Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 17:48
Behavioral task
behavioral1
Sample
JaffaCakes118_e748b94d218d04bab24eb56d7bb77c8b2a96e92a73134d4a85111eae21788cc4.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_e748b94d218d04bab24eb56d7bb77c8b2a96e92a73134d4a85111eae21788cc4.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_e748b94d218d04bab24eb56d7bb77c8b2a96e92a73134d4a85111eae21788cc4.exe
-
Size
1.3MB
-
MD5
c6237a0d253998c0369006bea48abf06
-
SHA1
2f2bf8e25f2f004283ae4b76123cc9778f7371b6
-
SHA256
e748b94d218d04bab24eb56d7bb77c8b2a96e92a73134d4a85111eae21788cc4
-
SHA512
2df0990e125a3e5b56d29ab20d154390f746c9105ce30ac2b69c5cbfb6066a558ecb7911cae93772c2de69eb353f485dbf08b30a22f817714b1b3551e5f8f498
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 51 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2832 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2052 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3984 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2756 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4000 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5008 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 780 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 220 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 532 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1612 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3016 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5044 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2004 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3708 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2940 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 312 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4792 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3588 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2968 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4504 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1444 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1136 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4252 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1476 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5060 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4640 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2520 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4928 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1728 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2392 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1776 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5052 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 836 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2284 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4812 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1220 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4920 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4220 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1460 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4088 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2596 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5084 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1964 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1696 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1208 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3824 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2784 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 876 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4076 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2352 2584 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1772 2584 schtasks.exe 86 -
resource yara_rule behavioral2/files/0x0007000000023c9e-10.dat dcrat behavioral2/memory/4780-13-0x00000000009E0000-0x0000000000AF0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4828 powershell.exe 1888 powershell.exe 4608 powershell.exe 3584 powershell.exe 4492 powershell.exe 2124 powershell.exe 4636 powershell.exe 3100 powershell.exe 2132 powershell.exe 3844 powershell.exe 636 powershell.exe 2868 powershell.exe 4628 powershell.exe 4228 powershell.exe 4616 powershell.exe 936 powershell.exe 2776 powershell.exe 4436 powershell.exe -
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation JaffaCakes118_e748b94d218d04bab24eb56d7bb77c8b2a96e92a73134d4a85111eae21788cc4.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 14 IoCs
pid Process 4780 DllCommonsvc.exe 4552 cmd.exe 220 cmd.exe 936 cmd.exe 4548 cmd.exe 2988 cmd.exe 2760 cmd.exe 1276 cmd.exe 1812 cmd.exe 2656 cmd.exe 3108 cmd.exe 4076 cmd.exe 1776 cmd.exe 1016 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
flow ioc 36 raw.githubusercontent.com 42 raw.githubusercontent.com 51 raw.githubusercontent.com 18 raw.githubusercontent.com 37 raw.githubusercontent.com 38 raw.githubusercontent.com 39 raw.githubusercontent.com 43 raw.githubusercontent.com 44 raw.githubusercontent.com 49 raw.githubusercontent.com 50 raw.githubusercontent.com 17 raw.githubusercontent.com 52 raw.githubusercontent.com -
Drops file in Program Files directory 11 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Multimedia Platform\9e8d7a4ca61bd9 DllCommonsvc.exe File created C:\Program Files\WindowsApps\sppsvc.exe DllCommonsvc.exe File created C:\Program Files\Windows Defender\it-IT\upfc.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Photo Viewer\5940a34987c991 DllCommonsvc.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\SppExtComObj.exe DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\e1ef82546f0b02 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe DllCommonsvc.exe File created C:\Program Files\Windows Defender\it-IT\ea1d8f6d871115 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Photo Viewer\dllhost.exe DllCommonsvc.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\ebf1f9fa8afd6d DllCommonsvc.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\38384e6a620884 DllCommonsvc.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\pris\spoolsv.exe DllCommonsvc.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\pris\f3b6ecef712a24 DllCommonsvc.exe File created C:\Windows\IdentityCRL\production\csrss.exe DllCommonsvc.exe File opened for modification C:\Windows\IdentityCRL\production\csrss.exe DllCommonsvc.exe File created C:\Windows\IdentityCRL\production\886983d96e3d3e DllCommonsvc.exe File created C:\Windows\ServiceProfiles\SearchApp.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_e748b94d218d04bab24eb56d7bb77c8b2a96e92a73134d4a85111eae21788cc4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings JaffaCakes118_e748b94d218d04bab24eb56d7bb77c8b2a96e92a73134d4a85111eae21788cc4.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1220 schtasks.exe 1460 schtasks.exe 1696 schtasks.exe 3984 schtasks.exe 1612 schtasks.exe 2520 schtasks.exe 1728 schtasks.exe 2392 schtasks.exe 2352 schtasks.exe 3588 schtasks.exe 2968 schtasks.exe 1776 schtasks.exe 3824 schtasks.exe 1136 schtasks.exe 5052 schtasks.exe 2832 schtasks.exe 5008 schtasks.exe 532 schtasks.exe 5044 schtasks.exe 4792 schtasks.exe 2004 schtasks.exe 2284 schtasks.exe 4088 schtasks.exe 5084 schtasks.exe 4812 schtasks.exe 2596 schtasks.exe 2784 schtasks.exe 2052 schtasks.exe 780 schtasks.exe 2940 schtasks.exe 4252 schtasks.exe 5060 schtasks.exe 1772 schtasks.exe 836 schtasks.exe 1964 schtasks.exe 220 schtasks.exe 3708 schtasks.exe 4504 schtasks.exe 1444 schtasks.exe 1476 schtasks.exe 876 schtasks.exe 4076 schtasks.exe 3016 schtasks.exe 4640 schtasks.exe 4928 schtasks.exe 4220 schtasks.exe 1208 schtasks.exe 2756 schtasks.exe 4000 schtasks.exe 312 schtasks.exe 4920 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4780 DllCommonsvc.exe 4780 DllCommonsvc.exe 4780 DllCommonsvc.exe 4780 DllCommonsvc.exe 4780 DllCommonsvc.exe 4780 DllCommonsvc.exe 4780 DllCommonsvc.exe 4780 DllCommonsvc.exe 4780 DllCommonsvc.exe 4780 DllCommonsvc.exe 4780 DllCommonsvc.exe 4780 DllCommonsvc.exe 4780 DllCommonsvc.exe 4780 DllCommonsvc.exe 4780 DllCommonsvc.exe 4780 DllCommonsvc.exe 4780 DllCommonsvc.exe 4436 powershell.exe 4436 powershell.exe 4608 powershell.exe 4608 powershell.exe 636 powershell.exe 636 powershell.exe 2124 powershell.exe 2124 powershell.exe 3844 powershell.exe 3844 powershell.exe 2776 powershell.exe 2776 powershell.exe 4616 powershell.exe 4616 powershell.exe 936 powershell.exe 936 powershell.exe 4628 powershell.exe 4628 powershell.exe 3100 powershell.exe 3100 powershell.exe 3584 powershell.exe 3584 powershell.exe 2868 powershell.exe 2868 powershell.exe 4228 powershell.exe 4228 powershell.exe 4636 powershell.exe 4636 powershell.exe 2124 powershell.exe 4492 powershell.exe 4492 powershell.exe 1888 powershell.exe 1888 powershell.exe 4828 powershell.exe 4828 powershell.exe 4436 powershell.exe 4436 powershell.exe 2132 powershell.exe 2132 powershell.exe 4492 powershell.exe 4828 powershell.exe 2132 powershell.exe 4608 powershell.exe 636 powershell.exe 4616 powershell.exe 936 powershell.exe 3844 powershell.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeDebugPrivilege 4780 DllCommonsvc.exe Token: SeDebugPrivilege 4436 powershell.exe Token: SeDebugPrivilege 4608 powershell.exe Token: SeDebugPrivilege 636 powershell.exe Token: SeDebugPrivilege 2124 powershell.exe Token: SeDebugPrivilege 3844 powershell.exe Token: SeDebugPrivilege 2776 powershell.exe Token: SeDebugPrivilege 4616 powershell.exe Token: SeDebugPrivilege 1888 powershell.exe Token: SeDebugPrivilege 3100 powershell.exe Token: SeDebugPrivilege 936 powershell.exe Token: SeDebugPrivilege 4628 powershell.exe Token: SeDebugPrivilege 2868 powershell.exe Token: SeDebugPrivilege 3584 powershell.exe Token: SeDebugPrivilege 4228 powershell.exe Token: SeDebugPrivilege 4828 powershell.exe Token: SeDebugPrivilege 4636 powershell.exe Token: SeDebugPrivilege 2132 powershell.exe Token: SeDebugPrivilege 4492 powershell.exe Token: SeDebugPrivilege 4552 cmd.exe Token: SeDebugPrivilege 220 cmd.exe Token: SeDebugPrivilege 936 cmd.exe Token: SeDebugPrivilege 4548 cmd.exe Token: SeDebugPrivilege 2988 cmd.exe Token: SeDebugPrivilege 2760 cmd.exe Token: SeDebugPrivilege 1276 cmd.exe Token: SeDebugPrivilege 1812 cmd.exe Token: SeDebugPrivilege 2656 cmd.exe Token: SeDebugPrivilege 3108 cmd.exe Token: SeDebugPrivilege 4076 cmd.exe Token: SeDebugPrivilege 1776 cmd.exe Token: SeDebugPrivilege 1016 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1092 wrote to memory of 2548 1092 JaffaCakes118_e748b94d218d04bab24eb56d7bb77c8b2a96e92a73134d4a85111eae21788cc4.exe 82 PID 1092 wrote to memory of 2548 1092 JaffaCakes118_e748b94d218d04bab24eb56d7bb77c8b2a96e92a73134d4a85111eae21788cc4.exe 82 PID 1092 wrote to memory of 2548 1092 JaffaCakes118_e748b94d218d04bab24eb56d7bb77c8b2a96e92a73134d4a85111eae21788cc4.exe 82 PID 2548 wrote to memory of 4556 2548 WScript.exe 83 PID 2548 wrote to memory of 4556 2548 WScript.exe 83 PID 2548 wrote to memory of 4556 2548 WScript.exe 83 PID 4556 wrote to memory of 4780 4556 cmd.exe 85 PID 4556 wrote to memory of 4780 4556 cmd.exe 85 PID 4780 wrote to memory of 4492 4780 DllCommonsvc.exe 138 PID 4780 wrote to memory of 4492 4780 DllCommonsvc.exe 138 PID 4780 wrote to memory of 2124 4780 DllCommonsvc.exe 139 PID 4780 wrote to memory of 2124 4780 DllCommonsvc.exe 139 PID 4780 wrote to memory of 4636 4780 DllCommonsvc.exe 140 PID 4780 wrote to memory of 4636 4780 DllCommonsvc.exe 140 PID 4780 wrote to memory of 3584 4780 DllCommonsvc.exe 141 PID 4780 wrote to memory of 3584 4780 DllCommonsvc.exe 141 PID 4780 wrote to memory of 4608 4780 DllCommonsvc.exe 142 PID 4780 wrote to memory of 4608 4780 DllCommonsvc.exe 142 PID 4780 wrote to memory of 1888 4780 DllCommonsvc.exe 143 PID 4780 wrote to memory of 1888 4780 DllCommonsvc.exe 143 PID 4780 wrote to memory of 3844 4780 DllCommonsvc.exe 144 PID 4780 wrote to memory of 3844 4780 DllCommonsvc.exe 144 PID 4780 wrote to memory of 4616 4780 DllCommonsvc.exe 146 PID 4780 wrote to memory of 4616 4780 DllCommonsvc.exe 146 PID 4780 wrote to memory of 2132 4780 DllCommonsvc.exe 147 PID 4780 wrote to memory of 2132 4780 DllCommonsvc.exe 147 PID 4780 wrote to memory of 4628 4780 DllCommonsvc.exe 149 PID 4780 wrote to memory of 4628 4780 DllCommonsvc.exe 149 PID 4780 wrote to memory of 2868 4780 DllCommonsvc.exe 150 PID 4780 wrote to memory of 2868 4780 DllCommonsvc.exe 150 PID 4780 wrote to memory of 3100 4780 DllCommonsvc.exe 151 PID 4780 wrote to memory of 3100 4780 DllCommonsvc.exe 151 PID 4780 wrote to memory of 4228 4780 DllCommonsvc.exe 152 PID 4780 wrote to memory of 4228 4780 DllCommonsvc.exe 152 PID 4780 wrote to memory of 4436 4780 DllCommonsvc.exe 153 PID 4780 wrote to memory of 4436 4780 DllCommonsvc.exe 153 PID 4780 wrote to memory of 636 4780 DllCommonsvc.exe 154 PID 4780 wrote to memory of 636 4780 DllCommonsvc.exe 154 PID 4780 wrote to memory of 4828 4780 DllCommonsvc.exe 156 PID 4780 wrote to memory of 4828 4780 DllCommonsvc.exe 156 PID 4780 wrote to memory of 2776 4780 DllCommonsvc.exe 157 PID 4780 wrote to memory of 2776 4780 DllCommonsvc.exe 157 PID 4780 wrote to memory of 936 4780 DllCommonsvc.exe 158 PID 4780 wrote to memory of 936 4780 DllCommonsvc.exe 158 PID 4780 wrote to memory of 1896 4780 DllCommonsvc.exe 174 PID 4780 wrote to memory of 1896 4780 DllCommonsvc.exe 174 PID 1896 wrote to memory of 4816 1896 cmd.exe 176 PID 1896 wrote to memory of 4816 1896 cmd.exe 176 PID 1896 wrote to memory of 4552 1896 cmd.exe 177 PID 1896 wrote to memory of 4552 1896 cmd.exe 177 PID 4552 wrote to memory of 2276 4552 cmd.exe 182 PID 4552 wrote to memory of 2276 4552 cmd.exe 182 PID 2276 wrote to memory of 4496 2276 cmd.exe 184 PID 2276 wrote to memory of 4496 2276 cmd.exe 184 PID 2276 wrote to memory of 220 2276 cmd.exe 187 PID 2276 wrote to memory of 220 2276 cmd.exe 187 PID 220 wrote to memory of 1540 220 cmd.exe 190 PID 220 wrote to memory of 1540 220 cmd.exe 190 PID 1540 wrote to memory of 4768 1540 cmd.exe 192 PID 1540 wrote to memory of 4768 1540 cmd.exe 192 PID 1540 wrote to memory of 936 1540 cmd.exe 193 PID 1540 wrote to memory of 936 1540 cmd.exe 193 PID 936 wrote to memory of 3268 936 cmd.exe 194 PID 936 wrote to memory of 3268 936 cmd.exe 194 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e748b94d218d04bab24eb56d7bb77c8b2a96e92a73134d4a85111eae21788cc4.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e748b94d218d04bab24eb56d7bb77c8b2a96e92a73134d4a85111eae21788cc4.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4492
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IdentityCRL\production\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4636
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3584
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4608
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1888
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3844
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4616
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\SppExtComObj.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2132
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4628
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3100
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\unsecapp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4228
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4436
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ServiceProfiles\SearchApp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:636
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Registry.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\pris\spoolsv.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\it-IT\upfc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:936
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6cCjb0ANlA.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:4816
-
-
C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qtVTp5BaF9.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:4496
-
-
C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JhLzHEla3w.bat"9⤵
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:4768
-
-
C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tpXWVAFTZv.bat"11⤵PID:3268
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:5084
-
-
C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4548 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dCyIaH4v8D.bat"13⤵PID:4144
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:540
-
-
C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2988 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\u02VouYs0z.bat"15⤵PID:4544
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:2888
-
-
C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2760 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qtVTp5BaF9.bat"17⤵PID:4816
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:1208
-
-
C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1276 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j5PKlq1uIo.bat"19⤵PID:1244
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:4028
-
-
C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1812 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NYP5fOsMgV.bat"21⤵PID:2276
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:3116
-
-
C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2656 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZBm8ilTxac.bat"23⤵PID:4292
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:3556
-
-
C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3108 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x1DfgQ9qXa.bat"25⤵PID:2848
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:1524
-
-
C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4076 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2zdeBu3xOP.bat"27⤵PID:3844
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:228⤵PID:3680
-
-
C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1776 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2zdeBu3xOP.bat"29⤵PID:4536
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:230⤵PID:1704
-
-
C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\IdentityCRL\production\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\production\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\IdentityCRL\production\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3984
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4000
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Pictures\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\Pictures\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Pictures\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\providercommon\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3708
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:312
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3588
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4504
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1444
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1136
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4252
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1476
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\providercommon\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\providercommon\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\providercommon\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5052
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1776
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\providercommon\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\providercommon\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4812
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\providercommon\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Windows\ServiceProfiles\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4088
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Windows\ServiceProfiles\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5084
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\providercommon\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1208
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\pris\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\pris\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\pris\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\it-IT\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4076
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\it-IT\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\it-IT\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD53a5e1f1efff867a822c6a57ee928dd66
SHA1b017854d8a1deb05f1447e9dd6002902fb66bf6b
SHA2568222fe869b025493591ca2ffbabe089c2e682449e77b754fc864ba62d64ee957
SHA51225fc0fd6a71595c44efe34d281c4bc4924ac82f76b9f697497d0019fa2c8e0cadf58f92ae4272f00b1ef1e97dfd93bd740a9e7f7d9dc93cb1cadbde5f93d1782
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD528d4235aa2e6d782751f980ceb6e5021
SHA1f5d82d56acd642b9fc4b963f684fd6b78f25a140
SHA2568c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638
SHA512dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2
-
Filesize
227B
MD5963635f67cc5af81ce00c584a29e568c
SHA13b1d201fa60ef24ed4419e59fe0d69e93f1ff1b9
SHA256de00dfca1e20d1e48d501f17ced732b0292234a136d88508a6cecfc6d381bd2d
SHA512760aa08a0bee111409b88d08a1195bd391bbbc45216a5d4a09775cf0cf88c61d1929efcebd17c5bbd6f741ed627380eac4f6a07655d344a36c5169b37ce1fa83
-
Filesize
227B
MD57d0125f2aaac3c9241c64299ac3b19e4
SHA1232d9cb790b4e7b9ad192831f8a5a4db4734265a
SHA256ab3062633f70419eeb6096270eaa96dd2bc3587b3371e2c687d2d7af9562c889
SHA5121a0530189dfeb4a460b6ca6b953f7c3735e6ebff541ccdf8cd1b0d503ca9cd7659c0128e3710b187915fea6dc324c25f19b2d106ba39b2916bccafa1a8d621dc
-
Filesize
227B
MD500668dd0f06c87e3ea2ad35bae4171f0
SHA10a58f1b1502d16049389ed12f7f8fed6fd2e38b6
SHA2566d4794c88a6781691c7a76b276490fb4cff939b93f20910cb41612946c7fe796
SHA512e08cb449758e97831b1e15909c6afbcdda6a5fe189e1a5c7bbc11f41a414fd67b2fecbea57fca29b855197e8440009044d8d2308ce343848323c5987df3e0e41
-
Filesize
227B
MD5ecc28b72e2a88ad029b45802f16ec08e
SHA104be9bf7eae169b7344c3586c2cd6b165ddbd18f
SHA256d644bb7f27ee9af3b5ebc61b2e899b3410236ed444979c0ce2e19fc0b79356ed
SHA5124333a58675bd1b181787bb98a91cea1dbc98377e71ca9c4128fb50d09a226dbff8900aa8ba76860e50bc1c9cdd7c16bbcbf78ed3c24b23f4c5ac032ae9953edd
-
Filesize
227B
MD5f86face2d437e113dcb95850d09cbb84
SHA168081f28668cc97e2b774f054cf52c130de81884
SHA2560a28fe7de943d66424405a8ef00fd887a4b4fdf99a436fc857f715429fa44bd5
SHA5129222e301b003dc9c0a0c880491636c25ab20764653443c36416447e156203eb14000d9c428a53d1efa7a09642e2d3c9b518d1fc3c3f9a53c75f1fcf6655eedbc
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
227B
MD5180bdb41f070d5b0f6d4b6e1cbde30c9
SHA1d0d524d7c0b190f2947df748dd00d5d930dfd7e6
SHA2561d8573ad66893781d290b199f138e42f722af172f7652bb51271d9c92518fc6b
SHA51290975ca3f08cef34fe6c928150286b4ff79f8f42130b69fd6047cd2ccc635ee4933aeed374fb4827f4be33ff90c03147f2c749734658963a4e52c23a0c9e468c
-
Filesize
227B
MD57acea0545fe970560fd6a56d617ecbd0
SHA1db0c964e99d6151ffecb724f69f9b91889959fc5
SHA256852c6a00cb0e4312b1365319413401ee1f3ade0eac589f5da2337ac11c787633
SHA5126f723c56657f708adbec7c781f3473cd09f39041dbf997da2a7a49f7edead27d712e0cb0e866887cc40ab136242e4488ecd247ac0b268926f292cbee1b369338
-
Filesize
227B
MD5c511f990d2a79b6a7a855c827f87701a
SHA1a8516f658b1b6d93003d7946cb950a56d72fe4d0
SHA256d96db7305cfbe8e24fe30a39215972bec445f78662c5c51425a5d39107da5cb8
SHA5121e5beae9eeb52cb212528ec4b3fff5a99cf201b967fbe1b10f2f15b3b4fab001ef190045154289084972efec5a10cd130d10e40cff46ddd7e0977949031d3392
-
Filesize
227B
MD51fdca00feab4919dca200fed77386291
SHA1d91e9b22857d9e6c5ce1bea692ccdaa146e66ffe
SHA256e64141b9e41b95334fc12af79369c0761775d7d1fada1ff288a2e631eff450b4
SHA51273e4f0c7a58916e63b2b7e8d5af58305fcac630d47948ad6d81bcfbade4a91b07780e2fee0f3712e2e2dcf500cd194c9d85d93106359dfbb0dbe89b49177c8da
-
Filesize
227B
MD52b35c95e409242a9be6cc68b9a2ff4ec
SHA13afe4b98ce61f0ab462e8ed118a66e866ebd9326
SHA2569c3fe4b47f2933fadc0dc016f45ecc6575c0ee4fc8c0422521d33583d1bfd3f0
SHA51276a648f64c12c258f7fa8dc96c358c773d3c3f26a4231defc6233602b54120f445d84074a05ff26fa7926735d4cbb79c9b28a04da11d7fa2881fa912d802667b
-
Filesize
227B
MD5e03144873ce6c42932748a557c751d43
SHA1a7e0316ddafd6e362d1036d3d595671e1b84a1b5
SHA2563e6e665271cc08f5ff6b0f7fb61d445e36da23682ddd134bfdd171531d54305f
SHA512580f991a37bb81a80f8063509d35006f58fad502223ba5d3e78a3506f0d94d52e744e1a2b09de9ca941e5749aeae57c46270bf347c29872f1e1d8336dd5002e3
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478