Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 02:27
Behavioral task
behavioral1
Sample
JaffaCakes118_1d9a9419adc05a53c2fd59e30f1fd36800f4b023aeed60bc1a5b936f2a3a0fc5.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_1d9a9419adc05a53c2fd59e30f1fd36800f4b023aeed60bc1a5b936f2a3a0fc5.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_1d9a9419adc05a53c2fd59e30f1fd36800f4b023aeed60bc1a5b936f2a3a0fc5.exe
-
Size
1.3MB
-
MD5
0497cf9a742024a9c551e2ada1e26d1a
-
SHA1
d335627e11555de708ef8e1dfdc7cda8f42f20c5
-
SHA256
1d9a9419adc05a53c2fd59e30f1fd36800f4b023aeed60bc1a5b936f2a3a0fc5
-
SHA512
61a1083be3af761f59cccc7e8956a5f08194260a69df34a3a268b12db9743d179488d5512ecb7b084a4e26ebf991f5986b2b411576de5d72dc4e66b22ff24132
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 54 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3496 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3584 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2156 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1172 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 952 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4112 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4464 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5108 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2768 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3032 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2720 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 920 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4460 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5060 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2668 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2080 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3124 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4472 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2180 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2068 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2724 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2500 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3340 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1472 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1060 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2444 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1900 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3356 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3576 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 516 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3028 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4604 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4768 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2288 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4276 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2364 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4284 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2788 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1760 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1536 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4928 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1936 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3096 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3804 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2408 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4048 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3116 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2280 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1208 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3980 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2564 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5048 972 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1036 972 schtasks.exe 88 -
resource yara_rule behavioral2/files/0x0007000000023c95-10.dat dcrat behavioral2/memory/3564-13-0x00000000005D0000-0x00000000006E0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4252 powershell.exe 3176 powershell.exe 4684 powershell.exe 4920 powershell.exe 2100 powershell.exe 4632 powershell.exe 3088 powershell.exe 1280 powershell.exe 3092 powershell.exe 3476 powershell.exe 4308 powershell.exe 4268 powershell.exe 1796 powershell.exe 1608 powershell.exe 4592 powershell.exe 1808 powershell.exe 2792 powershell.exe 1556 powershell.exe 3560 powershell.exe -
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation JaffaCakes118_1d9a9419adc05a53c2fd59e30f1fd36800f4b023aeed60bc1a5b936f2a3a0fc5.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation sysmon.exe -
Executes dropped EXE 14 IoCs
pid Process 3564 DllCommonsvc.exe 5784 sysmon.exe 5356 sysmon.exe 4276 sysmon.exe 5160 sysmon.exe 5200 sysmon.exe 5208 sysmon.exe 5128 sysmon.exe 5796 sysmon.exe 1060 sysmon.exe 632 sysmon.exe 1188 sysmon.exe 916 sysmon.exe 2792 sysmon.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
flow ioc 39 raw.githubusercontent.com 43 raw.githubusercontent.com 45 raw.githubusercontent.com 54 raw.githubusercontent.com 16 raw.githubusercontent.com 17 raw.githubusercontent.com 26 raw.githubusercontent.com 55 raw.githubusercontent.com 46 raw.githubusercontent.com 53 raw.githubusercontent.com 57 raw.githubusercontent.com 40 raw.githubusercontent.com 56 raw.githubusercontent.com 58 raw.githubusercontent.com -
Drops file in Program Files directory 13 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\uninstall\csrss.exe DllCommonsvc.exe File created C:\Program Files\Mozilla Firefox\uninstall\886983d96e3d3e DllCommonsvc.exe File created C:\Program Files\Crashpad\attachments\6ccacd8608530f DllCommonsvc.exe File created C:\Program Files\Crashpad\reports\ea1d8f6d871115 DllCommonsvc.exe File created C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\6203df4a6bafc7 DllCommonsvc.exe File opened for modification C:\Program Files (x86)\Windows Portable Devices\lsass.exe DllCommonsvc.exe File created C:\Program Files\Crashpad\attachments\Idle.exe DllCommonsvc.exe File created C:\Program Files\Crashpad\reports\upfc.exe DllCommonsvc.exe File created C:\Program Files\Windows Multimedia Platform\5b884080fd4f94 DllCommonsvc.exe File created C:\Program Files\Common Files\RuntimeBroker.exe DllCommonsvc.exe File created C:\Program Files\Common Files\9e8d7a4ca61bd9 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\lsass.exe DllCommonsvc.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\LiveKernelReports\Idle.exe DllCommonsvc.exe File created C:\Windows\LiveKernelReports\6ccacd8608530f DllCommonsvc.exe File created C:\Windows\de-DE\sppsvc.exe DllCommonsvc.exe File created C:\Windows\de-DE\0a1fd5f707cd16 DllCommonsvc.exe File created C:\Windows\Logs\taskhostw.exe DllCommonsvc.exe File created C:\Windows\Logs\ea9f0e6c9e2dcd DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_1d9a9419adc05a53c2fd59e30f1fd36800f4b023aeed60bc1a5b936f2a3a0fc5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings JaffaCakes118_1d9a9419adc05a53c2fd59e30f1fd36800f4b023aeed60bc1a5b936f2a3a0fc5.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings sysmon.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1172 schtasks.exe 4460 schtasks.exe 4928 schtasks.exe 4048 schtasks.exe 2080 schtasks.exe 2180 schtasks.exe 3356 schtasks.exe 1760 schtasks.exe 2364 schtasks.exe 1472 schtasks.exe 516 schtasks.exe 3116 schtasks.exe 2768 schtasks.exe 5060 schtasks.exe 3124 schtasks.exe 4604 schtasks.exe 4112 schtasks.exe 2068 schtasks.exe 2500 schtasks.exe 1536 schtasks.exe 2280 schtasks.exe 1036 schtasks.exe 3496 schtasks.exe 920 schtasks.exe 2668 schtasks.exe 4472 schtasks.exe 3340 schtasks.exe 3804 schtasks.exe 1060 schtasks.exe 2444 schtasks.exe 2564 schtasks.exe 1900 schtasks.exe 3980 schtasks.exe 2788 schtasks.exe 4464 schtasks.exe 5108 schtasks.exe 3028 schtasks.exe 4768 schtasks.exe 2408 schtasks.exe 2288 schtasks.exe 952 schtasks.exe 2720 schtasks.exe 4276 schtasks.exe 5048 schtasks.exe 3032 schtasks.exe 3576 schtasks.exe 3096 schtasks.exe 1208 schtasks.exe 3584 schtasks.exe 2156 schtasks.exe 2724 schtasks.exe 8 schtasks.exe 4284 schtasks.exe 1936 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3564 DllCommonsvc.exe 3564 DllCommonsvc.exe 3564 DllCommonsvc.exe 3564 DllCommonsvc.exe 3564 DllCommonsvc.exe 3564 DllCommonsvc.exe 3564 DllCommonsvc.exe 1808 powershell.exe 1808 powershell.exe 1608 powershell.exe 1608 powershell.exe 4252 powershell.exe 4252 powershell.exe 3088 powershell.exe 3088 powershell.exe 3176 powershell.exe 3176 powershell.exe 4920 powershell.exe 4920 powershell.exe 1280 powershell.exe 1280 powershell.exe 4268 powershell.exe 4268 powershell.exe 2100 powershell.exe 2100 powershell.exe 1556 powershell.exe 1556 powershell.exe 3088 powershell.exe 3092 powershell.exe 3092 powershell.exe 4308 powershell.exe 4308 powershell.exe 3560 powershell.exe 3560 powershell.exe 4592 powershell.exe 4592 powershell.exe 4632 powershell.exe 4632 powershell.exe 1796 powershell.exe 1796 powershell.exe 2792 powershell.exe 2792 powershell.exe 4684 powershell.exe 4684 powershell.exe 4308 powershell.exe 3476 powershell.exe 3476 powershell.exe 1808 powershell.exe 1808 powershell.exe 1608 powershell.exe 1608 powershell.exe 3092 powershell.exe 3176 powershell.exe 3176 powershell.exe 4252 powershell.exe 4252 powershell.exe 2100 powershell.exe 4268 powershell.exe 1280 powershell.exe 1280 powershell.exe 4920 powershell.exe 4920 powershell.exe 1556 powershell.exe 1796 powershell.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 3564 DllCommonsvc.exe Token: SeDebugPrivilege 1808 powershell.exe Token: SeDebugPrivilege 1608 powershell.exe Token: SeDebugPrivilege 4252 powershell.exe Token: SeDebugPrivilege 3088 powershell.exe Token: SeDebugPrivilege 3092 powershell.exe Token: SeDebugPrivilege 3176 powershell.exe Token: SeDebugPrivilege 4920 powershell.exe Token: SeDebugPrivilege 1280 powershell.exe Token: SeDebugPrivilege 4268 powershell.exe Token: SeDebugPrivilege 1556 powershell.exe Token: SeDebugPrivilege 2100 powershell.exe Token: SeDebugPrivilege 4632 powershell.exe Token: SeDebugPrivilege 4592 powershell.exe Token: SeDebugPrivilege 3560 powershell.exe Token: SeDebugPrivilege 4308 powershell.exe Token: SeDebugPrivilege 1796 powershell.exe Token: SeDebugPrivilege 2792 powershell.exe Token: SeDebugPrivilege 4684 powershell.exe Token: SeDebugPrivilege 3476 powershell.exe Token: SeDebugPrivilege 5784 sysmon.exe Token: SeDebugPrivilege 5356 sysmon.exe Token: SeDebugPrivilege 4276 sysmon.exe Token: SeDebugPrivilege 5160 sysmon.exe Token: SeDebugPrivilege 5200 sysmon.exe Token: SeDebugPrivilege 5208 sysmon.exe Token: SeDebugPrivilege 5128 sysmon.exe Token: SeDebugPrivilege 5796 sysmon.exe Token: SeDebugPrivilege 1060 sysmon.exe Token: SeDebugPrivilege 632 sysmon.exe Token: SeDebugPrivilege 1188 sysmon.exe Token: SeDebugPrivilege 916 sysmon.exe Token: SeDebugPrivilege 2792 sysmon.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3456 wrote to memory of 4100 3456 JaffaCakes118_1d9a9419adc05a53c2fd59e30f1fd36800f4b023aeed60bc1a5b936f2a3a0fc5.exe 83 PID 3456 wrote to memory of 4100 3456 JaffaCakes118_1d9a9419adc05a53c2fd59e30f1fd36800f4b023aeed60bc1a5b936f2a3a0fc5.exe 83 PID 3456 wrote to memory of 4100 3456 JaffaCakes118_1d9a9419adc05a53c2fd59e30f1fd36800f4b023aeed60bc1a5b936f2a3a0fc5.exe 83 PID 4100 wrote to memory of 3016 4100 WScript.exe 85 PID 4100 wrote to memory of 3016 4100 WScript.exe 85 PID 4100 wrote to memory of 3016 4100 WScript.exe 85 PID 3016 wrote to memory of 3564 3016 cmd.exe 87 PID 3016 wrote to memory of 3564 3016 cmd.exe 87 PID 3564 wrote to memory of 3476 3564 DllCommonsvc.exe 144 PID 3564 wrote to memory of 3476 3564 DllCommonsvc.exe 144 PID 3564 wrote to memory of 4592 3564 DllCommonsvc.exe 145 PID 3564 wrote to memory of 4592 3564 DllCommonsvc.exe 145 PID 3564 wrote to memory of 1808 3564 DllCommonsvc.exe 146 PID 3564 wrote to memory of 1808 3564 DllCommonsvc.exe 146 PID 3564 wrote to memory of 4252 3564 DllCommonsvc.exe 147 PID 3564 wrote to memory of 4252 3564 DllCommonsvc.exe 147 PID 3564 wrote to memory of 2792 3564 DllCommonsvc.exe 148 PID 3564 wrote to memory of 2792 3564 DllCommonsvc.exe 148 PID 3564 wrote to memory of 1556 3564 DllCommonsvc.exe 149 PID 3564 wrote to memory of 1556 3564 DllCommonsvc.exe 149 PID 3564 wrote to memory of 3176 3564 DllCommonsvc.exe 150 PID 3564 wrote to memory of 3176 3564 DllCommonsvc.exe 150 PID 3564 wrote to memory of 4308 3564 DllCommonsvc.exe 151 PID 3564 wrote to memory of 4308 3564 DllCommonsvc.exe 151 PID 3564 wrote to memory of 4684 3564 DllCommonsvc.exe 152 PID 3564 wrote to memory of 4684 3564 DllCommonsvc.exe 152 PID 3564 wrote to memory of 4268 3564 DllCommonsvc.exe 153 PID 3564 wrote to memory of 4268 3564 DllCommonsvc.exe 153 PID 3564 wrote to memory of 1796 3564 DllCommonsvc.exe 154 PID 3564 wrote to memory of 1796 3564 DllCommonsvc.exe 154 PID 3564 wrote to memory of 4632 3564 DllCommonsvc.exe 155 PID 3564 wrote to memory of 4632 3564 DllCommonsvc.exe 155 PID 3564 wrote to memory of 4920 3564 DllCommonsvc.exe 156 PID 3564 wrote to memory of 4920 3564 DllCommonsvc.exe 156 PID 3564 wrote to memory of 3088 3564 DllCommonsvc.exe 157 PID 3564 wrote to memory of 3088 3564 DllCommonsvc.exe 157 PID 3564 wrote to memory of 1280 3564 DllCommonsvc.exe 158 PID 3564 wrote to memory of 1280 3564 DllCommonsvc.exe 158 PID 3564 wrote to memory of 3560 3564 DllCommonsvc.exe 159 PID 3564 wrote to memory of 3560 3564 DllCommonsvc.exe 159 PID 3564 wrote to memory of 2100 3564 DllCommonsvc.exe 160 PID 3564 wrote to memory of 2100 3564 DllCommonsvc.exe 160 PID 3564 wrote to memory of 1608 3564 DllCommonsvc.exe 161 PID 3564 wrote to memory of 1608 3564 DllCommonsvc.exe 161 PID 3564 wrote to memory of 3092 3564 DllCommonsvc.exe 162 PID 3564 wrote to memory of 3092 3564 DllCommonsvc.exe 162 PID 3564 wrote to memory of 2388 3564 DllCommonsvc.exe 181 PID 3564 wrote to memory of 2388 3564 DllCommonsvc.exe 181 PID 2388 wrote to memory of 1056 2388 cmd.exe 184 PID 2388 wrote to memory of 1056 2388 cmd.exe 184 PID 2388 wrote to memory of 5784 2388 cmd.exe 191 PID 2388 wrote to memory of 5784 2388 cmd.exe 191 PID 5784 wrote to memory of 6020 5784 sysmon.exe 195 PID 5784 wrote to memory of 6020 5784 sysmon.exe 195 PID 6020 wrote to memory of 6092 6020 cmd.exe 197 PID 6020 wrote to memory of 6092 6020 cmd.exe 197 PID 6020 wrote to memory of 5356 6020 cmd.exe 203 PID 6020 wrote to memory of 5356 6020 cmd.exe 203 PID 5356 wrote to memory of 3512 5356 sysmon.exe 205 PID 5356 wrote to memory of 3512 5356 sysmon.exe 205 PID 3512 wrote to memory of 1420 3512 cmd.exe 207 PID 3512 wrote to memory of 1420 3512 cmd.exe 207 PID 3512 wrote to memory of 4276 3512 cmd.exe 211 PID 3512 wrote to memory of 4276 3512 cmd.exe 211 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d9a9419adc05a53c2fd59e30f1fd36800f4b023aeed60bc1a5b936f2a3a0fc5.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d9a9419adc05a53c2fd59e30f1fd36800f4b023aeed60bc1a5b936f2a3a0fc5.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3476
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4592
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\LiveKernelReports\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4252
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\de-DE\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\uninstall\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1556
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\SendTo\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3176
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Crashpad\attachments\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4308
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4684
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Crashpad\reports\upfc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4268
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1796
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Music\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4632
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4920
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Logs\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3088
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1280
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3560
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Videos\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3092
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NmXefpDXun.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:1056
-
-
C:\Users\Default User\sysmon.exe"C:\Users\Default User\sysmon.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\q3WH03M43W.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:6092
-
-
C:\Users\Default User\sysmon.exe"C:\Users\Default User\sysmon.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xAFUrPKKMy.bat"9⤵
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:1420
-
-
C:\Users\Default User\sysmon.exe"C:\Users\Default User\sysmon.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4276 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4yKdveU0JJ.bat"11⤵PID:1320
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:4900
-
-
C:\Users\Default User\sysmon.exe"C:\Users\Default User\sysmon.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5160 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\12JaEZR6zX.bat"13⤵PID:3584
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:3672
-
-
C:\Users\Default User\sysmon.exe"C:\Users\Default User\sysmon.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5200 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pCeLVPpGxY.bat"15⤵PID:2668
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:4852
-
-
C:\Users\Default User\sysmon.exe"C:\Users\Default User\sysmon.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5208 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9gHfnS8a2p.bat"17⤵PID:2576
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:5236
-
-
C:\Users\Default User\sysmon.exe"C:\Users\Default User\sysmon.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5128 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pCeLVPpGxY.bat"19⤵PID:5564
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:5768
-
-
C:\Users\Default User\sysmon.exe"C:\Users\Default User\sysmon.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5796 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NiQtqM3qVs.bat"21⤵PID:6004
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:6108
-
-
C:\Users\Default User\sysmon.exe"C:\Users\Default User\sysmon.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1060 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Gozseo6rLH.bat"23⤵PID:5580
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:520
-
-
C:\Users\Default User\sysmon.exe"C:\Users\Default User\sysmon.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:632 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gMBHdlpNUB.bat"25⤵PID:3588
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:3512
-
-
C:\Users\Default User\sysmon.exe"C:\Users\Default User\sysmon.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1188 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KmPq9HzxB6.bat"27⤵PID:5032
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:228⤵PID:4244
-
-
C:\Users\Default User\sysmon.exe"C:\Users\Default User\sysmon.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:916 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8pOjIocmws.bat"29⤵PID:3656
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:230⤵PID:540
-
-
C:\Users\Default User\sysmon.exe"C:\Users\Default User\sysmon.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2792 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j95GpUP4tv.bat"31⤵PID:4368
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:232⤵PID:2256
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3584
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\LiveKernelReports\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1172
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Windows\LiveKernelReports\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Windows\de-DE\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\de-DE\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows\de-DE\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:920
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\uninstall\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\uninstall\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\SendTo\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3124
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\SendTo\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4472
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files\Crashpad\attachments\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Crashpad\attachments\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files\Crashpad\attachments\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Default User\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3340
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Program Files\Crashpad\reports\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Crashpad\reports\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Program Files\Crashpad\reports\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1900
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3356
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3576
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:516
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Music\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\Music\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Music\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4768
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4276
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Windows\Logs\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\Logs\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Windows\Logs\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\providercommon\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3096
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3804
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Common Files\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Common Files\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3116
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Videos\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Videos\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1208
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Videos\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
197B
MD5fcbca2febf0f38e8dfbefed50f369d60
SHA13d49dc1c4ea5a6c295b9fe5190bb31ec2c4e01e2
SHA2561b7b6ac15643e9ccaf768b2b400e955b474d8a44a0db0a9fa3def5aff92c8b0c
SHA512b6edb658f51914abafcdd5ad43962ebcff66fe568cd4cb6bacaba8f318f7c2188aa8b10f401652e7bd8574a7d38b0799a4833ec4e8020d3883f0a0daed9270e2
-
Filesize
197B
MD5732848c65399a408e35ef4a27b4ad7e2
SHA1760d3650b464c11eecd2173e0c953fa442497623
SHA256ae35e5fdf7d7f64128ecb764bf5ff6d6d414edc5cedae03db8caaa3fc5c61418
SHA512c99b25abf10ee57b533f342fa39b9b3c7c59e08aec14e1fcaaaefafb9ff999894b9cd8dd82aee92942539d65333c8ed1aa4254cecac9ca9343fcf1e57daf95ac
-
Filesize
197B
MD53ba4a74b27ac1dd10d12d279b85a11a7
SHA192be2159223edbdbde0ac03d3adaa66476628e10
SHA256568f3c1da78d608013d19b44d55542283f8cb4a512c8a959c1808f1140a8210f
SHA51255842beee58c79d17d2afb1edb24817d69b7928333398b62b27a87896f39f553e91bec62fc4ba6c8f0fb90085807feb7b3935202010e31c6ba908f6041408d10
-
Filesize
197B
MD50d2bf5538e8d24878782afbad04385a6
SHA1d301ea05d8de0845ee0f957414e9e47e8fc4fb5f
SHA2561d572ff731663df21fffbddf61935e10da1fd6fe0ca3805c3022cb6b7a773bd7
SHA512fc21c046823efa977487c1d6bd6a2dfc009f84172bf341156e50b27b95e07b351916532940d66d182aad0146763f80540c36e7b8a521ec2d7497c96c00cdef7a
-
Filesize
197B
MD5ba366bee325d9ab51e7bb4478c5a0db6
SHA192b7429ba819cc2ce7b4865d29bd3478f6c8be91
SHA25637789820b6febcf2bfa61c12b462c0ace690f4d2941c41b5097ad77e94d1fede
SHA5125f5523316ffc2f5e6680d6441e3e968a225587d1686f7cdac1888e46fbf11f0222d994e2fec169e9dd611e500be0e2e04fe547aa13adb0365ce3bd9f212bccb3
-
Filesize
197B
MD50be4aa4b26467373ee4922afa483e427
SHA1f592fe3a02c4e78b238adf1358c9a43f8bb2ade5
SHA256344608ad0eba277dd358aaeeec00a892292a010a8e9a75a8f9209d6aed7b21e3
SHA51226966ea3916142d2482e66c9378a59a851f276bb656b954c386b98316e15d52d4213a6a46483a27ffc851e4f652676a9878b12591fc9243fff49ce1b50897ab8
-
Filesize
197B
MD506df87d50d8a787d491ad599998e0d3c
SHA1080a541a6c1976364fa2a35191842a71bd0ea2ec
SHA256b612d36c408cc216a65d28bd88086cfaf62ee515628dd5e4cf2c999cea638562
SHA512983c0f81a56060aca78384e186418de694fb524fc837fa7703c92fa176deb6a472a0bf23c011f0bab3824e340c323ba97ed8ef5735f41c565caf836b44cdc949
-
Filesize
197B
MD5464010774defeb31e9f85eee71da49ec
SHA166af8635709fc51a745d402d8d229bc546b45027
SHA25661a66fd693eae2ec1080d45801bc9bcd7e3ec4065ae8083cf8747414a02e6f52
SHA5128f21020672b9d4bc188ddb6984fa4049a0a6b03051843b897915536a33f1a8b8dd0119ffff876f2d048cd245c9dacef07df383d4d5da35eadad1d6516fde64cd
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
197B
MD5217999ff44ba63c185fa9fcce2949fd4
SHA18dcc56166cbe6ea40ac739c510ccbe2da4a57e48
SHA2561b9af98e2435c82e621eefb217f35ee971d70563f8e37537d85424d8d50b546a
SHA5120715027056527127e90b6ca9785d258e065fba61568aa6168adbc0b4a6d36c6024c26d8998ce12be20b328c643b0bb355725c7e4531e9fb810cd513b2e37756c
-
Filesize
197B
MD578e956d1968ad00d7d1ac1c2df6f931b
SHA10d224cbecf335015f9ef9e78e1dc068177236e45
SHA2563666e14c54d4408bd40836b4ad7acf3b744f5ff56bf0710e7a9e0db2891b4f79
SHA51273b838472cb04e1dc5e018dc18d6423a436821d2141644235bd8785b1a8869e5857b75e80400b69fa1402d87c1f4a9e549aa2f311d7917f88683191ed6b22b32
-
Filesize
197B
MD59005798d91c7f0a4acf67e0de96f1df9
SHA14c194daa1a3ddbe3b43547450c16465ed51983eb
SHA256833adbbe9122f885cee05af3b9ec1be0e0c0e54947f9a83c29b88b86649ec4fe
SHA512467cbe124eb65e04301ce9125d0edf241928c33bfd720561f9737449fe4a026f2783038f06e8a69d1273b85480c136d0a5743be7cafd08129e12888803d242eb
-
Filesize
197B
MD548466811f7be933cf4d03dc46550b9db
SHA1a64179c9534e98e8819cbaf7df253b0994b1299f
SHA256930866453b56e64ae5e99f463fe2640d6aa22779846101c3ecc3b068697f802d
SHA512a0b4302a77dab7e4652f7d0c222f096660e9530689572e9bd131d3031699e01b49e1fc8bbf8b43354e39e8ecc9dc593e89f7fa77c1faba6875d53ac8aa6707ac
-
Filesize
197B
MD5bd84191065f5475833349426a7010132
SHA18ebd3a34f1d60cca945b80854e1089cb87b62ac2
SHA256fc817a382d9b99601c4582a0a72fec43dee4b21b21e12167e1fca156d3cff39d
SHA5126dbf9d0bec6f33d08c8c2ba57e830fc2211b60235ca3415b8301120059af62f2b1b7ed968199db316932793c0b65520ff845aa509aaef3b2610736a15260aace
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478