Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 12:11
Behavioral task
behavioral1
Sample
JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe
-
Size
1.3MB
-
MD5
5fbc4bca617169252bda8262e9b737a9
-
SHA1
ac83bf7260fbe3716603d46f70aec1fbc86683f2
-
SHA256
346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af
-
SHA512
95f7674512882251acef53907c1c6b0bf68da43ef2e4ab28053328b85bb8f5d4608963826d852b0ac19fce2689761731364545415830ec657b36cba088eba62c
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 64 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3868 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2696 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4952 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4804 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1516 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2868 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 920 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1324 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3880 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2928 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3396 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1148 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3528 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5036 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3860 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3824 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3856 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2412 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4580 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4896 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2976 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1536 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1916 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2620 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2236 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3116 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3044 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2212 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4920 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1452 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4104 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2576 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3472 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5080 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2064 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 208 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4660 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3696 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3900 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 876 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1076 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3632 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1568 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4528 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4276 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4036 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3496 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1980 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 740 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3452 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3288 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2616 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4568 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2224 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3700 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1436 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2040 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5428 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5460 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5552 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5644 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5708 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5772 5020 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5844 5020 schtasks.exe 87 -
resource yara_rule behavioral2/files/0x0007000000023c98-10.dat dcrat behavioral2/memory/4000-13-0x00000000006F0000-0x0000000000800000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3960 powershell.exe 4468 powershell.exe 5072 powershell.exe 4984 powershell.exe 4064 powershell.exe 3508 powershell.exe 628 powershell.exe 2960 powershell.exe 2232 powershell.exe 5048 powershell.exe 3192 powershell.exe 5972 powershell.exe 3972 powershell.exe 4956 powershell.exe 640 powershell.exe 4264 powershell.exe 5984 powershell.exe 5948 powershell.exe 5960 powershell.exe 4700 powershell.exe 4180 powershell.exe 4516 powershell.exe 4560 powershell.exe 2908 powershell.exe -
Checks computer location settings 2 TTPs 17 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation powershell.exe -
Executes dropped EXE 19 IoCs
pid Process 4000 DllCommonsvc.exe 5104 DllCommonsvc.exe 5948 powershell.exe 5960 powershell.exe 5972 powershell.exe 5984 powershell.exe 6008 powershell.exe 3340 powershell.exe 3080 powershell.exe 2960 powershell.exe 3604 powershell.exe 1624 powershell.exe 5152 powershell.exe 4000 powershell.exe 1440 powershell.exe 3708 powershell.exe 3508 powershell.exe 4980 powershell.exe 4328 powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
flow ioc 54 raw.githubusercontent.com 44 raw.githubusercontent.com 46 raw.githubusercontent.com 53 raw.githubusercontent.com 55 raw.githubusercontent.com 40 raw.githubusercontent.com 38 raw.githubusercontent.com 39 raw.githubusercontent.com 56 raw.githubusercontent.com 17 raw.githubusercontent.com 24 raw.githubusercontent.com 45 raw.githubusercontent.com 60 raw.githubusercontent.com 16 raw.githubusercontent.com -
Drops file in Program Files directory 13 IoCs
description ioc Process File created C:\Program Files\7-Zip\spoolsv.exe DllCommonsvc.exe File created C:\Program Files\Mozilla Firefox\fonts\38384e6a620884 DllCommonsvc.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\powershell.exe DllCommonsvc.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\DllCommonsvc.exe DllCommonsvc.exe File created C:\Program Files\VideoLAN\conhost.exe DllCommonsvc.exe File created C:\Program Files\VideoLAN\088424020bedd6 DllCommonsvc.exe File created C:\Program Files\7-Zip\f3b6ecef712a24 DllCommonsvc.exe File created C:\Program Files\Internet Explorer\de-DE\fontdrvhost.exe DllCommonsvc.exe File created C:\Program Files\Internet Explorer\de-DE\5b884080fd4f94 DllCommonsvc.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\System.exe DllCommonsvc.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\27d1bcfc3c54e0 DllCommonsvc.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\a76d7bf15d8370 DllCommonsvc.exe File created C:\Program Files\Mozilla Firefox\fonts\SearchApp.exe DllCommonsvc.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\uk-UA\unsecapp.exe DllCommonsvc.exe File opened for modification C:\Windows\uk-UA\unsecapp.exe DllCommonsvc.exe File created C:\Windows\IdentityCRL\System.exe DllCommonsvc.exe File created C:\Windows\IdentityCRL\27d1bcfc3c54e0 DllCommonsvc.exe File created C:\Windows\Panther\UnattendGC\lsass.exe DllCommonsvc.exe File created C:\Windows\addins\OfficeClickToRun.exe DllCommonsvc.exe File created C:\Windows\addins\e6c9b481da804f DllCommonsvc.exe File created C:\Windows\uk-UA\29c1c3cc0f7685 DllCommonsvc.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\dllhost.exe DllCommonsvc.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\5940a34987c991 DllCommonsvc.exe File created C:\Windows\Panther\UnattendGC\6203df4a6bafc7 DllCommonsvc.exe File created C:\Windows\GameBarPresenceWriter\smss.exe DllCommonsvc.exe File created C:\Windows\GameBarPresenceWriter\69ddcba757bf72 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3868 schtasks.exe 920 schtasks.exe 2576 schtasks.exe 3472 schtasks.exe 3632 schtasks.exe 1436 schtasks.exe 5708 schtasks.exe 2040 schtasks.exe 5552 schtasks.exe 5644 schtasks.exe 3396 schtasks.exe 876 schtasks.exe 3288 schtasks.exe 3700 schtasks.exe 3860 schtasks.exe 2236 schtasks.exe 2212 schtasks.exe 5080 schtasks.exe 1980 schtasks.exe 5772 schtasks.exe 5844 schtasks.exe 3880 schtasks.exe 2412 schtasks.exe 4104 schtasks.exe 1568 schtasks.exe 5428 schtasks.exe 4952 schtasks.exe 2976 schtasks.exe 208 schtasks.exe 3900 schtasks.exe 1076 schtasks.exe 4276 schtasks.exe 2696 schtasks.exe 4804 schtasks.exe 2928 schtasks.exe 4580 schtasks.exe 4896 schtasks.exe 2620 schtasks.exe 3696 schtasks.exe 4036 schtasks.exe 2224 schtasks.exe 5036 schtasks.exe 1536 schtasks.exe 1452 schtasks.exe 4660 schtasks.exe 1148 schtasks.exe 3528 schtasks.exe 3116 schtasks.exe 2616 schtasks.exe 4568 schtasks.exe 4528 schtasks.exe 5912 schtasks.exe 1516 schtasks.exe 1916 schtasks.exe 3044 schtasks.exe 3496 schtasks.exe 5868 schtasks.exe 1324 schtasks.exe 4920 schtasks.exe 2868 schtasks.exe 3856 schtasks.exe 740 schtasks.exe 5460 schtasks.exe 3824 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 4000 DllCommonsvc.exe 628 powershell.exe 628 powershell.exe 4064 powershell.exe 4064 powershell.exe 3508 powershell.exe 3508 powershell.exe 3192 powershell.exe 3192 powershell.exe 5048 powershell.exe 5048 powershell.exe 4560 powershell.exe 4560 powershell.exe 2960 powershell.exe 2960 powershell.exe 640 powershell.exe 640 powershell.exe 4700 powershell.exe 4700 powershell.exe 4956 powershell.exe 4956 powershell.exe 3972 powershell.exe 3972 powershell.exe 4468 powershell.exe 4468 powershell.exe 4264 powershell.exe 4264 powershell.exe 2232 powershell.exe 2232 powershell.exe 4516 powershell.exe 4516 powershell.exe 4180 powershell.exe 4180 powershell.exe 2908 powershell.exe 2908 powershell.exe -
Suspicious use of AdjustPrivilegeToken 39 IoCs
description pid Process Token: SeDebugPrivilege 4000 DllCommonsvc.exe Token: SeDebugPrivilege 628 powershell.exe Token: SeDebugPrivilege 4064 powershell.exe Token: SeDebugPrivilege 3508 powershell.exe Token: SeDebugPrivilege 3192 powershell.exe Token: SeDebugPrivilege 5048 powershell.exe Token: SeDebugPrivilege 4560 powershell.exe Token: SeDebugPrivilege 2960 powershell.exe Token: SeDebugPrivilege 640 powershell.exe Token: SeDebugPrivilege 4700 powershell.exe Token: SeDebugPrivilege 4956 powershell.exe Token: SeDebugPrivilege 3972 powershell.exe Token: SeDebugPrivilege 2232 powershell.exe Token: SeDebugPrivilege 4264 powershell.exe Token: SeDebugPrivilege 4468 powershell.exe Token: SeDebugPrivilege 4516 powershell.exe Token: SeDebugPrivilege 4180 powershell.exe Token: SeDebugPrivilege 5072 powershell.exe Token: SeDebugPrivilege 4984 powershell.exe Token: SeDebugPrivilege 2908 powershell.exe Token: SeDebugPrivilege 5104 DllCommonsvc.exe Token: SeDebugPrivilege 3960 powershell.exe Token: SeDebugPrivilege 5960 powershell.exe Token: SeDebugPrivilege 5972 powershell.exe Token: SeDebugPrivilege 5948 powershell.exe Token: SeDebugPrivilege 5984 powershell.exe Token: SeDebugPrivilege 6008 powershell.exe Token: SeDebugPrivilege 3340 powershell.exe Token: SeDebugPrivilege 3080 powershell.exe Token: SeDebugPrivilege 2960 powershell.exe Token: SeDebugPrivilege 3604 powershell.exe Token: SeDebugPrivilege 1624 powershell.exe Token: SeDebugPrivilege 5152 powershell.exe Token: SeDebugPrivilege 4000 powershell.exe Token: SeDebugPrivilege 1440 powershell.exe Token: SeDebugPrivilege 3708 powershell.exe Token: SeDebugPrivilege 3508 powershell.exe Token: SeDebugPrivilege 4980 powershell.exe Token: SeDebugPrivilege 4328 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3084 wrote to memory of 3648 3084 JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe 83 PID 3084 wrote to memory of 3648 3084 JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe 83 PID 3084 wrote to memory of 3648 3084 JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe 83 PID 3648 wrote to memory of 5112 3648 WScript.exe 84 PID 3648 wrote to memory of 5112 3648 WScript.exe 84 PID 3648 wrote to memory of 5112 3648 WScript.exe 84 PID 5112 wrote to memory of 4000 5112 cmd.exe 86 PID 5112 wrote to memory of 4000 5112 cmd.exe 86 PID 4000 wrote to memory of 3960 4000 DllCommonsvc.exe 146 PID 4000 wrote to memory of 3960 4000 DllCommonsvc.exe 146 PID 4000 wrote to memory of 4468 4000 DllCommonsvc.exe 147 PID 4000 wrote to memory of 4468 4000 DllCommonsvc.exe 147 PID 4000 wrote to memory of 4700 4000 DllCommonsvc.exe 148 PID 4000 wrote to memory of 4700 4000 DllCommonsvc.exe 148 PID 4000 wrote to memory of 3508 4000 DllCommonsvc.exe 149 PID 4000 wrote to memory of 3508 4000 DllCommonsvc.exe 149 PID 4000 wrote to memory of 3192 4000 DllCommonsvc.exe 150 PID 4000 wrote to memory of 3192 4000 DllCommonsvc.exe 150 PID 4000 wrote to memory of 5048 4000 DllCommonsvc.exe 151 PID 4000 wrote to memory of 5048 4000 DllCommonsvc.exe 151 PID 4000 wrote to memory of 4064 4000 DllCommonsvc.exe 152 PID 4000 wrote to memory of 4064 4000 DllCommonsvc.exe 152 PID 4000 wrote to memory of 4264 4000 DllCommonsvc.exe 153 PID 4000 wrote to memory of 4264 4000 DllCommonsvc.exe 153 PID 4000 wrote to memory of 4984 4000 DllCommonsvc.exe 154 PID 4000 wrote to memory of 4984 4000 DllCommonsvc.exe 154 PID 4000 wrote to memory of 2908 4000 DllCommonsvc.exe 155 PID 4000 wrote to memory of 2908 4000 DllCommonsvc.exe 155 PID 4000 wrote to memory of 4560 4000 DllCommonsvc.exe 157 PID 4000 wrote to memory of 4560 4000 DllCommonsvc.exe 157 PID 4000 wrote to memory of 640 4000 DllCommonsvc.exe 158 PID 4000 wrote to memory of 640 4000 DllCommonsvc.exe 158 PID 4000 wrote to memory of 4516 4000 DllCommonsvc.exe 160 PID 4000 wrote to memory of 4516 4000 DllCommonsvc.exe 160 PID 4000 wrote to memory of 2232 4000 DllCommonsvc.exe 161 PID 4000 wrote to memory of 2232 4000 DllCommonsvc.exe 161 PID 4000 wrote to memory of 4956 4000 DllCommonsvc.exe 163 PID 4000 wrote to memory of 4956 4000 DllCommonsvc.exe 163 PID 4000 wrote to memory of 2960 4000 DllCommonsvc.exe 165 PID 4000 wrote to memory of 2960 4000 DllCommonsvc.exe 165 PID 4000 wrote to memory of 628 4000 DllCommonsvc.exe 166 PID 4000 wrote to memory of 628 4000 DllCommonsvc.exe 166 PID 4000 wrote to memory of 5072 4000 DllCommonsvc.exe 167 PID 4000 wrote to memory of 5072 4000 DllCommonsvc.exe 167 PID 4000 wrote to memory of 4180 4000 DllCommonsvc.exe 168 PID 4000 wrote to memory of 4180 4000 DllCommonsvc.exe 168 PID 4000 wrote to memory of 3972 4000 DllCommonsvc.exe 170 PID 4000 wrote to memory of 3972 4000 DllCommonsvc.exe 170 PID 4000 wrote to memory of 5104 4000 DllCommonsvc.exe 185 PID 4000 wrote to memory of 5104 4000 DllCommonsvc.exe 185 PID 5104 wrote to memory of 5948 5104 DllCommonsvc.exe 196 PID 5104 wrote to memory of 5948 5104 DllCommonsvc.exe 196 PID 5104 wrote to memory of 5960 5104 DllCommonsvc.exe 197 PID 5104 wrote to memory of 5960 5104 DllCommonsvc.exe 197 PID 5104 wrote to memory of 5972 5104 DllCommonsvc.exe 198 PID 5104 wrote to memory of 5972 5104 DllCommonsvc.exe 198 PID 5104 wrote to memory of 5984 5104 DllCommonsvc.exe 199 PID 5104 wrote to memory of 5984 5104 DllCommonsvc.exe 199 PID 5104 wrote to memory of 3452 5104 DllCommonsvc.exe 200 PID 5104 wrote to memory of 3452 5104 DllCommonsvc.exe 200 PID 3452 wrote to memory of 5204 3452 cmd.exe 202 PID 3452 wrote to memory of 5204 3452 cmd.exe 202 PID 3452 wrote to memory of 6008 3452 cmd.exe 209 PID 3452 wrote to memory of 6008 3452 cmd.exe 209 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\uk-UA\unsecapp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Update\1.3.36.371\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4700
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3508
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3192
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\spoolsv.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4264
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IdentityCRL\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4984
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\de-DE\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Configuration\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Favorites\Links\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:640
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4516
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\UnattendGC\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4956
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\fonts\SearchApp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:628
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\GameBarPresenceWriter\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5072
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4180
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3972
-
-
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\providercommon\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5948
-
-
C:\providercommon\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\csrss.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5960 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Fb5uY85DH.bat"7⤵PID:5652
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:5320
-
-
C:\providercommon\powershell.exe"C:\providercommon\powershell.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3340 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iYTmIkWLiw.bat"9⤵PID:3396
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:4420
-
-
C:\providercommon\powershell.exe"C:\providercommon\powershell.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3080 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\N4rS0hE0df.bat"11⤵PID:2616
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:5612
-
-
C:\providercommon\powershell.exe"C:\providercommon\powershell.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2960 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\M1TWCJOn7d.bat"13⤵PID:5372
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:3312
-
-
C:\providercommon\powershell.exe"C:\providercommon\powershell.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3604 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2Oj9OucH8K.bat"15⤵PID:4664
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:5724
-
-
C:\providercommon\powershell.exe"C:\providercommon\powershell.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1624 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SvvYNrLnHE.bat"17⤵PID:1848
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:4984
-
-
C:\providercommon\powershell.exe"C:\providercommon\powershell.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5152 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fdSjcfTSOA.bat"19⤵PID:1612
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:6100
-
-
C:\providercommon\powershell.exe"C:\providercommon\powershell.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4000 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\da4noHdFs8.bat"21⤵PID:5256
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:5960
-
-
C:\providercommon\powershell.exe"C:\providercommon\powershell.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1440 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hibqn60Xcy.bat"23⤵PID:1488
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:6024
-
-
C:\providercommon\powershell.exe"C:\providercommon\powershell.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3708 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0Sh6ipYOoX.bat"25⤵PID:5392
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:1152
-
-
C:\providercommon\powershell.exe"C:\providercommon\powershell.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3508 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Urxb3wPgb0.bat"27⤵PID:3560
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:228⤵PID:5636
-
-
C:\providercommon\powershell.exe"C:\providercommon\powershell.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4980 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4JlC5zfAS6.bat"29⤵PID:3100
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:230⤵PID:1596
-
-
C:\providercommon\powershell.exe"C:\providercommon\powershell.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4328 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Zj0hR7WTEZ.bat"31⤵PID:4760
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:232⤵PID:4280
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\providercommon\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\addins\OfficeClickToRun.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5972
-
-
C:\providercommon\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\powershell.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5984
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PN219sj1of.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:5204
-
-
C:\providercommon\powershell.exe"C:\providercommon\powershell.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6008
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Windows\uk-UA\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\uk-UA\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Windows\uk-UA\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\Update\1.3.36.371\DllCommonsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4804
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\1.3.36.371\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1516
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\Update\1.3.36.371\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:920
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1324
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3880
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files\VideoLAN\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1148
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3860
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\7-Zip\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files\7-Zip\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\providercommon\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4580
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4896
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Windows\IdentityCRL\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Windows\IdentityCRL\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\de-DE\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\de-DE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3116
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\de-DE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1452
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Favorites\Links\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4104
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\Favorites\Links\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Favorites\Links\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3472
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:2064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:208
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Documents\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4660
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\Documents\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3696
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Documents\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3900
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\Panther\UnattendGC\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Panther\UnattendGC\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1076
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\Panther\UnattendGC\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3632
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\fonts\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1568
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\fonts\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\fonts\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4276
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Windows\GameBarPresenceWriter\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\GameBarPresenceWriter\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:3452
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\GameBarPresenceWriter\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4568
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3700
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Default\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5552
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Windows\addins\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5644
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\addins\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5708
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Windows\addins\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5772
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 7 /tr "'C:\providercommon\powershell.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5844
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\providercommon\powershell.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:5868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 11 /tr "'C:\providercommon\powershell.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:5912
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57f3c0ae41f0d9ae10a8985a2c327b8fb
SHA1d58622bf6b5071beacf3b35bb505bde2000983e3
SHA256519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900
SHA5128a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD52979eabc783eaca50de7be23dd4eafcf
SHA1d709ce5f3a06b7958a67e20870bfd95b83cad2ea
SHA256006cca90e78fbb571532a83082ac6712721a34ea4b21f490058ffb3f521f4903
SHA51292bc433990572d9427d0c93eef9bd1cc23fa00ed60dd0c9c983d87d3421e02ce3f156c6f88fe916ef6782dbf185cbce083bc0094f8c527f302be6a37d1c53aba
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD528d4235aa2e6d782751f980ceb6e5021
SHA1f5d82d56acd642b9fc4b963f684fd6b78f25a140
SHA2568c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638
SHA512dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2
-
Filesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
Filesize
944B
MD5e448fe0d240184c6597a31d3be2ced58
SHA1372b8d8c19246d3e38cd3ba123cc0f56070f03cd
SHA256c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391
SHA5120b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
Filesize
944B
MD5a8e8360d573a4ff072dcc6f09d992c88
SHA13446774433ceaf0b400073914facab11b98b6807
SHA256bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b
SHA5124ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe
-
Filesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
Filesize
197B
MD54d5b4cd795371b6bdcd372224271cea3
SHA1a3626b9546b7e92cb1894cb25fce98eae32fc5df
SHA2565cc1010eb320fc7f0c90f9c37ad5b4d13a5169ebe3e25b246c6d230749ad4bbc
SHA5128a02044d08bc2e00a229c0d89a2d2a1393abec827c6bb1bbf2d5dcef123504c4de2ccdb238e2e4dfb8648a57fa2032492d5eb40f1c4c1b709e046695ff58c6b0
-
Filesize
197B
MD545a4b7ae268db352cf6f6b8d76d85b85
SHA1d9f898f16690e7dddb3d1e3f455dc203fbf982f5
SHA256ceaa538bcf48f01670355a1a3eeac6eaceeac769b2fc774c37ca47b088a56d88
SHA5124f453db026ade4978a8adfc0da632d384c552fed11863300e058bd16eda3172ff6e71cc3170061bb28e259f77b6e9e9852752b416de27e38039cf00683c8615f
-
Filesize
197B
MD5a86873bce88151f3f3c562f8bf87a799
SHA19072f7e354eca77f55fd9480e206fc9dcbac4702
SHA2564546755011e85cc301d0c29c87a9092fa9e59e8711fd88d65e1d7eb2125188d3
SHA512e6b86459430a9331d5c207771ced63e52698067bc618b0893eeed8ac65259e2c69ac1c50808ec097b26bfc97e50b50fd3f8dfb38ada9caa2b34cbff83b684ace
-
Filesize
197B
MD5fc43896afa7db145253423374e926b07
SHA1667ba7aa41974b00a3da170362f93aeb84c573ec
SHA2560ef6302cd5374fbaf1038eef22ef8239bb565055c1bd24ad51af6fb9514d79ba
SHA512ca279a7b0f291ad567ecbe270af0730deb1ce7560842a2f5bd8cdebadc9cd420e1334f84434e1c4ac1880c5b7fa8c1bfdb78b84658889b7a4fd64a17abc41e5c
-
Filesize
197B
MD53cdb82f268620848e6a70b102ead8abc
SHA13a8556fa6d07e53f6ffa05adeba497d1e7bf160f
SHA25626d9fd42ec0aa354cceaa5a7a411e8a7a908c81e8f86ff4521eac5fc66c7360e
SHA51238138df9ce630436da32ccafab1ef27e94aff7aabe638a342b901ec39292d7e2b87852f925fbfe5c1956009cfcd00c3e40928ced321bd942f2226ca183b372b2
-
Filesize
197B
MD5aafd5e6bede527ac9e1c9a3b1e083315
SHA1886aafb626a1a457b35c9f6e30e2a425cd7acf19
SHA256bad9165a7a8e8cbc62830fe4b650e13e4b9be115f970e9807cf3d371b0aec118
SHA512d9a79c1e51dcc654eb867760b0bb9c26675f6848e889d2b423398ec37f0c55a68b2a3f8b3b1edcfca64faa53f615a420078abefbf819f7125eefa66d18cf533b
-
Filesize
197B
MD50812e51c7f3fe400641f4e7e5bc215fa
SHA1c06fb74bc3841b05cf91f3e102c2a0732c518633
SHA256b09084acc58b9a3ab4a81cab073cf31d6a2f8c7caf247dadfc49948eff77ca41
SHA51291b6b8b6aa5d2dbe96bfa425721d43ef6e686f368c34138a4d5732fcd4e3eef11366295ed54088d58affd39a44533c5c6e53295cff39227057e7a3e8eca80489
-
Filesize
197B
MD512cc914aede1789a00062ea8d7f937a9
SHA10721e33200e6075af3076021fd426f7087f8c4c2
SHA2565c5ea8ea7f62dc58ec6a7d1dc0154943ea7b9c1139e24cc2684ac0901b01f6b3
SHA512a3031bf006d9dda3cc3c43ccfbf6258b4808beb378fa91397d11329560ec47f18765d87067a8d31454c8b2b1a104ca6d3caec439b2418e710956b1e5f81c25a2
-
Filesize
197B
MD5abf6b1590571c3ad0bf600d3303126f6
SHA117eab73b6109edbac529ddb66e6d06f0deaab83f
SHA25678e8963d6a0d278d1a4a7609b05d0fe703977167de52c8cd34d801f0fe909390
SHA512b44b7b96df84b9703cf7a091095f5524ba33fd59a213310426c1b1674d94cfcebdc6802f594eec0c9018b7dcb9549c6dc23f85a986ed804b11a1e904fa844e61
-
Filesize
197B
MD5d4f1835a2e412acc9cf74c8a0de6738d
SHA1be3d5c55633a6a1d9c433c46162a9b4caa4cc847
SHA2564e5ceb713b4867e49d219ab6296c2dc4ee6a4f46acecba8da967ceb5b246f250
SHA51256d234ca12d62bff7f28631c4074373d3d0f138206e395baa7d3b15b98d4d0151246d803066e3f824f2f200d81a4534402cbb971cab48042297b92cca7029b68
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
197B
MD59456d2199fd368c627e49c6fa8136a9e
SHA109fdd5a013e65a2b92317ee5edf7ec0b6b9232be
SHA256f462d8751cf95b3a76008d1940320930fcdc27f70c4d5d69f8c751fd90f878fa
SHA512089eb45dc36c24ccb1a406ee739a4735c54b3d0ffb36966e84cc3f54fcb228b6cba2721e8cc8d116f5d605a6bb57c17577a08a4a221915c0546e64e215870941
-
Filesize
197B
MD5a5fbcf79ec7ce252723e4978fe89abd4
SHA15cd62a2b48eab220479a3ba9b196d1bfa272321a
SHA256a17c38e14498eddd3318abb7eb0e354b8b8f714ce000bd445a4355307e3485af
SHA5121c721330ba9b63d420a9e0468be3313a9506ddab1b8b542390c301142fe712ea70596584f064d6ee021c2f47f285e9a33b120c861489908e2a785cef8045cc72
-
Filesize
197B
MD573211da06fc8e1f9bc72fa6e3eb59311
SHA1710215d8aaefcb57b2529f91bd6b4fb45ccc44a7
SHA2567afc06ed97cf0ff9d017a70cd72fa26227fb979e2832e21129dbe7b1c65fb34f
SHA512b8c8ffed440335fb7cf93f012d864af40ffd16cf3c8a5a7fd270760de9e597c185d12152fac33660595fc39c4039091979a1c857ed0c4a49e8387f8eea3c8d12
-
Filesize
197B
MD5c5cab2db0be641ba455ba954866df490
SHA1a20b94ac205afd253a8bd8212cac15abffaf1e50
SHA256fc19e07453fbbb63e96f9dc2fb693957d354b9e457f353d5dde7ad103a9954c2
SHA512c13a49ac188a68763c4976d01f9aabdd3d0bd52b71155400c70a1b27df2d699caa111d734d618bddfdad201ff8c894ddba9037ec25114427e447b3a9cd78b71c
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478