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1564 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2956 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1212 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 820 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1448 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2124 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2480 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1804 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1412 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2172 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2464 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1856 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1952 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1032 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2276 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 840 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1744 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1308 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 704 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1768 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2376 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1904 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1780 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1764 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2568 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 568 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1072 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1196 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1652 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1624 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2412 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 688 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1736 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1932 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 528 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1728 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1560 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2524 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2104 2812 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1620 2812 schtasks.exe 35 -
resource yara_rule behavioral1/files/0x0008000000015d59-9.dat dcrat behavioral1/memory/2816-13-0x0000000000340000-0x0000000000450000-memory.dmp dcrat behavioral1/memory/1660-60-0x00000000010D0000-0x00000000011E0000-memory.dmp dcrat behavioral1/memory/1736-215-0x0000000001220000-0x0000000001330000-memory.dmp dcrat behavioral1/memory/1436-275-0x0000000000050000-0x0000000000160000-memory.dmp dcrat behavioral1/memory/1584-335-0x00000000000E0000-0x00000000001F0000-memory.dmp dcrat behavioral1/memory/1276-395-0x0000000000C20000-0x0000000000D30000-memory.dmp dcrat behavioral1/memory/2704-515-0x0000000000080000-0x0000000000190000-memory.dmp dcrat behavioral1/memory/848-575-0x0000000001090000-0x00000000011A0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2968 powershell.exe 2552 powershell.exe 1220 powershell.exe 2980 powershell.exe 2740 powershell.exe 1520 powershell.exe 2752 powershell.exe 2660 powershell.exe 2632 powershell.exe 2608 powershell.exe 2876 powershell.exe 2792 powershell.exe 1900 powershell.exe 2944 powershell.exe 2652 powershell.exe 2620 powershell.exe 2836 powershell.exe 2572 powershell.exe 2900 powershell.exe -
Executes dropped EXE 13 IoCs
pid Process 2816 DllCommonsvc.exe 1660 dwm.exe 1736 dwm.exe 1436 dwm.exe 1584 dwm.exe 1276 dwm.exe 1656 dwm.exe 2704 dwm.exe 848 dwm.exe 316 dwm.exe 1620 dwm.exe 2316 dwm.exe 1172 dwm.exe -
Loads dropped DLL 2 IoCs
pid Process 2760 cmd.exe 2760 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
flow ioc 40 raw.githubusercontent.com 4 raw.githubusercontent.com 5 raw.githubusercontent.com 9 raw.githubusercontent.com 16 raw.githubusercontent.com 22 raw.githubusercontent.com 33 raw.githubusercontent.com 12 raw.githubusercontent.com 19 raw.githubusercontent.com 26 raw.githubusercontent.com 29 raw.githubusercontent.com 36 raw.githubusercontent.com -
Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Portable Devices\69ddcba757bf72 DllCommonsvc.exe File created C:\Program Files\Microsoft Games\Minesweeper\ja-JP\6cb0b6c459d5d3 DllCommonsvc.exe File created C:\Program Files (x86)\Internet Explorer\en-US\42af1c969fbb7b DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\smss.exe DllCommonsvc.exe File created C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\WMIADAP.exe DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\75a57c1bdf437c DllCommonsvc.exe File created C:\Program Files (x86)\Internet Explorer\en-US\audiodg.exe DllCommonsvc.exe File created C:\Program Files\Google\Chrome\Application\lsm.exe DllCommonsvc.exe File created C:\Program Files\Google\Chrome\Application\101b941d020240 DllCommonsvc.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\debug\WIA\0a1fd5f707cd16 DllCommonsvc.exe File created C:\Windows\assembly\GAC_MSIL\explorer.exe DllCommonsvc.exe File created C:\Windows\Migration\WTR\DllCommonsvc.exe DllCommonsvc.exe File created C:\Windows\Offline Web Pages\audiodg.exe DllCommonsvc.exe File created C:\Windows\Offline Web Pages\42af1c969fbb7b DllCommonsvc.exe File created C:\Windows\security\templates\WmiPrvSE.exe DllCommonsvc.exe File created C:\Windows\debug\WIA\sppsvc.exe DllCommonsvc.exe File created C:\Windows\Migration\WTR\a76d7bf15d8370 DllCommonsvc.exe File created C:\Windows\security\templates\24dbde2999530e DllCommonsvc.exe File created C:\Windows\assembly\GAC_MSIL\7a0fd90576e088 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1800 schtasks.exe 2796 schtasks.exe 2480 schtasks.exe 1768 schtasks.exe 1196 schtasks.exe 1560 schtasks.exe 568 schtasks.exe 1932 schtasks.exe 1416 schtasks.exe 2524 schtasks.exe 3056 schtasks.exe 2132 schtasks.exe 1412 schtasks.exe 2464 schtasks.exe 2412 schtasks.exe 2124 schtasks.exe 1764 schtasks.exe 1652 schtasks.exe 1332 schtasks.exe 900 schtasks.exe 2708 schtasks.exe 2172 schtasks.exe 840 schtasks.exe 2376 schtasks.exe 1624 schtasks.exe 688 schtasks.exe 2792 schtasks.exe 2612 schtasks.exe 1032 schtasks.exe 2568 schtasks.exe 1728 schtasks.exe 1804 schtasks.exe 1952 schtasks.exe 2276 schtasks.exe 1072 schtasks.exe 528 schtasks.exe 2680 schtasks.exe 848 schtasks.exe 1744 schtasks.exe 1224 schtasks.exe 820 schtasks.exe 1448 schtasks.exe 704 schtasks.exe 1780 schtasks.exe 1736 schtasks.exe 2104 schtasks.exe 1304 schtasks.exe 1564 schtasks.exe 1856 schtasks.exe 2956 schtasks.exe 1212 schtasks.exe 1308 schtasks.exe 1904 schtasks.exe 1620 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 2816 DllCommonsvc.exe 2816 DllCommonsvc.exe 2816 DllCommonsvc.exe 2552 powershell.exe 2660 powershell.exe 2968 powershell.exe 1220 powershell.exe 2900 powershell.exe 2836 powershell.exe 1660 dwm.exe 2608 powershell.exe 2876 powershell.exe 2980 powershell.exe 2740 powershell.exe 2944 powershell.exe 2632 powershell.exe 2652 powershell.exe 2792 powershell.exe 2620 powershell.exe 2572 powershell.exe 2752 powershell.exe 1900 powershell.exe 1520 powershell.exe 1736 dwm.exe 1436 dwm.exe 1584 dwm.exe 1276 dwm.exe 1656 dwm.exe 2704 dwm.exe 848 dwm.exe 316 dwm.exe 1620 dwm.exe 2316 dwm.exe 1172 dwm.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeDebugPrivilege 2816 DllCommonsvc.exe Token: SeDebugPrivilege 2552 powershell.exe Token: SeDebugPrivilege 2968 powershell.exe Token: SeDebugPrivilege 2660 powershell.exe Token: SeDebugPrivilege 1220 powershell.exe Token: SeDebugPrivilege 1660 dwm.exe Token: SeDebugPrivilege 2900 powershell.exe Token: SeDebugPrivilege 2836 powershell.exe Token: SeDebugPrivilege 2608 powershell.exe Token: SeDebugPrivilege 2876 powershell.exe Token: SeDebugPrivilege 2980 powershell.exe Token: SeDebugPrivilege 2740 powershell.exe Token: SeDebugPrivilege 2944 powershell.exe Token: SeDebugPrivilege 2632 powershell.exe Token: SeDebugPrivilege 2652 powershell.exe Token: SeDebugPrivilege 2792 powershell.exe Token: SeDebugPrivilege 2620 powershell.exe Token: SeDebugPrivilege 2572 powershell.exe Token: SeDebugPrivilege 2752 powershell.exe Token: SeDebugPrivilege 1900 powershell.exe Token: SeDebugPrivilege 1520 powershell.exe Token: SeDebugPrivilege 1736 dwm.exe Token: SeDebugPrivilege 1436 dwm.exe Token: SeDebugPrivilege 1584 dwm.exe Token: SeDebugPrivilege 1276 dwm.exe Token: SeDebugPrivilege 1656 dwm.exe Token: SeDebugPrivilege 2704 dwm.exe Token: SeDebugPrivilege 848 dwm.exe Token: SeDebugPrivilege 316 dwm.exe Token: SeDebugPrivilege 1620 dwm.exe Token: SeDebugPrivilege 2316 dwm.exe Token: SeDebugPrivilege 1172 dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2084 2292 JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe 30 PID 2292 wrote to memory of 2084 2292 JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe 30 PID 2292 wrote to memory of 2084 2292 JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe 30 PID 2292 wrote to memory of 2084 2292 JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe 30 PID 2084 wrote to memory of 2760 2084 WScript.exe 32 PID 2084 wrote to memory of 2760 2084 WScript.exe 32 PID 2084 wrote to memory of 2760 2084 WScript.exe 32 PID 2084 wrote to memory of 2760 2084 WScript.exe 32 PID 2760 wrote to memory of 2816 2760 cmd.exe 34 PID 2760 wrote to memory of 2816 2760 cmd.exe 34 PID 2760 wrote to memory of 2816 2760 cmd.exe 34 PID 2760 wrote to memory of 2816 2760 cmd.exe 34 PID 2816 wrote to memory of 2968 2816 DllCommonsvc.exe 90 PID 2816 wrote to memory of 2968 2816 DllCommonsvc.exe 90 PID 2816 wrote to memory of 2968 2816 DllCommonsvc.exe 90 PID 2816 wrote to memory of 2900 2816 DllCommonsvc.exe 91 PID 2816 wrote to memory of 2900 2816 DllCommonsvc.exe 91 PID 2816 wrote to memory of 2900 2816 DllCommonsvc.exe 91 PID 2816 wrote to memory of 2552 2816 DllCommonsvc.exe 93 PID 2816 wrote to memory of 2552 2816 DllCommonsvc.exe 93 PID 2816 wrote to memory of 2552 2816 DllCommonsvc.exe 93 PID 2816 wrote to memory of 2572 2816 DllCommonsvc.exe 94 PID 2816 wrote to memory of 2572 2816 DllCommonsvc.exe 94 PID 2816 wrote to memory of 2572 2816 DllCommonsvc.exe 94 PID 2816 wrote to memory of 2876 2816 DllCommonsvc.exe 96 PID 2816 wrote to memory of 2876 2816 DllCommonsvc.exe 96 PID 2816 wrote to memory of 2876 2816 DllCommonsvc.exe 96 PID 2816 wrote to memory of 2752 2816 DllCommonsvc.exe 98 PID 2816 wrote to memory of 2752 2816 DllCommonsvc.exe 98 PID 2816 wrote to memory of 2752 2816 DllCommonsvc.exe 98 PID 2816 wrote to memory of 1220 2816 DllCommonsvc.exe 99 PID 2816 wrote to memory of 1220 2816 DllCommonsvc.exe 99 PID 2816 wrote to memory of 1220 2816 DllCommonsvc.exe 99 PID 2816 wrote to memory of 2980 2816 DllCommonsvc.exe 100 PID 2816 wrote to memory of 2980 2816 DllCommonsvc.exe 100 PID 2816 wrote to memory of 2980 2816 DllCommonsvc.exe 100 PID 2816 wrote to memory of 2836 2816 DllCommonsvc.exe 101 PID 2816 wrote to memory of 2836 2816 DllCommonsvc.exe 101 PID 2816 wrote to memory of 2836 2816 DllCommonsvc.exe 101 PID 2816 wrote to memory of 1900 2816 DllCommonsvc.exe 102 PID 2816 wrote to memory of 1900 2816 DllCommonsvc.exe 102 PID 2816 wrote to memory of 1900 2816 DllCommonsvc.exe 102 PID 2816 wrote to memory of 2660 2816 DllCommonsvc.exe 103 PID 2816 wrote to memory of 2660 2816 DllCommonsvc.exe 103 PID 2816 wrote to memory of 2660 2816 DllCommonsvc.exe 103 PID 2816 wrote to memory of 2608 2816 DllCommonsvc.exe 104 PID 2816 wrote to memory of 2608 2816 DllCommonsvc.exe 104 PID 2816 wrote to memory of 2608 2816 DllCommonsvc.exe 104 PID 2816 wrote to memory of 2632 2816 DllCommonsvc.exe 105 PID 2816 wrote to memory of 2632 2816 DllCommonsvc.exe 105 PID 2816 wrote to memory of 2632 2816 DllCommonsvc.exe 105 PID 2816 wrote to memory of 2620 2816 DllCommonsvc.exe 106 PID 2816 wrote to memory of 2620 2816 DllCommonsvc.exe 106 PID 2816 wrote to memory of 2620 2816 DllCommonsvc.exe 106 PID 2816 wrote to memory of 2740 2816 DllCommonsvc.exe 107 PID 2816 wrote to memory of 2740 2816 DllCommonsvc.exe 107 PID 2816 wrote to memory of 2740 2816 DllCommonsvc.exe 107 PID 2816 wrote to memory of 2792 2816 DllCommonsvc.exe 113 PID 2816 wrote to memory of 2792 2816 DllCommonsvc.exe 113 PID 2816 wrote to memory of 2792 2816 DllCommonsvc.exe 113 PID 2816 wrote to memory of 1520 2816 DllCommonsvc.exe 114 PID 2816 wrote to memory of 1520 2816 DllCommonsvc.exe 114 PID 2816 wrote to memory of 1520 2816 DllCommonsvc.exe 114 PID 2816 wrote to memory of 2652 2816 DllCommonsvc.exe 116 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\providercommon\1zu9dW.bat" "3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2968
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\audiodg.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2552
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Offline Web Pages\audiodg.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2876
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\SetupMetrics\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\templates\WmiPrvSE.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\debug\WIA\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1900
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\WMIADAP.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Favorites\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\en-US\audiodg.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2620
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\lsm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\GAC_MSIL\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1520
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\taskhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2944
-
-
C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1660 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rmFq19iy8Y.bat"6⤵PID:2748
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:1724
-
-
C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1736 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UucX7bnqC8.bat"8⤵PID:2252
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:2792
-
-
C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1436 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ELd0wzhjGt.bat"10⤵PID:1072
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:608
-
-
C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1584 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yyRUJOSyqo.bat"12⤵PID:2736
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:2364
-
-
C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1276 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CV35gbisF1.bat"14⤵PID:1044
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:2600
-
-
C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1656 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2qVagYZlTM.bat"16⤵PID:2500
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:1220
-
-
C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2704 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ap6i2Y3psm.bat"18⤵PID:1924
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:1560
-
-
C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:848 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BDCDGXc9ch.bat"20⤵PID:2076
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:1936
-
-
C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:316 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V9nTU0UPEK.bat"22⤵PID:2980
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:1756
-
-
C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1620 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\esvfELjyVS.bat"24⤵PID:576
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:2848
-
-
C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YQG5KQjShu.bat"26⤵PID:1892
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:1544
-
-
C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1172
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\audiodg.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\All Users\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2612
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\Windows\Migration\WTR\DllCommonsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1416
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 14 /tr "'C:\Windows\Migration\WTR\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Windows\Offline Web Pages\audiodg.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1332
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Windows\Offline Web Pages\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1304
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1224
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Windows\security\templates\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\security\templates\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Windows\security\templates\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:820
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Windows\debug\WIA\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\debug\WIA\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows\debug\WIA\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\WMIADAP.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\WMIADAP.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\WMIADAP.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:840
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Favorites\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\All Users\Favorites\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Favorites\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:704
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\en-US\audiodg.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\en-US\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\en-US\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\Application\lsm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1072
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\Application\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Windows\assembly\GAC_MSIL\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:688
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\assembly\GAC_MSIL\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Windows\assembly\GAC_MSIL\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\taskhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b42aad109ec4b722ec3e12a17fe9fb37
SHA176ae60ff842f8b105066c98208a829f38ed2bb5d
SHA256c877c7ac75df0dd3bb24eb76e2925c26a13c26f0c65bf7fbd3f10a30b24f25c4
SHA512eb56b44e0018c1335568c257d39add29ae27e65c3855419f7220d8f65851b8cc333a29f11c66cde40153ea22ec546a03391bf1d8b90d32818e20c4c9356364d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb10fc6398c617d16e474a5885520fa2
SHA124a87b174de54d4a4b41c75519ff72cb5b90a33d
SHA25638931079540f288606bebf188da63cfc10402bbcef86d84599e3d2caabd9fe31
SHA5128bff1bd0dd50c54a7cc09c665ace136e9f9226b916c4fc0b1a7c12afbc6829fa8aa145f1a46109be9e352366d7a2e25a92004ba6d5e572e7b1d01f78778091c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bc417b6c88160a8f65d069a5a07cef9
SHA1ea1090d0dd66285faf826c1b05f94280f1dd7bc3
SHA2566240f007e2d979f7eb83cfb6cc43f19086556c54c04782416c3ecec6fbe61ed9
SHA5124d9333888e423eee48ea8b4d606636bac2fad3658b050d0d672c10195d43ec96cb9ed2ec95668be95e214d903dc8f825f82c1d6ea1196d08c3b22d1d43380b62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc11043f8a2981364659c157a0e4ff62
SHA1832e8f06056a553fd4b59a606f7552a52979a825
SHA256b810c7eda379965d038b40a31bac27da31c5b072a5256c5c6b69431e14d55fac
SHA512c84d799b550434929b1fc54481260087ffb9316feb99468c4402f6ba90e87d92e3a0d99888da927e76205544c56e80e0504cf8b4f0ced4c8e17faff727f9bad7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596fc69629b96e20c11ef77f87c8479d7
SHA11897e61ec5bde5438cc30f4f71915c7f7b56302c
SHA25695afff131047320d56c6b23671d0fb504f9afeba8604fb8e9e8ebb693ece7a98
SHA512d1ecff8624a2fa99cdaceeb3995456636694de83511fe1503fe97ace16679a8dfd9526f8424cf9f3b9ae7fde135de322af408b9404d92d8523267bde0fe15fbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD599b290f7463eca34dcd80aaabb399bb5
SHA11829fe78c8aefbb29edd61eac1c22ef027105ca6
SHA2562996f329a1e9720bbc3a39f2aa2c61f5295db64b294c33b8333f573b48297151
SHA51244d87161b94b27729a9720a9f06249aeaaf2d6d7928de48018b9e4ccc27c5bd60ba44b3d72c9eeb09689c8d25e611733a04645df3b2d961cc8abc4147c75304c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc5831c37c0dfa6590c18167d81b52e3
SHA183a524d43860b9d9c396edf783f097150a7cfa53
SHA256428e6ebb809e5b2b47e75ddda907edf4243580c516b3b384a9d0122298d2f0d7
SHA512e5a3acb6883f19486c3ac541ea614272652f167e110e55f65db599d07c850bd38ae70ff9e792146b1aa53b009b19f86def42f61a95e69b7411a1704d3a03ea75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b072d341fec5f7b5105c6721c8a0a8b
SHA139673e356ecb8d3a9c541d5c8337e6f14875b37c
SHA25652f1f06f57da2a7743cc48b56b5388b8d41dc54327aac530deb36488033531ac
SHA512b6e3aaf6ebb37717c03152680819436a4f39e15bbbb36cb5b6aeca0a3ffbe6f20f778d9dda2ac1ad64c2ca3706d65a64ec14c5ed0d98220a3ffa0a7d58bca790
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD526c3c4ae005f8f3a98cbe37c7cfb7e97
SHA1c80ff204189a483bb4adbc299e69941a9bb638df
SHA256ddaea031caa2966caae2dd5979942c0157a03159af712459de9942d42c23f3ab
SHA51235ef6abad192e3823c90c8731d74bf28680626aca78d17b3b7a54f1075e8f6bcc849913fbbe54ddd9192ff5901a0e5f95af48d96a30d8f89142ececa0e3a98f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f075d713684a8ad1c7a3f7e3db8e2ea
SHA168d6359dcf6ff038743f20a05832224b387ba285
SHA2566b57afa58c7f5548c26c09950c497e120fd2db83e994c58d0b00c54328893f59
SHA512a2efc4244627c8e7b92af27a877a031dd8ecfe1c6d8e27eefff7f204f83db27bbd1f38a55f9abf280e102183c5a214bf83caf4de13170543c1b725fb73a4b65d
-
Filesize
223B
MD5a17a9baba82d14bf38befb1fbdf8782d
SHA1c34f8eaf9408cef43035cd838ea0c16f0aac0bdc
SHA2564434c3ba0e1e1895b56dcbb5a7a60bf3007104e3be9e5606d54d68eebb70a37f
SHA512eb18ec6a72199db7d165caaa5860def950f0ad83bb6686f39a3e86e16bd6cde73d477c8bbc74d9a1d2f4a95a0b187d57825c41d40d5636953f04ccd731374c81
-
Filesize
223B
MD5efff2e1c997ce1eb53ad0feada584ebe
SHA1e9fd7a9864e0b5b06180958a883e4690f73a3b22
SHA256a509437963fd6cd7ca549bafbc7d9b37759001b189a2ab91326ca7340d227803
SHA512fa97cd539885a84925af04bcd1e45fa121779ee4b9b68d2f3a8d81265701fa85f8f0195469b46c0df69cf8e3d224fdf6aab2895d17f5d4be7075c5b69633583b
-
Filesize
223B
MD5c3cce53c33e3a33505111d3b78e42cbf
SHA1ffb2c2dcc8d1d7dd95fbeb2c1fd560250dbe3820
SHA2560cef18d4c3b197febd8fa2a7b4ffcc7f1dae8e94e9ae09e3c167ec942c922225
SHA5122c7deec899428e7c5ae71a8e9dbe80849ade4e8aec132a3f989400bc797bf6f37b133663f37b7b089b555d196eeea1f7952a71fa8374edd12fcfbc958712a5d5
-
Filesize
223B
MD51192c75df1db084cfdbf91c47a49cecd
SHA1b9b8105db7d89f3d0ca586a757e383b776d0af73
SHA2568c79d344579d12ef07d7f033bb4e9cb02cfe456a5a5d4ceae181a0d570aa1a47
SHA5129dcc9e16546afc120c0185e0cab1c8f8c33b654cc1bd253f2eee960fe375fdecdc5b0011b352ae0af74d2f4b9ff48af0fb795bdd2fce035ff21735d041692705
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
223B
MD5190c0d18d68e4be5655dc1e5cdacf2c4
SHA11b2a42e3413435d211e470d824d644325974ad90
SHA25699f13ad9b432fe5d5a58c749f7dccd450ebf5e44adbd2af2b45b14a37bf440a1
SHA512a211d9f827768a2ba55330b675d61f55a9d2e899e3e2d639c4cdde6e2179707a70f7c891de1785af28fc2ce48f22bbba537541b72ddf9370db9d55dd33cf9f88
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
223B
MD5ed2387f4e8db61a8e5f67c42e6c994a6
SHA11c1cd49b97367480ded5222602d9109f68fb96fe
SHA2562c4ad95a9fa7b1d78d5f39cc1ff69af178604824f4f0b318c7032ca1a980c2dc
SHA512495d44c9081282ff8a234f4bf04e8dc70b39b6af93c652137c45b565def8ec155d1c3f07bb7953f14f2fa6d2071d3d84a4c5cbf86aabf11f384f39ece64a629e
-
Filesize
223B
MD58384c9cc6074ce18ae94f55726de5c96
SHA14e16ea004d9adb3ea25593d9c2ad6923f6b658d9
SHA2567391985f220f6f5fb9603c4af377ba71d0f4affecae77d7563014316022d4d82
SHA512c4e7742e594f6373af1e6391a50ff107dd2f9c394bd291d2062c8826e0f0043e4fc2158f68084be510ecddfcc38dc345b614d07bd9fae3ac990f13859865acd0
-
Filesize
223B
MD5d3f9fbaf07ad1586dfc222e79067f490
SHA11b67c2361750af4b381109f61536afbcaeb12a82
SHA2565ad5928ae7bf9a9fc6c11e717ed4542c9cb80b2def2760cfbd58a8e1eaef8988
SHA5127fc1080c5af752b79c28150eaabec4aab64ff183040b9daae0f03a38eeb1aef06fe4513dc763675a4e497ddbe04fea510d01dbb24dfcd06046efc596f8db21b8
-
Filesize
223B
MD569b7d52db3dd1549fece2a1598fefdbb
SHA1117ee9596903bb36a8e31a7e9fb067ac72434aa7
SHA256f2d92209f03809b4f3ca42d11d0df5d1d851967fa1fe58a10045e917864afa92
SHA5121bce2a84a6d5c5e2921923cb4e69fadc7bc562d1b9224ced6becaa299e6c06b1b3b5f1d483ba27bf12cdcf4d2145c392a9c6a2dd2fa6caa8875915f8b6aba40b
-
Filesize
223B
MD51923d61471fcfdcf76b72e9591a0bdbe
SHA12646c8cf8e95b1ef2ae77534a77132414c931c5b
SHA256acf762c05575e99350d0d97ed17a360401a6756dae0255c462e87f52a2ecdd33
SHA5127f4eb7f8e777b9e57d5896df4e152ffb329e961789121ad6740f7ab5bebe844114ebfb066ca898e3131734599e8211e9acd218aab98990891aa80cffbcedaf86
-
Filesize
223B
MD50eb454ce482c568e492927db1e5ebe5e
SHA1325e192a248669038a601a8263095f3578ff245d
SHA25614f73581b9eab2241f45e3f1d635034caa67677ff7e4e2b41a7fe29519733bbf
SHA512c07e152a0b5ba4a4c18da5bdcee0b28762e69cfeeb25efc4cd69448f1e27fe996a3098d0cd361ad55a4f4ea2325ec2030be9ea78ccf01db24f242329b64f8c30
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD550b953cd33da52305a3315a7a7d11232
SHA145da0671779347d9434b2d225e450d120e021fa6
SHA256266f9ba79a40e0d6d48412a72d8ec82d2f6f67306d93e146d5cb91d3f5333c85
SHA512bf8a6f7d94e83e7f7be0274dc6fd97b543aef8e40cfe5cec70288b81f6165df382518b08a1e68f744e21b68e6812efb5bd5fab64031b003b2f23767838966204
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394