Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 02:03
Behavioral task
behavioral1
Sample
JaffaCakes118_bcf048384781099cbf7333dba8d51985908a33cdb1dfbb315a33ff8af92c4a99.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_bcf048384781099cbf7333dba8d51985908a33cdb1dfbb315a33ff8af92c4a99.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_bcf048384781099cbf7333dba8d51985908a33cdb1dfbb315a33ff8af92c4a99.exe
-
Size
1.3MB
-
MD5
2a1f4d34ad5c44906d6fec7584afb5e9
-
SHA1
54cc1a9fe88281490bb5c3336a505a16d88e2e02
-
SHA256
bcf048384781099cbf7333dba8d51985908a33cdb1dfbb315a33ff8af92c4a99
-
SHA512
341a3dead26b8be2374d25f9cdfc28c662ffb2d76ee1ef4ac59e79df7deef11c1155216565b527d5f9aaaa2a24c8f53839ef51417c30d7c4b0d29c6df667e1f3
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 54 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4420 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4188 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2892 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3080 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2248 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1952 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5080 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4852 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4424 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4116 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2932 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4552 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2344 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3132 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1272 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2652 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3328 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2972 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4988 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4936 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2832 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1992 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4476 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 640 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 396 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2484 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1780 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3144 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3972 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4516 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3612 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1816 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3700 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1192 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1056 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1152 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4460 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2644 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3764 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4824 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3052 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2340 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4288 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1576 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4656 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1840 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2156 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1756 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2296 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2104 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2204 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 228 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4404 1860 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2528 1860 schtasks.exe 86 -
resource yara_rule behavioral2/files/0x000a000000023b7e-10.dat dcrat behavioral2/memory/1460-13-0x0000000000470000-0x0000000000580000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1624 powershell.exe 1200 powershell.exe 220 powershell.exe 1176 powershell.exe 4000 powershell.exe 4340 powershell.exe 5012 powershell.exe 468 powershell.exe 1180 powershell.exe 1616 powershell.exe 1936 powershell.exe 8 powershell.exe 5100 powershell.exe 1572 powershell.exe 3408 powershell.exe 4488 powershell.exe 1196 powershell.exe 4432 powershell.exe 4868 powershell.exe -
Checks computer location settings 2 TTPs 17 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation JaffaCakes118_bcf048384781099cbf7333dba8d51985908a33cdb1dfbb315a33ff8af92c4a99.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation winlogon.exe -
Executes dropped EXE 15 IoCs
pid Process 1460 DllCommonsvc.exe 1396 winlogon.exe 5280 winlogon.exe 4276 winlogon.exe 640 winlogon.exe 3612 winlogon.exe 5592 winlogon.exe 628 winlogon.exe 2192 winlogon.exe 6100 winlogon.exe 3284 winlogon.exe 3068 winlogon.exe 5256 winlogon.exe 5976 winlogon.exe 5420 winlogon.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs
flow ioc 52 raw.githubusercontent.com 54 raw.githubusercontent.com 43 raw.githubusercontent.com 51 raw.githubusercontent.com 53 raw.githubusercontent.com 55 raw.githubusercontent.com 37 raw.githubusercontent.com 19 raw.githubusercontent.com 38 raw.githubusercontent.com 39 raw.githubusercontent.com 44 raw.githubusercontent.com 50 raw.githubusercontent.com 18 raw.githubusercontent.com 45 raw.githubusercontent.com 21 raw.githubusercontent.com -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\Speech\Engines\TTS\cmd.exe DllCommonsvc.exe File created C:\Windows\System32\Speech\Engines\TTS\ebf1f9fa8afd6d DllCommonsvc.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\unsecapp.exe DllCommonsvc.exe File created C:\Program Files (x86)\Google\WmiPrvSE.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Mail\winlogon.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Mail\cc11b995f2a76d DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\fr-FR\StartMenuExperienceHost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\uk-UA\wininit.exe DllCommonsvc.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\29c1c3cc0f7685 DllCommonsvc.exe File created C:\Program Files\Windows Mail\f3b6ecef712a24 DllCommonsvc.exe File created C:\Program Files\Windows Mail\spoolsv.exe DllCommonsvc.exe File opened for modification C:\Program Files (x86)\Google\WmiPrvSE.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\fr-FR\55b276f4edf653 DllCommonsvc.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\conhost.exe DllCommonsvc.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\088424020bedd6 DllCommonsvc.exe File created C:\Program Files (x86)\Google\24dbde2999530e DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\uk-UA\56085415360792 DllCommonsvc.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rescache\_merged\3749802865\csrss.exe DllCommonsvc.exe File created C:\Windows\SystemResources\SppExtComObj.exe DllCommonsvc.exe File created C:\Windows\es-ES\taskhostw.exe DllCommonsvc.exe File created C:\Windows\es-ES\ea9f0e6c9e2dcd DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_bcf048384781099cbf7333dba8d51985908a33cdb1dfbb315a33ff8af92c4a99.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings JaffaCakes118_bcf048384781099cbf7333dba8d51985908a33cdb1dfbb315a33ff8af92c4a99.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings winlogon.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 640 schtasks.exe 1192 schtasks.exe 2340 schtasks.exe 1840 schtasks.exe 4552 schtasks.exe 4936 schtasks.exe 1152 schtasks.exe 4824 schtasks.exe 228 schtasks.exe 1952 schtasks.exe 5080 schtasks.exe 3972 schtasks.exe 2528 schtasks.exe 2652 schtasks.exe 1576 schtasks.exe 2296 schtasks.exe 1780 schtasks.exe 3700 schtasks.exe 4116 schtasks.exe 3132 schtasks.exe 1272 schtasks.exe 2932 schtasks.exe 4988 schtasks.exe 2892 schtasks.exe 3080 schtasks.exe 4424 schtasks.exe 4476 schtasks.exe 4516 schtasks.exe 4288 schtasks.exe 4188 schtasks.exe 2248 schtasks.exe 1992 schtasks.exe 2972 schtasks.exe 4656 schtasks.exe 2484 schtasks.exe 2156 schtasks.exe 1756 schtasks.exe 4420 schtasks.exe 2344 schtasks.exe 3328 schtasks.exe 1056 schtasks.exe 3764 schtasks.exe 4404 schtasks.exe 4852 schtasks.exe 2832 schtasks.exe 3612 schtasks.exe 4460 schtasks.exe 396 schtasks.exe 2644 schtasks.exe 2204 schtasks.exe 3144 schtasks.exe 3052 schtasks.exe 2104 schtasks.exe 1816 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1460 DllCommonsvc.exe 1460 DllCommonsvc.exe 1460 DllCommonsvc.exe 1460 DllCommonsvc.exe 1460 DllCommonsvc.exe 1460 DllCommonsvc.exe 1460 DllCommonsvc.exe 1460 DllCommonsvc.exe 1460 DllCommonsvc.exe 3408 powershell.exe 1936 powershell.exe 1936 powershell.exe 3408 powershell.exe 4488 powershell.exe 4488 powershell.exe 1196 powershell.exe 1196 powershell.exe 8 powershell.exe 8 powershell.exe 1572 powershell.exe 1572 powershell.exe 4000 powershell.exe 4000 powershell.exe 1200 powershell.exe 1200 powershell.exe 220 powershell.exe 220 powershell.exe 1176 powershell.exe 1176 powershell.exe 468 powershell.exe 468 powershell.exe 5100 powershell.exe 5100 powershell.exe 1396 winlogon.exe 1396 winlogon.exe 1616 powershell.exe 1616 powershell.exe 5012 powershell.exe 5012 powershell.exe 4340 powershell.exe 4340 powershell.exe 4868 powershell.exe 4868 powershell.exe 1624 powershell.exe 1180 powershell.exe 1180 powershell.exe 1624 powershell.exe 4432 powershell.exe 4432 powershell.exe 1180 powershell.exe 5100 powershell.exe 4868 powershell.exe 3408 powershell.exe 3408 powershell.exe 4488 powershell.exe 4488 powershell.exe 1936 powershell.exe 1936 powershell.exe 1176 powershell.exe 220 powershell.exe 1196 powershell.exe 4000 powershell.exe 1200 powershell.exe 1572 powershell.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeDebugPrivilege 1460 DllCommonsvc.exe Token: SeDebugPrivilege 3408 powershell.exe Token: SeDebugPrivilege 1936 powershell.exe Token: SeDebugPrivilege 1396 winlogon.exe Token: SeDebugPrivilege 4488 powershell.exe Token: SeDebugPrivilege 1196 powershell.exe Token: SeDebugPrivilege 4868 powershell.exe Token: SeDebugPrivilege 8 powershell.exe Token: SeDebugPrivilege 1572 powershell.exe Token: SeDebugPrivilege 4000 powershell.exe Token: SeDebugPrivilege 1180 powershell.exe Token: SeDebugPrivilege 1200 powershell.exe Token: SeDebugPrivilege 220 powershell.exe Token: SeDebugPrivilege 1176 powershell.exe Token: SeDebugPrivilege 468 powershell.exe Token: SeDebugPrivilege 5100 powershell.exe Token: SeDebugPrivilege 1616 powershell.exe Token: SeDebugPrivilege 5012 powershell.exe Token: SeDebugPrivilege 4340 powershell.exe Token: SeDebugPrivilege 1624 powershell.exe Token: SeDebugPrivilege 4432 powershell.exe Token: SeDebugPrivilege 5280 winlogon.exe Token: SeDebugPrivilege 4276 winlogon.exe Token: SeDebugPrivilege 640 winlogon.exe Token: SeDebugPrivilege 3612 winlogon.exe Token: SeDebugPrivilege 5592 winlogon.exe Token: SeDebugPrivilege 628 winlogon.exe Token: SeDebugPrivilege 2192 winlogon.exe Token: SeDebugPrivilege 6100 winlogon.exe Token: SeDebugPrivilege 3284 winlogon.exe Token: SeDebugPrivilege 3068 winlogon.exe Token: SeDebugPrivilege 5256 winlogon.exe Token: SeDebugPrivilege 5976 winlogon.exe Token: SeDebugPrivilege 5420 winlogon.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3220 wrote to memory of 1552 3220 JaffaCakes118_bcf048384781099cbf7333dba8d51985908a33cdb1dfbb315a33ff8af92c4a99.exe 82 PID 3220 wrote to memory of 1552 3220 JaffaCakes118_bcf048384781099cbf7333dba8d51985908a33cdb1dfbb315a33ff8af92c4a99.exe 82 PID 3220 wrote to memory of 1552 3220 JaffaCakes118_bcf048384781099cbf7333dba8d51985908a33cdb1dfbb315a33ff8af92c4a99.exe 82 PID 1552 wrote to memory of 3680 1552 WScript.exe 87 PID 1552 wrote to memory of 3680 1552 WScript.exe 87 PID 1552 wrote to memory of 3680 1552 WScript.exe 87 PID 3680 wrote to memory of 1460 3680 cmd.exe 89 PID 3680 wrote to memory of 1460 3680 cmd.exe 89 PID 1460 wrote to memory of 4432 1460 DllCommonsvc.exe 144 PID 1460 wrote to memory of 4432 1460 DllCommonsvc.exe 144 PID 1460 wrote to memory of 220 1460 DllCommonsvc.exe 145 PID 1460 wrote to memory of 220 1460 DllCommonsvc.exe 145 PID 1460 wrote to memory of 1572 1460 DllCommonsvc.exe 146 PID 1460 wrote to memory of 1572 1460 DllCommonsvc.exe 146 PID 1460 wrote to memory of 3408 1460 DllCommonsvc.exe 147 PID 1460 wrote to memory of 3408 1460 DllCommonsvc.exe 147 PID 1460 wrote to memory of 5012 1460 DllCommonsvc.exe 148 PID 1460 wrote to memory of 5012 1460 DllCommonsvc.exe 148 PID 1460 wrote to memory of 4340 1460 DllCommonsvc.exe 149 PID 1460 wrote to memory of 4340 1460 DllCommonsvc.exe 149 PID 1460 wrote to memory of 5100 1460 DllCommonsvc.exe 151 PID 1460 wrote to memory of 5100 1460 DllCommonsvc.exe 151 PID 1460 wrote to memory of 4000 1460 DllCommonsvc.exe 152 PID 1460 wrote to memory of 4000 1460 DllCommonsvc.exe 152 PID 1460 wrote to memory of 8 1460 DllCommonsvc.exe 153 PID 1460 wrote to memory of 8 1460 DllCommonsvc.exe 153 PID 1460 wrote to memory of 1196 1460 DllCommonsvc.exe 154 PID 1460 wrote to memory of 1196 1460 DllCommonsvc.exe 154 PID 1460 wrote to memory of 4488 1460 DllCommonsvc.exe 155 PID 1460 wrote to memory of 4488 1460 DllCommonsvc.exe 155 PID 1460 wrote to memory of 4868 1460 DllCommonsvc.exe 156 PID 1460 wrote to memory of 4868 1460 DllCommonsvc.exe 156 PID 1460 wrote to memory of 1200 1460 DllCommonsvc.exe 157 PID 1460 wrote to memory of 1200 1460 DllCommonsvc.exe 157 PID 1460 wrote to memory of 1936 1460 DllCommonsvc.exe 158 PID 1460 wrote to memory of 1936 1460 DllCommonsvc.exe 158 PID 1460 wrote to memory of 1176 1460 DllCommonsvc.exe 159 PID 1460 wrote to memory of 1176 1460 DllCommonsvc.exe 159 PID 1460 wrote to memory of 468 1460 DllCommonsvc.exe 160 PID 1460 wrote to memory of 468 1460 DllCommonsvc.exe 160 PID 1460 wrote to memory of 1616 1460 DllCommonsvc.exe 161 PID 1460 wrote to memory of 1616 1460 DllCommonsvc.exe 161 PID 1460 wrote to memory of 1624 1460 DllCommonsvc.exe 162 PID 1460 wrote to memory of 1624 1460 DllCommonsvc.exe 162 PID 1460 wrote to memory of 1180 1460 DllCommonsvc.exe 163 PID 1460 wrote to memory of 1180 1460 DllCommonsvc.exe 163 PID 1460 wrote to memory of 1396 1460 DllCommonsvc.exe 181 PID 1460 wrote to memory of 1396 1460 DllCommonsvc.exe 181 PID 1396 wrote to memory of 5124 1396 winlogon.exe 186 PID 1396 wrote to memory of 5124 1396 winlogon.exe 186 PID 5124 wrote to memory of 5196 5124 cmd.exe 188 PID 5124 wrote to memory of 5196 5124 cmd.exe 188 PID 5124 wrote to memory of 5280 5124 cmd.exe 189 PID 5124 wrote to memory of 5280 5124 cmd.exe 189 PID 5280 wrote to memory of 5464 5280 winlogon.exe 190 PID 5280 wrote to memory of 5464 5280 winlogon.exe 190 PID 5464 wrote to memory of 5496 5464 cmd.exe 192 PID 5464 wrote to memory of 5496 5464 cmd.exe 192 PID 5464 wrote to memory of 4276 5464 cmd.exe 195 PID 5464 wrote to memory of 4276 5464 cmd.exe 195 PID 4276 wrote to memory of 5572 4276 winlogon.exe 196 PID 4276 wrote to memory of 5572 4276 winlogon.exe 196 PID 5572 wrote to memory of 748 5572 cmd.exe 198 PID 5572 wrote to memory of 748 5572 cmd.exe 198 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bcf048384781099cbf7333dba8d51985908a33cdb1dfbb315a33ff8af92c4a99.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bcf048384781099cbf7333dba8d51985908a33cdb1dfbb315a33ff8af92c4a99.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4432
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\WmiPrvSE.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:220
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Templates\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1572
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Registry.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3408
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5012
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\upfc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4000
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\fr-FR\StartMenuExperienceHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\SearchApp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4488
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\Speech\Engines\TTS\cmd.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1200
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\uk-UA\wininit.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1936
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\es-ES\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1176
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OfficeClickToRun.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:468
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\unsecapp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1624
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\spoolsv.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1180
-
-
C:\Program Files (x86)\Windows Mail\winlogon.exe"C:\Program Files (x86)\Windows Mail\winlogon.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EYKlAcFNfO.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:5196
-
-
C:\Program Files (x86)\Windows Mail\winlogon.exe"C:\Program Files (x86)\Windows Mail\winlogon.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0rnbwo7iYS.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:5496
-
-
C:\Program Files (x86)\Windows Mail\winlogon.exe"C:\Program Files (x86)\Windows Mail\winlogon.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\p5ITN63wlJ.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:748
-
-
C:\Program Files (x86)\Windows Mail\winlogon.exe"C:\Program Files (x86)\Windows Mail\winlogon.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:640 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ssDSZpddA3.bat"12⤵PID:6020
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:6032
-
-
C:\Program Files (x86)\Windows Mail\winlogon.exe"C:\Program Files (x86)\Windows Mail\winlogon.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3612 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\o09MCfWrWU.bat"14⤵PID:5556
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:1032
-
-
C:\Program Files (x86)\Windows Mail\winlogon.exe"C:\Program Files (x86)\Windows Mail\winlogon.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5592 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gMBHdlpNUB.bat"16⤵PID:1176
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:3736
-
-
C:\Program Files (x86)\Windows Mail\winlogon.exe"C:\Program Files (x86)\Windows Mail\winlogon.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:628 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\t3iRsZx2b7.bat"18⤵PID:2680
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:1936
-
-
C:\Program Files (x86)\Windows Mail\winlogon.exe"C:\Program Files (x86)\Windows Mail\winlogon.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2192 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Gozseo6rLH.bat"20⤵PID:2080
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:2308
-
-
C:\Program Files (x86)\Windows Mail\winlogon.exe"C:\Program Files (x86)\Windows Mail\winlogon.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:6100 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JbtrqXgYk1.bat"22⤵PID:4644
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:1144
-
-
C:\Program Files (x86)\Windows Mail\winlogon.exe"C:\Program Files (x86)\Windows Mail\winlogon.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3284 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\k2jNhBdkgg.bat"24⤵PID:4960
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:2424
-
-
C:\Program Files (x86)\Windows Mail\winlogon.exe"C:\Program Files (x86)\Windows Mail\winlogon.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3068 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TK13bru719.bat"26⤵PID:1840
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:812
-
-
C:\Program Files (x86)\Windows Mail\winlogon.exe"C:\Program Files (x86)\Windows Mail\winlogon.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5256 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HZWv28qLDz.bat"28⤵PID:5372
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:5540
-
-
C:\Program Files (x86)\Windows Mail\winlogon.exe"C:\Program Files (x86)\Windows Mail\winlogon.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5976 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\h6hK16ZrMt.bat"30⤵PID:2644
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵PID:3868
-
-
C:\Program Files (x86)\Windows Mail\winlogon.exe"C:\Program Files (x86)\Windows Mail\winlogon.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5420 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WRY5ahHPmz.bat"32⤵PID:1924
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:233⤵PID:5272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4420
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4188
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Google\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Templates\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Templates\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Templates\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4852
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4424
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4116
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4552
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2344
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\All Users\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3132
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\providercommon\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Downloads\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Downloads\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4476
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Downloads\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\providercommon\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3144
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\providercommon\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3972
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\providercommon\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4516
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3612
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3700
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Windows\System32\Speech\Engines\TTS\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1192
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\System32\Speech\Engines\TTS\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Windows\System32\Speech\Engines\TTS\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1152
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Windows\es-ES\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\es-ES\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Windows\es-ES\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\providercommon\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:228
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Mail\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD528d4235aa2e6d782751f980ceb6e5021
SHA1f5d82d56acd642b9fc4b963f684fd6b78f25a140
SHA2568c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638
SHA512dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
213B
MD52ca881c026bc4511cb8b7c4a12d39ffc
SHA12ff8658b82e60a93d8ea95dd133914d6871a454b
SHA256bbc351e33a44da33ea217d3c3ca1e50a867c502ec197c4b5f8e5e69ed350a795
SHA512dadae151f0abac4b431de8871439bb5c1bcbd1154cdd329b71c2c755c74b566a764efa0dd09f0f18263b8fac6209efa0e6ac0ef45c78aab03608364b65d2965d
-
Filesize
213B
MD5ce143d630626a2d5a4294f788e9b2b20
SHA181e961f2218581091bc13428a054ab3405a22eeb
SHA25698733cf464ce68f872e698dbbb11a3429bdbced3f2853c80fb57ea364179742a
SHA5121881a7d2643041d7b2cfcd7592e4387b986f36fa79875b2565ce86fa675ff1bb142e86c667c1967a0137e836339201d810038e922aac2993686e4ad28f94fd40
-
Filesize
213B
MD5dccc3c0e0b065a5ccb6775ecb6140cae
SHA16efc17405500876e27917e15cc988ad177688e6d
SHA256b838ec9ee060a13400e061f07f3d76b6a5bf8e9fcbbd6e2e1207354a26d13ca8
SHA512e3bba5a1dc6f69f8cc0ccc48063beb3fe7b821bc455dd4fe28e554057a1fcbae12caae888484f401a7aa7e851df3c558abf79e9a96e3201cb657e72aded19ea4
-
Filesize
213B
MD556e3c6d5e2a145f2c81f2b70f012e2c9
SHA132aed2124bb255f7a6dc998cd9f626babed773bd
SHA256793d47145486e42e49ba4f9923ecfd8edcd50b9537f72d159e653a7206637ef2
SHA5125c5980660fb05e9ed95cf05b53c11748e310b0a553cb833199bc445311ad0997990a6730665d169396262529442237f96bd89743dbadb3713466820e07c39c01
-
Filesize
213B
MD51de644a275ff55be0309b09be423a03f
SHA1133fe0e1ac46f277109e7e6e67f5c0bbc195a536
SHA2561ed5a6b899af1228e5ed5ffff4526a9e896d3b2fb48723e302828931588fc415
SHA51297cf72a8b1260bcea16baeb7ce23532d6e44c7538c97988d27d2ecf76d7ffedfe941db829ace3162ccf1d1f5da9be2e488667e7a5abac3ef8fa4b43a76d929d7
-
Filesize
213B
MD5c8197a0e2c000eecd96cfed250baa4d2
SHA14666e3adca6c4610199cc5684761305c12552f2b
SHA25658c0366c245014c096c611aa2ddeb7e245cf15200b97045b0883d47e44188020
SHA512e58061af06a061520a7e0a71d4ef5a99e738b9769a6175647b2d97b607f2f7a76d333035bc4808c09e62bab8ca39869d43929c3f62ebf6a358164c7e47805ee0
-
Filesize
213B
MD5657d95cecab7e435772fcda86f61dfa2
SHA19431e344a88b13bc23410b39f90016ac6485d23d
SHA256fa22e263a139d299059445088300445b7ff657c77b25266d8ac069b59b606713
SHA5127e6abb9a98bd13480a0f7e8fdffa792a10e98224cd55ee80bcde8e5de496d75ea005c09ea3f1c463cfa0cb1b69799c76de3a8d1385f47e8f6d3a59351dfcad2d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
213B
MD54e2beb1169a4c851c5077b7da6ade09f
SHA1f395568acf803acf1575a96029e7b2406ad40d39
SHA2565c5889ac7fd4024a51492eb38bfa160ac606ddadbf4663c9046ca1e6a548d10e
SHA512fcdc4c52cceacd24371e0f013e424735e3239b8e1b1f22c10aaf9e2c39ea49bc950103df020031d19b424e8128ca0de462706151848a265589968320f0d3eaca
-
Filesize
213B
MD59acbf272a436ad6c665a0981fad6fa6a
SHA1ceb5d1937b19a853917d3d15da2647b3ab8789fe
SHA2565ab86b7c2fd428c9f6ed17d8f5a640c518046dd9fc7dd268b14fc6993dd6c9f0
SHA5121ec10d2fb489f067c6b3a60922e1cb11e9366b0158f80db46d128e38cd35e9c63d7e0b4883296064442c33e358a9cfac8cd38e9803876a5c8790c1d81d020265
-
Filesize
213B
MD577854fb801e91507ae46e6e5b4458638
SHA16b282a2fcc652f10592c5885e14fc08967015d25
SHA256b13d7ac8a5f6740c789b754c5976d2f9b594b999dfcb2c61e227f756b0f99780
SHA512e9bd163e187766619cec16698ed2008fc81f258cc39bcb97da6025d20ecf9f30ccd30b54748e8581557f759fe4ada3adf3a60c3024aa9c0dfda9f8e2183d1979
-
Filesize
213B
MD589c13092cb05c74954a8d628e1fe3b6f
SHA11842dfa68efab86a646db7d0c6a12d74bce3471e
SHA256243246295492ae2f6eeb2e8b8da4912e6ba2fc06a3cf00ae74f76a97578303bb
SHA51243d25343b15d1883d025da6942094cfac235ea7b444afcc72b16037c3bac82434a908c29794d09f25da69a832f172d0d5bfa122bd25008224f32cef4e760294a
-
Filesize
213B
MD58db40baf2939c131581ac39c6fb45933
SHA19e6ed957026dcb1f27012604a379e7976ff81fee
SHA256a8d1bbdf3a550c0ba75083ab4d8f2d695636a060d65e75b4588f50b9ada4b634
SHA512e8b249a9139134c7f1725802da93399bc94e64b4010935034c1cd54ba1bca150e8601c0d9811a11c66f4abb075fb5e68d6a1fcc9c670db0711c60091f9390394
-
Filesize
213B
MD54d2b623524d4b971ae3c8d5a981897f4
SHA1e34fd1f93dce7661cdfcc4f5d8becc15d98ea4d5
SHA25621d9d9dcc7c7e8b935485dc0e88f710cd3c176eb88853562cd43841bd0ce553a
SHA51219d0928388bae5c2a596aafb649c36ff36c4aaec0cd444b7f721afdaf83b567cc8f8dd0c03dab37067de6cf15a0d855bb2b34be41479721c7bd80b873bca885d
-
Filesize
213B
MD5c6beb7483dd895ee3f18db9ccb9cb18e
SHA1edfcdf74f279882cc1f9106fb943891f74afff8d
SHA256b13dc4c773678be953e8f16ed237c73d9554ab1f4be117b3727621c17f143d05
SHA51267530e6b3b9d770b88ccd2fe3c81ff33675c6d2a7aafbc5543d58121fb226f3c0390e85919bd7885edf3d46b1a9575b850bb15db37e6754379d22140d7174744
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478