Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 17:09
Behavioral task
behavioral1
Sample
JaffaCakes118_21016ad2a1088da1d5e30404cff3b40daeadd9c6e5c6d05968842f8d3e66d20f.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_21016ad2a1088da1d5e30404cff3b40daeadd9c6e5c6d05968842f8d3e66d20f.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_21016ad2a1088da1d5e30404cff3b40daeadd9c6e5c6d05968842f8d3e66d20f.exe
-
Size
1.3MB
-
MD5
5d577105e0d44d5d1e896c7d33edf212
-
SHA1
67dbfa0fcd1af1691823f97a89f94dbe25d13d7b
-
SHA256
21016ad2a1088da1d5e30404cff3b40daeadd9c6e5c6d05968842f8d3e66d20f
-
SHA512
93515b2619d713fe21937acd707a7f6e2c126bf70c426b2051c707e04cb4a987dba9168191f7720863e578a90f63ac5f385cb03e12999b19c405c062998d34fb
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 57 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1996 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2952 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3976 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 720 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3204 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4708 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4592 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 764 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4748 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1600 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3436 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3532 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4048 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 372 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4148 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2992 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4712 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2340 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 376 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 868 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 700 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3432 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5008 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2396 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3596 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2196 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4752 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1304 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1772 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2816 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5088 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4632 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3980 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1352 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3856 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4280 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4964 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2412 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 380 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5052 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3176 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1348 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 912 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1960 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4616 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1460 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 448 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1012 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1480 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4452 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3832 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1592 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 644 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2360 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 624 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4728 2596 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4464 2596 schtasks.exe 90 -
resource yara_rule behavioral2/files/0x0007000000023c92-10.dat dcrat behavioral2/memory/5096-13-0x0000000000890000-0x00000000009A0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3112 powershell.exe 872 powershell.exe 5108 powershell.exe 2716 powershell.exe 4768 powershell.exe 3612 powershell.exe 3088 powershell.exe 4528 powershell.exe 3096 powershell.exe 1828 powershell.exe 4948 powershell.exe 3556 powershell.exe 2104 powershell.exe 4244 powershell.exe 2372 powershell.exe 2044 powershell.exe 4924 powershell.exe 1008 powershell.exe 3620 powershell.exe 1860 powershell.exe -
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation JaffaCakes118_21016ad2a1088da1d5e30404cff3b40daeadd9c6e5c6d05968842f8d3e66d20f.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 13 IoCs
pid Process 5096 DllCommonsvc.exe 3988 cmd.exe 3124 cmd.exe 1636 cmd.exe 2924 cmd.exe 1580 cmd.exe 5908 cmd.exe 872 cmd.exe 6120 cmd.exe 5776 cmd.exe 3348 cmd.exe 3596 cmd.exe 5036 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
flow ioc 54 raw.githubusercontent.com 55 raw.githubusercontent.com 24 raw.githubusercontent.com 26 raw.githubusercontent.com 40 raw.githubusercontent.com 45 raw.githubusercontent.com 52 raw.githubusercontent.com 53 raw.githubusercontent.com 15 raw.githubusercontent.com 16 raw.githubusercontent.com 41 raw.githubusercontent.com 44 raw.githubusercontent.com 56 raw.githubusercontent.com -
Drops file in Program Files directory 12 IoCs
description ioc Process File created C:\Program Files\ModifiableWindowsApps\fontdrvhost.exe DllCommonsvc.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\5b884080fd4f94 DllCommonsvc.exe File created C:\Program Files\Windows Mail\StartMenuExperienceHost.exe DllCommonsvc.exe File created C:\Program Files\Windows Mail\55b276f4edf653 DllCommonsvc.exe File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\e6c9b481da804f DllCommonsvc.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\fontdrvhost.exe DllCommonsvc.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\5b884080fd4f94 DllCommonsvc.exe File created C:\Program Files\Google\Chrome\ea1d8f6d871115 DllCommonsvc.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\fontdrvhost.exe DllCommonsvc.exe File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\OfficeClickToRun.exe DllCommonsvc.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\unsecapp.exe DllCommonsvc.exe File created C:\Program Files\Google\Chrome\upfc.exe DllCommonsvc.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\Registration\CRMLog\69ddcba757bf72 DllCommonsvc.exe File created C:\Windows\es-ES\886983d96e3d3e DllCommonsvc.exe File created C:\Windows\twain_32\9e8d7a4ca61bd9 DllCommonsvc.exe File created C:\Windows\GameBarPresenceWriter\RuntimeBroker.exe DllCommonsvc.exe File created C:\Windows\GameBarPresenceWriter\9e8d7a4ca61bd9 DllCommonsvc.exe File created C:\Windows\OCR\DllCommonsvc.exe DllCommonsvc.exe File created C:\Windows\Registration\CRMLog\smss.exe DllCommonsvc.exe File created C:\Windows\es-ES\csrss.exe DllCommonsvc.exe File created C:\Windows\twain_32\RuntimeBroker.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_21016ad2a1088da1d5e30404cff3b40daeadd9c6e5c6d05968842f8d3e66d20f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings JaffaCakes118_21016ad2a1088da1d5e30404cff3b40daeadd9c6e5c6d05968842f8d3e66d20f.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4464 schtasks.exe 4708 schtasks.exe 1304 schtasks.exe 1460 schtasks.exe 1480 schtasks.exe 1592 schtasks.exe 2360 schtasks.exe 2412 schtasks.exe 448 schtasks.exe 3832 schtasks.exe 624 schtasks.exe 5008 schtasks.exe 3976 schtasks.exe 3532 schtasks.exe 1772 schtasks.exe 3980 schtasks.exe 1348 schtasks.exe 1996 schtasks.exe 1012 schtasks.exe 4452 schtasks.exe 2396 schtasks.exe 1960 schtasks.exe 720 schtasks.exe 4148 schtasks.exe 868 schtasks.exe 372 schtasks.exe 2340 schtasks.exe 5088 schtasks.exe 4280 schtasks.exe 4964 schtasks.exe 5052 schtasks.exe 4616 schtasks.exe 4592 schtasks.exe 700 schtasks.exe 3596 schtasks.exe 4748 schtasks.exe 1352 schtasks.exe 4752 schtasks.exe 644 schtasks.exe 4728 schtasks.exe 1600 schtasks.exe 3204 schtasks.exe 3436 schtasks.exe 2992 schtasks.exe 4712 schtasks.exe 2196 schtasks.exe 4632 schtasks.exe 3176 schtasks.exe 912 schtasks.exe 764 schtasks.exe 3856 schtasks.exe 2816 schtasks.exe 4048 schtasks.exe 376 schtasks.exe 3432 schtasks.exe 380 schtasks.exe 2952 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5096 DllCommonsvc.exe 5096 DllCommonsvc.exe 5096 DllCommonsvc.exe 5096 DllCommonsvc.exe 5096 DllCommonsvc.exe 5096 DllCommonsvc.exe 5096 DllCommonsvc.exe 5096 DllCommonsvc.exe 2372 powershell.exe 2372 powershell.exe 2716 powershell.exe 2716 powershell.exe 2044 powershell.exe 2044 powershell.exe 1828 powershell.exe 1828 powershell.exe 1860 powershell.exe 1860 powershell.exe 3096 powershell.exe 3096 powershell.exe 4948 powershell.exe 4948 powershell.exe 3556 powershell.exe 3556 powershell.exe 4924 powershell.exe 4924 powershell.exe 3612 powershell.exe 1008 powershell.exe 3612 powershell.exe 1008 powershell.exe 4528 powershell.exe 4528 powershell.exe 4244 powershell.exe 4244 powershell.exe 2104 powershell.exe 2104 powershell.exe 872 powershell.exe 872 powershell.exe 5108 powershell.exe 5108 powershell.exe 3112 powershell.exe 3112 powershell.exe 3620 powershell.exe 3620 powershell.exe 3988 cmd.exe 3988 cmd.exe 3556 powershell.exe 3088 powershell.exe 3088 powershell.exe 4768 powershell.exe 4768 powershell.exe 4768 powershell.exe 3620 powershell.exe 1860 powershell.exe 2372 powershell.exe 2372 powershell.exe 2716 powershell.exe 2716 powershell.exe 1828 powershell.exe 1828 powershell.exe 2044 powershell.exe 4244 powershell.exe 2044 powershell.exe 3096 powershell.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 5096 DllCommonsvc.exe Token: SeDebugPrivilege 2372 powershell.exe Token: SeDebugPrivilege 2716 powershell.exe Token: SeDebugPrivilege 2044 powershell.exe Token: SeDebugPrivilege 1828 powershell.exe Token: SeDebugPrivilege 1860 powershell.exe Token: SeDebugPrivilege 3988 cmd.exe Token: SeDebugPrivilege 3096 powershell.exe Token: SeDebugPrivilege 4244 powershell.exe Token: SeDebugPrivilege 4948 powershell.exe Token: SeDebugPrivilege 3112 powershell.exe Token: SeDebugPrivilege 4528 powershell.exe Token: SeDebugPrivilege 3620 powershell.exe Token: SeDebugPrivilege 3556 powershell.exe Token: SeDebugPrivilege 1008 powershell.exe Token: SeDebugPrivilege 3612 powershell.exe Token: SeDebugPrivilege 4924 powershell.exe Token: SeDebugPrivilege 2104 powershell.exe Token: SeDebugPrivilege 872 powershell.exe Token: SeDebugPrivilege 3088 powershell.exe Token: SeDebugPrivilege 5108 powershell.exe Token: SeDebugPrivilege 4768 powershell.exe Token: SeDebugPrivilege 3124 cmd.exe Token: SeDebugPrivilege 1636 cmd.exe Token: SeDebugPrivilege 2924 cmd.exe Token: SeDebugPrivilege 1580 cmd.exe Token: SeDebugPrivilege 5908 cmd.exe Token: SeDebugPrivilege 872 cmd.exe Token: SeDebugPrivilege 6120 cmd.exe Token: SeDebugPrivilege 5776 cmd.exe Token: SeDebugPrivilege 3348 cmd.exe Token: SeDebugPrivilege 3596 cmd.exe Token: SeDebugPrivilege 5036 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1488 wrote to memory of 1888 1488 JaffaCakes118_21016ad2a1088da1d5e30404cff3b40daeadd9c6e5c6d05968842f8d3e66d20f.exe 83 PID 1488 wrote to memory of 1888 1488 JaffaCakes118_21016ad2a1088da1d5e30404cff3b40daeadd9c6e5c6d05968842f8d3e66d20f.exe 83 PID 1488 wrote to memory of 1888 1488 JaffaCakes118_21016ad2a1088da1d5e30404cff3b40daeadd9c6e5c6d05968842f8d3e66d20f.exe 83 PID 1888 wrote to memory of 4056 1888 WScript.exe 85 PID 1888 wrote to memory of 4056 1888 WScript.exe 85 PID 1888 wrote to memory of 4056 1888 WScript.exe 85 PID 4056 wrote to memory of 5096 4056 cmd.exe 87 PID 4056 wrote to memory of 5096 4056 cmd.exe 87 PID 5096 wrote to memory of 4768 5096 DllCommonsvc.exe 151 PID 5096 wrote to memory of 4768 5096 DllCommonsvc.exe 151 PID 5096 wrote to memory of 4948 5096 DllCommonsvc.exe 152 PID 5096 wrote to memory of 4948 5096 DllCommonsvc.exe 152 PID 5096 wrote to memory of 2716 5096 DllCommonsvc.exe 153 PID 5096 wrote to memory of 2716 5096 DllCommonsvc.exe 153 PID 5096 wrote to memory of 2372 5096 DllCommonsvc.exe 154 PID 5096 wrote to memory of 2372 5096 DllCommonsvc.exe 154 PID 5096 wrote to memory of 1828 5096 DllCommonsvc.exe 155 PID 5096 wrote to memory of 1828 5096 DllCommonsvc.exe 155 PID 5096 wrote to memory of 2044 5096 DllCommonsvc.exe 158 PID 5096 wrote to memory of 2044 5096 DllCommonsvc.exe 158 PID 5096 wrote to memory of 1860 5096 DllCommonsvc.exe 159 PID 5096 wrote to memory of 1860 5096 DllCommonsvc.exe 159 PID 5096 wrote to memory of 1008 5096 DllCommonsvc.exe 161 PID 5096 wrote to memory of 1008 5096 DllCommonsvc.exe 161 PID 5096 wrote to memory of 4244 5096 DllCommonsvc.exe 163 PID 5096 wrote to memory of 4244 5096 DllCommonsvc.exe 163 PID 5096 wrote to memory of 4924 5096 DllCommonsvc.exe 164 PID 5096 wrote to memory of 4924 5096 DllCommonsvc.exe 164 PID 5096 wrote to memory of 2104 5096 DllCommonsvc.exe 166 PID 5096 wrote to memory of 2104 5096 DllCommonsvc.exe 166 PID 5096 wrote to memory of 3096 5096 DllCommonsvc.exe 167 PID 5096 wrote to memory of 3096 5096 DllCommonsvc.exe 167 PID 5096 wrote to memory of 5108 5096 DllCommonsvc.exe 168 PID 5096 wrote to memory of 5108 5096 DllCommonsvc.exe 168 PID 5096 wrote to memory of 872 5096 DllCommonsvc.exe 169 PID 5096 wrote to memory of 872 5096 DllCommonsvc.exe 169 PID 5096 wrote to memory of 3112 5096 DllCommonsvc.exe 170 PID 5096 wrote to memory of 3112 5096 DllCommonsvc.exe 170 PID 5096 wrote to memory of 4528 5096 DllCommonsvc.exe 171 PID 5096 wrote to memory of 4528 5096 DllCommonsvc.exe 171 PID 5096 wrote to memory of 3556 5096 DllCommonsvc.exe 172 PID 5096 wrote to memory of 3556 5096 DllCommonsvc.exe 172 PID 5096 wrote to memory of 3620 5096 DllCommonsvc.exe 173 PID 5096 wrote to memory of 3620 5096 DllCommonsvc.exe 173 PID 5096 wrote to memory of 3088 5096 DllCommonsvc.exe 174 PID 5096 wrote to memory of 3088 5096 DllCommonsvc.exe 174 PID 5096 wrote to memory of 3612 5096 DllCommonsvc.exe 175 PID 5096 wrote to memory of 3612 5096 DllCommonsvc.exe 175 PID 5096 wrote to memory of 3988 5096 DllCommonsvc.exe 190 PID 5096 wrote to memory of 3988 5096 DllCommonsvc.exe 190 PID 3988 wrote to memory of 5568 3988 cmd.exe 193 PID 3988 wrote to memory of 5568 3988 cmd.exe 193 PID 5568 wrote to memory of 5464 5568 cmd.exe 195 PID 5568 wrote to memory of 5464 5568 cmd.exe 195 PID 5568 wrote to memory of 3124 5568 cmd.exe 201 PID 5568 wrote to memory of 3124 5568 cmd.exe 201 PID 3124 wrote to memory of 5820 3124 cmd.exe 203 PID 3124 wrote to memory of 5820 3124 cmd.exe 203 PID 5820 wrote to memory of 5172 5820 cmd.exe 205 PID 5820 wrote to memory of 5172 5820 cmd.exe 205 PID 5820 wrote to memory of 1636 5820 cmd.exe 207 PID 5820 wrote to memory of 1636 5820 cmd.exe 207 PID 1636 wrote to memory of 1476 1636 cmd.exe 210 PID 1636 wrote to memory of 1476 1636 cmd.exe 210 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_21016ad2a1088da1d5e30404cff3b40daeadd9c6e5c6d05968842f8d3e66d20f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_21016ad2a1088da1d5e30404cff3b40daeadd9c6e5c6d05968842f8d3e66d20f.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4948
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\OfficeClickToRun.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\GameBarPresenceWriter\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1828
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\cmd.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\cmd.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1860
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1008
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sihost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4244
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4924
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Registration\CRMLog\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3096
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5108
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:872
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\upfc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3112
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\es-ES\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4528
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\twain_32\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3556
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Configuration\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3620
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\spoolsv.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3088
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\StartMenuExperienceHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Wqkq749RcZ.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:5464
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\79RMekxjZd.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:5172
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\574RqM7W2b.bat"10⤵PID:1476
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:4428
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2924 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bhowVEGEG8.bat"12⤵PID:4012
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:5868
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1580 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kz6bOuYaab.bat"14⤵PID:4872
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:5336
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5908 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3B2OAH3dio.bat"16⤵PID:1340
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:1696
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:872 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6xwNL0dL8Y.bat"18⤵PID:1732
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:1412
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:6120 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VlbjwdcMOl.bat"20⤵PID:3564
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:5536
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5776 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vCRFnHZZKP.bat"22⤵PID:1548
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:4552
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3348 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\16sHyqWYU0.bat"24⤵PID:788
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:1444
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3596 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ddqzBJK7Zu.bat"26⤵PID:5368
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:5260
-
-
C:\Recovery\WindowsRE\cmd.exe"C:\Recovery\WindowsRE\cmd.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5036 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UZ6jdsJyxg.bat"28⤵PID:5208
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:4372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Libraries\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\Libraries\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Libraries\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3976
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:720
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3204
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4708
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4592
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4748
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\GameBarPresenceWriter\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\GameBarPresenceWriter\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\GameBarPresenceWriter\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4148
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\providercommon\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4712
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\providercommon\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:376
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:700
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\providercommon\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3596
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4752
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\Registration\CRMLog\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1304
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Windows\Registration\CRMLog\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\providercommon\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5088
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4632
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\providercommon\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4280
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Downloads\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Public\Downloads\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Downloads\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5052
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3176
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Program Files\Google\Chrome\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1348
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\es-ES\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:912
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\es-ES\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\es-ES\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4616
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\twain_32\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\twain_32\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\twain_32\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4452
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3832
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:644
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Mail\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD571fa55c67a762ba70e40011153e19b3c
SHA1a36d2bb4802a8ec7db1a68de5f0c3d6007987492
SHA256b8be6896ca89d3ebe9ee8a94e3407483f4750badaf7fa33526817cfc926dc291
SHA51232760af7c05e20fec8cbddf56c2df544a69335f930f1d313cd1fdceaa90ed2afe81e54ac1b6770097d6f5ca5f30955f95970171a453579aa19239a17aaefe47f
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD5a8e8360d573a4ff072dcc6f09d992c88
SHA13446774433ceaf0b400073914facab11b98b6807
SHA256bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b
SHA5124ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
Filesize
944B
MD5ecceac16628651c18879d836acfcb062
SHA1420502b3e5220a01586c59504e94aa1ee11982c9
SHA25658238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9
SHA512be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3
-
Filesize
944B
MD5e448fe0d240184c6597a31d3be2ced58
SHA1372b8d8c19246d3e38cd3ba123cc0f56070f03cd
SHA256c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391
SHA5120b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4
-
Filesize
194B
MD5ef40e813577650c7a03e3fc09d256185
SHA1b0fa632605d715d43db0f717e04bc1dbfb4cd37a
SHA256c49f720837ea4a2339e7afe26d0a33b0eff50c42d59d413a916e98478c4ba037
SHA5125bc94386d476296ce11cb18a30fcc6f4a0bb9b7f46cedd8c2cdd060f917245f9a42c410188ee9140f19447903d509aed36467fb97c1062757ed00d52e0e20352
-
Filesize
194B
MD53377c0c48a848af5972a01c3fe80f356
SHA1157fc9fd1f3b3096d58175d838b59b7b3d9a9dda
SHA25687c6cdc30f4299999b0a69f6ca179eca419ad3af4d49ff19823d5c219410d04b
SHA5126ac5085b1c95931029289e4815ef7fc50ef5086c4ba1ad5e489c77f60dab8e8e00879557ab4a297640d84297e60ef2f9ad9910593417640c3f06dbbf62360a79
-
Filesize
194B
MD573e5aed612c68b10bd61bb825e518294
SHA15cea2b99c811d8f7ba692df081296b1f3a8cc10f
SHA256c4b83e1c10ed0e474e9a33c2dc9420c3db5d20ad2af230ffbe4e6833ba094ea5
SHA5125a03a205125c72d174c248d2147220480bc66dfca98e287b635e733f0d12747826b50fd16cefc740fd15e15a3e464f51d9a70c3439cce009e7ef5268b49357c3
-
Filesize
194B
MD5c460810600af94aadbe8d5feded88476
SHA156e4caa7144133774fef6b1ca63b41c55c7905cf
SHA2569a05ce8c108d81ea1cc392fe33414520e9ea3011e8db5f2136c8e5e91bb1acb2
SHA5128782521f015b592e7521471cc394211edf00921d1ef81fefded1950bcb1e28f5b705c0b8a1fe132385b48672f073159313e1b2e828f3dc3ed00fde4a79f5c77f
-
Filesize
194B
MD5240e08a70be9d1507faf44fadd543c3d
SHA10b50df65c39e5443427b9e9835eb102265af5ead
SHA256d6219135bb448af567037b2d54cd186c0778443399766c602284f90e31d0101e
SHA512a360bcbad2412f248f814284b46a3cd03855c6a7a725bfee23126904dc0f91cbe4f103c3ebc418231dde6773eed20cb5a855d4314169e1facb7e7ede23425d55
-
Filesize
194B
MD5c50928e5ba90da0257f181a5aff93fbf
SHA109ebbbbf5bfcdbbf6a5ae596662018a89a156bff
SHA256afa91096011c7d52542570c6b2a14f49d7ca804bec7b2b5e6b1955a02dd26cfc
SHA512ed1dae26efdddbf0dd7959ec8072a7787c6a195b7bfd5bf8fd9745e361f5a3c902292eb9ab44a8b6bd1ce6e3014f28d23ae456b0f5a0ad7ac2abc5d2e25cf6c0
-
Filesize
194B
MD57b6438b2667de822f5c73d14d7f2c87d
SHA1bfad84858b30b46df0d818007818d4d012ab531a
SHA256e2268e0fca4ffa51bf6db98ac4aa33acca06267431d101e28bd0d2d19b85a885
SHA5126be16e783d75712b069b0671b2b4ebf7492b8884cfa29d8cf949499cb73b19877c45253524d80c7dac1853c635f2743b0bad3ce101aa5e6906f6fc83a75530e8
-
Filesize
194B
MD536068d1a720e31e9a29db13f8c130abf
SHA13333a46c3904007658a49bbf17dcddc05115ede5
SHA2562cac5b1e7d1ca635cf0a5555dfec72f36ef08b220a2fcb3289ec174e81843cc3
SHA512666fecde2973c177ae77b90e9617ddcc08bef3ffa7d61fefd63028d2af5ee22fa08b16320756a71fb382628d3242c4330c309abfb839c4ad9f299edc6237f0bc
-
Filesize
194B
MD504d055ff3352b52c09375fd5767ee40b
SHA10f164f5034e1f159ce47f854820a84324e35597e
SHA25671709e8f05adee58660945af9fbeb6108193a793b9d53c3c97a977c07ec72524
SHA512f249d1966d2477ef96399687d15ce3ee949e9c7d28ed3b893e9881ce2fbaf9e11674a8e155261205554db7a60a4f547a8caa4cd1865fceb0420da4c689166efd
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
194B
MD55fbf9af806629d741713ed69130c6580
SHA1e45e7618ae7138d48e2e8c57ea9f13f8d2bdb24f
SHA256a1de5c342524f468e47e93e23c6e2b77838bc2ee0ac1161493732ad8f5c45c3d
SHA51287c469f1d16bc430473f02e65036945d22b5869e159fc0110743dd3bcf54b8d9b9fdc34548e2d842caad78e337dbf43de461f2a8e9c20affdef213bbd388a309
-
Filesize
194B
MD58c06facf60f4f285be949abf878a300c
SHA1e7d6705c1850d399b2ed20099352e46a8b35c658
SHA256d67b2309bf831282e1d4048fd0877bb72e9e9f97cf796b4221a4bde44d783a45
SHA51217a532f30649538b4e27174b8cfe8851053dced7656e76a11e418043dd3bf056a455a940caf316f39420a37c65550f22c35c01240d23881e1551bd84ade50344
-
Filesize
194B
MD5b5be108a03eb7ce36ea3e1b779d2de2e
SHA18a20f1522084550a0070218f5418fec27eb07514
SHA2560844d17e8669718c7ccbc2308f040113cbab12292a5f848935fca4ff0c23f2b2
SHA5125cf07887cea6c0aa03a0536b0ffe154cc7d559e6e6d7cfc2eba5a404254c8082d5d3394e9200f7e74506331e5f5fcb2c35645e57ee72c7c6766c843d90322392
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478