Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 17:41
Behavioral task
behavioral1
Sample
JaffaCakes118_5984ba0fba5910e05da433e9411f7314edfb0d264052264690136aa02e245694.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_5984ba0fba5910e05da433e9411f7314edfb0d264052264690136aa02e245694.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_5984ba0fba5910e05da433e9411f7314edfb0d264052264690136aa02e245694.exe
-
Size
1.3MB
-
MD5
8dcdf997cb48e2b4106d667557d8f819
-
SHA1
a046ecc1acd78be06c690d4e39cde3342c17dd45
-
SHA256
5984ba0fba5910e05da433e9411f7314edfb0d264052264690136aa02e245694
-
SHA512
c89a0e0a872cbbf4cf3f9722f91d4b001df6953b610c31a2d324d2e26809afc4e82915ca0bb05fa5e0a98b2d940b9bfa64effc9ecec4f484bcc562bca68c7646
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 64 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1448 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 368 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1868 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2284 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3236 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3020 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 680 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5088 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 732 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2360 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3984 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 228 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4900 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4620 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3484 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2852 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3588 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1768 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1176 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4004 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4612 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1192 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4732 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2080 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2032 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2412 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3680 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4932 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1416 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3144 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3168 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4580 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3552 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4940 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2068 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4652 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4864 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4416 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4504 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4864 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3500 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1104 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2400 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4024 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3540 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2084 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4504 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 448 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1448 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2884 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1200 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3980 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5080 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4432 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2516 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1824 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2448 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1196 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3620 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 404 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4936 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2080 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3956 5076 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4972 5076 schtasks.exe 87 -
resource yara_rule behavioral2/files/0x000e000000023bd3-10.dat dcrat behavioral2/memory/32-13-0x00000000008D0000-0x00000000009E0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 34 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2668 powershell.exe 3872 powershell.exe 4644 powershell.exe 4892 powershell.exe 644 powershell.exe 1056 powershell.exe 3956 powershell.exe 1616 powershell.exe 4640 powershell.exe 4136 powershell.exe 2284 powershell.exe 4856 powershell.exe 1940 powershell.exe 4304 powershell.exe 1872 powershell.exe 2344 powershell.exe 2616 powershell.exe 3872 powershell.exe 2936 powershell.exe 680 powershell.exe 4464 powershell.exe 208 powershell.exe 4480 powershell.exe 3660 powershell.exe 2240 powershell.exe 1192 powershell.exe 3912 powershell.exe 2828 powershell.exe 4820 powershell.exe 1988 powershell.exe 2604 powershell.exe 3860 powershell.exe 3260 powershell.exe 5028 powershell.exe -
Checks computer location settings 2 TTPs 17 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation JaffaCakes118_5984ba0fba5910e05da433e9411f7314edfb0d264052264690136aa02e245694.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Registry.exe -
Executes dropped EXE 16 IoCs
pid Process 32 DllCommonsvc.exe 3128 DllCommonsvc.exe 5892 Registry.exe 5128 Registry.exe 5480 Registry.exe 4288 Registry.exe 3748 Registry.exe 3024 Registry.exe 3144 Registry.exe 5852 Registry.exe 3076 Registry.exe 784 Registry.exe 2184 Registry.exe 2760 Registry.exe 5012 Registry.exe 3264 Registry.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
flow ioc 51 raw.githubusercontent.com 53 raw.githubusercontent.com 49 raw.githubusercontent.com 50 raw.githubusercontent.com 18 raw.githubusercontent.com 19 raw.githubusercontent.com 37 raw.githubusercontent.com 38 raw.githubusercontent.com 39 raw.githubusercontent.com 40 raw.githubusercontent.com 44 raw.githubusercontent.com 45 raw.githubusercontent.com 54 raw.githubusercontent.com 52 raw.githubusercontent.com -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\services.exe DllCommonsvc.exe File created C:\Windows\SysWOW64\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\c5b4cb5e9653cc DllCommonsvc.exe -
Drops file in Program Files directory 34 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\6203df4a6bafc7 DllCommonsvc.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\dwm.exe DllCommonsvc.exe File created C:\Program Files\Mozilla Firefox\defaults\pref\RuntimeBroker.exe DllCommonsvc.exe File created C:\Program Files\Windows Portable Devices\RuntimeBroker.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\f3b6ecef712a24 DllCommonsvc.exe File created C:\Program Files\MSBuild\Microsoft\886983d96e3d3e DllCommonsvc.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\TextInputHost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\22eafd247d37c3 DllCommonsvc.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\6cb0b6c459d5d3 DllCommonsvc.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\cc11b995f2a76d DllCommonsvc.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\smss.exe DllCommonsvc.exe File created C:\Program Files (x86)\Google\Temp\886983d96e3d3e DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\TextInputHost.exe DllCommonsvc.exe File created C:\Program Files\Windows Portable Devices\9e8d7a4ca61bd9 DllCommonsvc.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\spoolsv.exe DllCommonsvc.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\en-US\spoolsv.exe DllCommonsvc.exe File created C:\Program Files (x86)\Google\Temp\csrss.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Mail\services.exe DllCommonsvc.exe File created C:\Program Files\Mozilla Firefox\defaults\pref\9e8d7a4ca61bd9 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\cc11b995f2a76d DllCommonsvc.exe File created C:\Program Files\Uninstall Information\ea9f0e6c9e2dcd DllCommonsvc.exe File created C:\Program Files\Windows NT\Accessories\it-IT\conhost.exe DllCommonsvc.exe File created C:\Program Files\Windows NT\Accessories\it-IT\088424020bedd6 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\886983d96e3d3e DllCommonsvc.exe File created C:\Program Files\Uninstall Information\taskhostw.exe DllCommonsvc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\lsass.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\csrss.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\winlogon.exe DllCommonsvc.exe File created C:\Program Files\MSBuild\Microsoft\csrss.exe DllCommonsvc.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\winlogon.exe DllCommonsvc.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\69ddcba757bf72 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Mail\c5b4cb5e9653cc DllCommonsvc.exe File created C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe DllCommonsvc.exe File created C:\Program Files\Microsoft Office 15\ClientX64\9e8d7a4ca61bd9 DllCommonsvc.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\ja-JP\ebf1f9fa8afd6d DllCommonsvc.exe File created C:\Windows\apppatch\it-IT\services.exe DllCommonsvc.exe File created C:\Windows\apppatch\it-IT\c5b4cb5e9653cc DllCommonsvc.exe File created C:\Windows\ServiceState\sysmon.exe DllCommonsvc.exe File created C:\Windows\SystemResources\Windows.UI.BlockedShutdown\fontdrvhost.exe DllCommonsvc.exe File created C:\Windows\ShellExperiences\TextInputHost.exe DllCommonsvc.exe File created C:\Windows\ShellExperiences\22eafd247d37c3 DllCommonsvc.exe File created C:\Windows\ja-JP\cmd.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_5984ba0fba5910e05da433e9411f7314edfb0d264052264690136aa02e245694.exe -
Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings JaffaCakes118_5984ba0fba5910e05da433e9411f7314edfb0d264052264690136aa02e245694.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings Registry.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5080 schtasks.exe 1020 schtasks.exe 4388 schtasks.exe 3020 schtasks.exe 1192 schtasks.exe 4932 schtasks.exe 4416 schtasks.exe 896 schtasks.exe 2360 schtasks.exe 4004 schtasks.exe 1196 schtasks.exe 4972 schtasks.exe 2852 schtasks.exe 4580 schtasks.exe 928 schtasks.exe 1104 schtasks.exe 3620 schtasks.exe 2520 schtasks.exe 4356 schtasks.exe 2400 schtasks.exe 2080 schtasks.exe 4704 schtasks.exe 2284 schtasks.exe 3484 schtasks.exe 3680 schtasks.exe 4864 schtasks.exe 3828 schtasks.exe 4620 schtasks.exe 3588 schtasks.exe 1416 schtasks.exe 4504 schtasks.exe 1416 schtasks.exe 4860 schtasks.exe 1448 schtasks.exe 1200 schtasks.exe 2032 schtasks.exe 4384 schtasks.exe 732 schtasks.exe 3956 schtasks.exe 3476 schtasks.exe 4208 schtasks.exe 1760 schtasks.exe 4732 schtasks.exe 448 schtasks.exe 2884 schtasks.exe 404 schtasks.exe 2032 schtasks.exe 4620 schtasks.exe 1448 schtasks.exe 3984 schtasks.exe 228 schtasks.exe 2080 schtasks.exe 1712 schtasks.exe 3552 schtasks.exe 4452 schtasks.exe 1308 schtasks.exe 1372 schtasks.exe 3168 schtasks.exe 4864 schtasks.exe 4432 schtasks.exe 1824 schtasks.exe 3236 schtasks.exe 680 schtasks.exe 1768 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 32 DllCommonsvc.exe 32 DllCommonsvc.exe 32 DllCommonsvc.exe 32 DllCommonsvc.exe 32 DllCommonsvc.exe 32 DllCommonsvc.exe 32 DllCommonsvc.exe 32 DllCommonsvc.exe 32 DllCommonsvc.exe 32 DllCommonsvc.exe 3872 powershell.exe 3872 powershell.exe 4464 powershell.exe 4464 powershell.exe 1988 powershell.exe 1988 powershell.exe 2616 powershell.exe 2616 powershell.exe 4640 powershell.exe 4640 powershell.exe 4304 powershell.exe 4304 powershell.exe 2604 powershell.exe 2604 powershell.exe 3956 powershell.exe 3956 powershell.exe 4892 powershell.exe 4892 powershell.exe 2668 powershell.exe 2668 powershell.exe 1872 powershell.exe 1872 powershell.exe 4820 powershell.exe 4820 powershell.exe 4136 powershell.exe 4136 powershell.exe 1616 powershell.exe 1616 powershell.exe 3956 powershell.exe 4464 powershell.exe 4304 powershell.exe 1988 powershell.exe 2616 powershell.exe 4640 powershell.exe 2604 powershell.exe 3872 powershell.exe 1872 powershell.exe 2668 powershell.exe 4136 powershell.exe 1616 powershell.exe 4892 powershell.exe 4820 powershell.exe 3128 DllCommonsvc.exe 3128 DllCommonsvc.exe 3128 DllCommonsvc.exe 3128 DllCommonsvc.exe 3128 DllCommonsvc.exe 3128 DllCommonsvc.exe 3128 DllCommonsvc.exe 3128 DllCommonsvc.exe 3128 DllCommonsvc.exe 3128 DllCommonsvc.exe 3128 DllCommonsvc.exe 3128 DllCommonsvc.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeDebugPrivilege 32 DllCommonsvc.exe Token: SeDebugPrivilege 3872 powershell.exe Token: SeDebugPrivilege 4464 powershell.exe Token: SeDebugPrivilege 1988 powershell.exe Token: SeDebugPrivilege 2616 powershell.exe Token: SeDebugPrivilege 3956 powershell.exe Token: SeDebugPrivilege 4640 powershell.exe Token: SeDebugPrivilege 4304 powershell.exe Token: SeDebugPrivilege 2604 powershell.exe Token: SeDebugPrivilege 2668 powershell.exe Token: SeDebugPrivilege 4892 powershell.exe Token: SeDebugPrivilege 1872 powershell.exe Token: SeDebugPrivilege 4820 powershell.exe Token: SeDebugPrivilege 4136 powershell.exe Token: SeDebugPrivilege 1616 powershell.exe Token: SeDebugPrivilege 3128 DllCommonsvc.exe Token: SeDebugPrivilege 1940 powershell.exe Token: SeDebugPrivilege 2284 powershell.exe Token: SeDebugPrivilege 3912 powershell.exe Token: SeDebugPrivilege 3872 powershell.exe Token: SeDebugPrivilege 2828 powershell.exe Token: SeDebugPrivilege 3860 powershell.exe Token: SeDebugPrivilege 2240 powershell.exe Token: SeDebugPrivilege 1192 powershell.exe Token: SeDebugPrivilege 5028 powershell.exe Token: SeDebugPrivilege 4644 powershell.exe Token: SeDebugPrivilege 208 powershell.exe Token: SeDebugPrivilege 2936 powershell.exe Token: SeDebugPrivilege 4856 powershell.exe Token: SeDebugPrivilege 680 powershell.exe Token: SeDebugPrivilege 4480 powershell.exe Token: SeDebugPrivilege 644 powershell.exe Token: SeDebugPrivilege 3260 powershell.exe Token: SeDebugPrivilege 3660 powershell.exe Token: SeDebugPrivilege 2344 powershell.exe Token: SeDebugPrivilege 1056 powershell.exe Token: SeDebugPrivilege 5892 Registry.exe Token: SeDebugPrivilege 5128 Registry.exe Token: SeDebugPrivilege 5480 Registry.exe Token: SeDebugPrivilege 4288 Registry.exe Token: SeDebugPrivilege 3748 Registry.exe Token: SeDebugPrivilege 3024 Registry.exe Token: SeDebugPrivilege 3144 Registry.exe Token: SeDebugPrivilege 5852 Registry.exe Token: SeDebugPrivilege 3076 Registry.exe Token: SeDebugPrivilege 784 Registry.exe Token: SeDebugPrivilege 2184 Registry.exe Token: SeDebugPrivilege 2760 Registry.exe Token: SeDebugPrivilege 5012 Registry.exe Token: SeDebugPrivilege 3264 Registry.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3716 wrote to memory of 4556 3716 JaffaCakes118_5984ba0fba5910e05da433e9411f7314edfb0d264052264690136aa02e245694.exe 83 PID 3716 wrote to memory of 4556 3716 JaffaCakes118_5984ba0fba5910e05da433e9411f7314edfb0d264052264690136aa02e245694.exe 83 PID 3716 wrote to memory of 4556 3716 JaffaCakes118_5984ba0fba5910e05da433e9411f7314edfb0d264052264690136aa02e245694.exe 83 PID 4556 wrote to memory of 1532 4556 WScript.exe 84 PID 4556 wrote to memory of 1532 4556 WScript.exe 84 PID 4556 wrote to memory of 1532 4556 WScript.exe 84 PID 1532 wrote to memory of 32 1532 cmd.exe 86 PID 1532 wrote to memory of 32 1532 cmd.exe 86 PID 32 wrote to memory of 2616 32 DllCommonsvc.exe 128 PID 32 wrote to memory of 2616 32 DllCommonsvc.exe 128 PID 32 wrote to memory of 4820 32 DllCommonsvc.exe 129 PID 32 wrote to memory of 4820 32 DllCommonsvc.exe 129 PID 32 wrote to memory of 4304 32 DllCommonsvc.exe 130 PID 32 wrote to memory of 4304 32 DllCommonsvc.exe 130 PID 32 wrote to memory of 3872 32 DllCommonsvc.exe 131 PID 32 wrote to memory of 3872 32 DllCommonsvc.exe 131 PID 32 wrote to memory of 1872 32 DllCommonsvc.exe 132 PID 32 wrote to memory of 1872 32 DllCommonsvc.exe 132 PID 32 wrote to memory of 1988 32 DllCommonsvc.exe 133 PID 32 wrote to memory of 1988 32 DllCommonsvc.exe 133 PID 32 wrote to memory of 3956 32 DllCommonsvc.exe 134 PID 32 wrote to memory of 3956 32 DllCommonsvc.exe 134 PID 32 wrote to memory of 2668 32 DllCommonsvc.exe 135 PID 32 wrote to memory of 2668 32 DllCommonsvc.exe 135 PID 32 wrote to memory of 4892 32 DllCommonsvc.exe 136 PID 32 wrote to memory of 4892 32 DllCommonsvc.exe 136 PID 32 wrote to memory of 1616 32 DllCommonsvc.exe 137 PID 32 wrote to memory of 1616 32 DllCommonsvc.exe 137 PID 32 wrote to memory of 4640 32 DllCommonsvc.exe 138 PID 32 wrote to memory of 4640 32 DllCommonsvc.exe 138 PID 32 wrote to memory of 4136 32 DllCommonsvc.exe 139 PID 32 wrote to memory of 4136 32 DllCommonsvc.exe 139 PID 32 wrote to memory of 4464 32 DllCommonsvc.exe 140 PID 32 wrote to memory of 4464 32 DllCommonsvc.exe 140 PID 32 wrote to memory of 2604 32 DllCommonsvc.exe 141 PID 32 wrote to memory of 2604 32 DllCommonsvc.exe 141 PID 32 wrote to memory of 4636 32 DllCommonsvc.exe 156 PID 32 wrote to memory of 4636 32 DllCommonsvc.exe 156 PID 4636 wrote to memory of 4648 4636 cmd.exe 158 PID 4636 wrote to memory of 4648 4636 cmd.exe 158 PID 4636 wrote to memory of 3128 4636 cmd.exe 160 PID 4636 wrote to memory of 3128 4636 cmd.exe 160 PID 3128 wrote to memory of 1192 3128 DllCommonsvc.exe 218 PID 3128 wrote to memory of 1192 3128 DllCommonsvc.exe 218 PID 3128 wrote to memory of 680 3128 DllCommonsvc.exe 219 PID 3128 wrote to memory of 680 3128 DllCommonsvc.exe 219 PID 3128 wrote to memory of 2936 3128 DllCommonsvc.exe 220 PID 3128 wrote to memory of 2936 3128 DllCommonsvc.exe 220 PID 3128 wrote to memory of 3860 3128 DllCommonsvc.exe 221 PID 3128 wrote to memory of 3860 3128 DllCommonsvc.exe 221 PID 3128 wrote to memory of 3912 3128 DllCommonsvc.exe 222 PID 3128 wrote to memory of 3912 3128 DllCommonsvc.exe 222 PID 3128 wrote to memory of 2284 3128 DllCommonsvc.exe 223 PID 3128 wrote to memory of 2284 3128 DllCommonsvc.exe 223 PID 3128 wrote to memory of 3260 3128 DllCommonsvc.exe 224 PID 3128 wrote to memory of 3260 3128 DllCommonsvc.exe 224 PID 3128 wrote to memory of 4856 3128 DllCommonsvc.exe 225 PID 3128 wrote to memory of 4856 3128 DllCommonsvc.exe 225 PID 3128 wrote to memory of 644 3128 DllCommonsvc.exe 226 PID 3128 wrote to memory of 644 3128 DllCommonsvc.exe 226 PID 3128 wrote to memory of 2344 3128 DllCommonsvc.exe 227 PID 3128 wrote to memory of 2344 3128 DllCommonsvc.exe 227 PID 3128 wrote to memory of 3872 3128 DllCommonsvc.exe 228 PID 3128 wrote to memory of 3872 3128 DllCommonsvc.exe 228 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5984ba0fba5910e05da433e9411f7314edfb0d264052264690136aa02e245694.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5984ba0fba5910e05da433e9411f7314edfb0d264052264690136aa02e245694.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\en-US\spoolsv.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ja-JP\cmd.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3872
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1872
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1988
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3956
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\Accessories\it-IT\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4892
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\apppatch\it-IT\services.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\Modules\Pester\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4640
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4136
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4464
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Temp\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R2nbOD6pHm.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:4648
-
-
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1192
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\TextInputHost.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:680
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\dwm.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WmiPrvSE.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3860
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\services.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellExperiences\TextInputHost.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3260
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\winlogon.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4856
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Registry.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:644
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\spoolsv.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2344
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sppsvc.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3872
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\unsecapp.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\csrss.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1940
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\services.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:208
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\defaults\pref\RuntimeBroker.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4644
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4480
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1056
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3660
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Registry.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2240
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MZDUxNJydM.bat"7⤵PID:1972
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:220
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5892 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Zcl4dB2r8y.bat"9⤵PID:4516
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:2356
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5128 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WSSqGJyhfL.bat"11⤵PID:4576
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:5200
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5480 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DiMaLaQqUm.bat"13⤵PID:3956
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:5256
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4288 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\s2EHkno7yQ.bat"15⤵PID:3028
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:5388
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3748 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Gy1gqmGK9f.bat"17⤵PID:4256
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:4864
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3024 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rHhDMS4c5i.bat"19⤵PID:5240
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:3096
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3144 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WM6x9zCNT5.bat"21⤵PID:2188
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:5644
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5852 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jI650TZYhJ.bat"23⤵PID:1568
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:656
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3076 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kq4mDwN7mD.bat"25⤵PID:5048
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:4488
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:784 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CrTeqwt2Oo.bat"27⤵PID:4304
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:228⤵PID:3284
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2184 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ph8sa6VtQm.bat"29⤵PID:5488
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:230⤵PID:3620
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2760 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rBMLF9HJtT.bat"31⤵PID:2388
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:232⤵PID:3628
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"32⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5012 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\15yWIDpGaf.bat"33⤵PID:2200
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:234⤵PID:2880
-
-
C:\providercommon\Registry.exe"C:\providercommon\Registry.exe"34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:368
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:1868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3236
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Windows\ja-JP\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:680
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\ja-JP\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:5088
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Windows\ja-JP\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:732
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\providercommon\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3984
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:228
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\MSBuild\Microsoft\csrss.exe'" /f1⤵
- Process spawned unexpected child process
PID:4900
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3484
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3588
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows NT\Accessories\it-IT\conhost.exe'" /f1⤵
- Process spawned unexpected child process
PID:1176
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\it-IT\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4004
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\Accessories\it-IT\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:4612
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\providercommon\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1192
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\providercommon\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4732
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\providercommon\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Windows\apppatch\it-IT\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\apppatch\it-IT\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:2412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Windows\apppatch\it-IT\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3680
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files\WindowsPowerShell\Modules\Pester\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\Pester\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1416
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files\WindowsPowerShell\Modules\Pester\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:3144
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3168
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4580
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3552
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
PID:4940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:2068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:4652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\Temp\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4416
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\Temp\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:4504
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:3500
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1104
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:4024
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:3540
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\providercommon\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
PID:2084
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4504
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Windows\SysWOW64\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\SysWOW64\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\SysWOW64\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1200
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f1⤵
- Process spawned unexpected child process
PID:3980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Windows\ShellExperiences\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
PID:2516
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Windows\ShellExperiences\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:2448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3620
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f1⤵
- Process spawned unexpected child process
PID:4936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3956
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4972
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:896
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:4704
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:3828
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f1⤵PID:4464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f1⤵PID:1884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f1⤵PID:1988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:4208
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Media Player\csrss.exe'" /f1⤵PID:3628
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\csrss.exe'" /rl HIGHEST /f1⤵PID:4292
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Media Player\csrss.exe'" /rl HIGHEST /f1⤵PID:1464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\services.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:928
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\services.exe'" /rl HIGHEST /f1⤵PID:344
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\services.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\RuntimeBroker.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:4384
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:4452
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\RuntimeBroker.exe'" /rl HIGHEST /f1⤵PID:1980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1416
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1020
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f1⤵PID:2420
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1308
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /rl HIGHEST /f1⤵PID:4368
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:4388
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\providercommon\dllhost.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:4860
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:4356
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f1⤵PID:2604
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe'" /f1⤵PID:2684
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:3476
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\providercommon\Registry.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:4620
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1712
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57f3c0ae41f0d9ae10a8985a2c327b8fb
SHA1d58622bf6b5071beacf3b35bb505bde2000983e3
SHA256519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900
SHA5128a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD5ecceac16628651c18879d836acfcb062
SHA1420502b3e5220a01586c59504e94aa1ee11982c9
SHA25658238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9
SHA512be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3
-
Filesize
944B
MD59006afb2f47b3bb7d3669c647651e29c
SHA1cdc0d7654be8e516df2c36accd9b52eac1f00ffd
SHA256a025443b35555d64473b1ef01194239e808c49b47c924b99b942514036901302
SHA512f2e72bbecfa823415bd0be7a091b1272e10e11059a71baf115780aa7ce3e694d114f6642de161ccba24e2182765b8188cc6dbb804fd07e318af9e1917549841c
-
Filesize
944B
MD5178a223809b2fcee400234523c647027
SHA15f99d23d238aa3a76a5cdfc26ca1c66a71fea5e1
SHA2562f27c985114783e80e3c8650b2cd280270f82d971950797f772b6606eb3c0d80
SHA5128a557a6f984d1ee63d37c96a09043d12181675eee7b03aa32ef322c63872272b85b7153474cd97533797fb2d7ce9a7500e57ac163cf148e4543cdc838aa1115d
-
Filesize
944B
MD5c94af379fe0d2afdabe4476dc7232198
SHA1ae6ebf37fd84cf66dcd330e998f972a4d0a21b72
SHA2567a1017d506434a4bd30a8ab78c064881313d14d95bc8b4e13589824b4caf9a07
SHA51280e112fe35b27c0e85b657ec158583faf742157f27e8ff00ea1e4f3d688ac173bd154bb0dec19aee43f7035c2b4b7156373a52f0642773dee0a01fcb37844144
-
Filesize
944B
MD51f545274ba19d9199a78f74cd05e8187
SHA14036cf78d3f310af42963c8f16ae27c5922b5dff
SHA2563b4780cb2e226f4b05643c0b512960e694f21b35bbbe84d5c5e97628e1f8909c
SHA512b0f66a6c32cb7f2f96b51c141ffe7df7f4fd61a792e6a3756f54b6d0df6f48d7a3bda23d46ee1e18a22ac995520fb9c4ca1b444d204bdd8f3e4b8651f59adc0d
-
Filesize
944B
MD50f6a77860cd9c5289dd6e45bbc36a982
SHA1750d55b0d394bc5716fc3e3204975b029d3dc43b
SHA256a8388051b43fdc7a50ee51047ef4076c4b6502a6e53befe8131efcb71aa700a4
SHA512e4e4473383243a71d7bebffb8bf4bf449201e1aee752426044e81bdc12c3aaf284ce003a859b0ac96d5fd75063376485dc5b5ac0caad189577bf394f104cdd06
-
Filesize
944B
MD5481c1608c2bec426ca209e8800611abd
SHA15df5a08760b0e5c56cb9daf768894435354d2651
SHA25644e538c7570e175634f9929d350a79203730fcb753638f611a1dd4780ec430ed
SHA5125a87762225beffbd34048fd0d617a75eff25ca6dfe47c258cdfad8c841f8b0b4144ae8c7ef04ee5de36987cb6ae0953499d5fa27b2100483a8042ee5e27d190c
-
Filesize
944B
MD5dd064c034d8c630a8e5c19c4a7f50e38
SHA1ca06b64941fa6b43e7ca99f812d91fbae89c9c1c
SHA256d67ae3e1ac4b6942da10c03b8141fb242d3dc03cb2c560bcf83a8bae84de7531
SHA5126adf4c2aa4587db81d0c3bb99e3b1b3640a33d4de14302fc6012eaed3941875d6c4df306944bb454d7f6377e9b1cce83dfcd4ae72889524dd1cad61764a59ef8
-
Filesize
944B
MD58fbdf20dd30b6ccf91308090184986d8
SHA1fde6e3a60582552e322af16289c63d6943a18a78
SHA2563b67692f7e6b5569626ecbf266289b9ae7cb4dc40ee5165eb6c6ea70c5f1f78b
SHA5123ceefad823f555c522d46b266a6c77ea51002f1fb7426992f8a4ea70f0b9cf1ab6979db319c480cfcd51dc393407d3de5e111368b951a6d15766aa296045ffee
-
Filesize
195B
MD56b6f2a61ec2c209dcd199720141b37f0
SHA1f89f9aa48e93ccaa45fd378efdb687d0c1846d54
SHA25669fce8f54b92aaa53f2955c07ecf575b48120302044636a3c75f41fc6ddb0800
SHA512adf384d2654318ef73f36372e3300f7a1488b42c68816ddfb3c3feaa258bb8ceac61fe6cc6d1b09c84d1ae2c37c264afc69282dfcbebbfcbf573197e6c704a62
-
Filesize
195B
MD59b010afcb716f8e3c0ed18f626bb2e2e
SHA1e2cdbd01e86495f04625a39f7db6ea12df73c0cd
SHA25601dc0706cbf79e8e94d4985f721ff3d7da597c59d4a1bada3598f82f74e3489c
SHA5127b38049687fc286516d62bcec3dde6ecf21b38c7328efb25e638484a1e6ea05b196d0da71fc192e71a931f7f638099c34e8d02ae73033d3d9394e69e3d2543ac
-
Filesize
195B
MD55f273b7d20c8f84f832b3e8df3c15130
SHA1ff286d58ef9feebcd9a187215e0ddb79669123dd
SHA2566f34aa4afac09d5a9bf72453430aa6a95dc5821f37ee7bd909e20ed553d9fe62
SHA5121d332e4a0550220e8f9979151949a1755bcc4ae72405a25111a9c54671e636dde57c78a90580ff73b8a4832f926e66e46e834ce9d5239094d2967c860efa623b
-
Filesize
195B
MD578c300fb27597e5546c7b537e2c6c223
SHA1466a314a13271d3dc6f3bbd162e0296641cb3690
SHA25625db3f2938afc4d5716ee3f59f3ea7764a6f66e5d6eee602fdb84498e57f8268
SHA512da07a18725dfd1060402315386c05052f4c83b178ed8f169c416a9012a86bbb011735779a74eee56de249a350bd24c7973c5dd98031f9e04ff83600d469623b8
-
Filesize
199B
MD5c4e99917d374ced03ae9b4a87ac58acc
SHA10b1da68daff7a1a2a29b7b4fe72165b02cd84477
SHA25619100883a902d9df46a72f10bad9556f4c9cc786cc0a31ec92986f19be5bc688
SHA512ef0e0224c8399d2be3d6b7a6396e2c27ee63bed9aace06ce7e192285306f4d29cf7f95d326712110ec0cb63afb5ac21d7f22138ede520e78c10f7d8c6abbb7d6
-
Filesize
195B
MD54769106a4cec35c62797d7739d4470f9
SHA12fbe2d75d425ac4f085d2bc66cd3f2ad78ffbd70
SHA2564c5f242a375c51ee9f81eab67228b19a814211b03fd2ca2ae539533024ccfb4f
SHA51298ba5856e6d4941b1f68a98faab1d9c5c4e04fe89507f9ec6272bd72a5fca4b23221ca86645354fa9ebc34b4afd856b02c13ea5a504f3d7378fc00dea0eb9d79
-
Filesize
195B
MD5692b7022f552c0da1dc235bbc4f8ce0f
SHA123ac58b66d259d739c1ffb5ced3a0d185f7e7f21
SHA256259ba0c5d498390a9a26112e9d0adae55a85b663c6fa5efe2a02f6c5170663ce
SHA512452d9d80e315d915fa78014b088206333e1cf156060f8622fa82a7aefb88e364cc266ebcea7406c527339b2904c41d0348926abb90a353c7f6cf915a24cb5405
-
Filesize
195B
MD5a5d30469d0d7f2b66fcf5941457eed3e
SHA16b249ab1075066275105670785f84c3a657a14b7
SHA256ea110bfe588e49f07d31b658eed2e68a077dfa56aaadda3fa09cf0fb243b790e
SHA5125652c5e3dd8319b6aa03e52681b8d1b98a8b1c11fd25e13279167d10f13ab95bceab6485355911caa94e25bdd197eaa8a4f0dd1e8fc06a49d7a88771a5f30659
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
195B
MD513c4fe3dc206703aa8ebd45ed74d1728
SHA12b1b07145d442db11650587ace2ed5d4139fb5fc
SHA256d08c621db3648f76be9e69644e1ea4ed07d2db8e3447f0cd430f227072f6023a
SHA512d2101b3af9b1b4a1726f26622e1aff7019e829edbfc2716d7cc24dfccc2c3939cfdb569cb491a8982c37c64233a19d65a2f5a5e5f96cd4221e4a7479a0ce8f21
-
Filesize
195B
MD539321728ac90f167d77e2b809011509f
SHA121a1d31771853284ff698ba21ac4316b19f806de
SHA25601741f56435519c66a0164bf990a74c747d54ace665960e10841a766ad7b164f
SHA512c065b121b3dfaa8504de4139583bed35c04c1d5b93b7c33531d7c85f39c316f12372200d774dcac7cc3a5fbe5b0fb926d892e1eca56229c9160bdec957a1ac3c
-
Filesize
195B
MD5c699e868f4e8f6b2f9af88ac4c31ea95
SHA1285a1505bdbb18b4870852b0b928d6a854ec2d52
SHA25699b33d8d4b5f95eb92cfce03104c4b2c75ae80018134684b4d6513a73a1a1c51
SHA512ebcc0578f9882e911acb9a3c58dafb34eadf8d06fc51634f9e4b9e35c10737b50d2d9952e754ce9579b4cb31d0e0f15cdb3e3c59cca117a7ed3d425b39431d7d
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
538B
MD5f45ef76998f46b982e95241272d31249
SHA15785ea9060fa32a8d8e7ed8172f7468a7205ed66
SHA2569c912e6578a2410606bb42c12cbe7431a671ec1120ff7a7bdfc7e849b6b44138
SHA512f9a9050e9ebdc9a3479cc562a9b7fff29f154939df81e8db46de8c8e013e55cae8aa99276300b28fa6a9311e100f8e717329975013e31ea26401106d84d03e50
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478