dcrat | 3c5d4007aabc7835b586d15313645af2e823dfad1d487cad46453dc3474e2693

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
855deb7775f714f1fc46d29fea8008d7.exe
Size 1.6MB
Sample250322-zaqppszvbx
SHA256 795cdb953a299acec277e31a6c97b38acdc44dfca7a2ce6bda2785a48bdfafdf
MD5 855deb7775f714f1fc46d29fea8008d7
SHA1 421d56096458fc456190f7c8d13fa3435c051264
SHA512 7fd5597d07dd4597262a6122c3b165b0624d99ee9d222f448e2161c07bcef791a08be95bf52eb4cf37c8105e53855bf96d1bf026d887cb3ef85d132c07b40d99
SSDEEP 24576:Ksm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:KD8Jijt+xpS/ekYmLGdhEAf7bCcjE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4084	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4428	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3668	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4056	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4016	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3196	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	368	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3692	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	664	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3920	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3516	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1172	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3184	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4004	1648	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	1648	schtasks.exe	87

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral10/memory/4320-1-0x0000000000FF0000-0x0000000001192000-memory.dmp	dcrat
behavioral10/files/0x00070000000240b3-26.dat	dcrat
behavioral10/files/0x000a0000000240e6-89.dat	dcrat
behavioral10/files/0x000a0000000240af-134.dat	dcrat
behavioral10/files/0x000c0000000240b3-157.dat	dcrat
behavioral10/files/0x000a0000000240c9-214.dat	dcrat
behavioral10/files/0x000a0000000240d8-245.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2712	powershell.exe
2020	powershell.exe
2188	powershell.exe
3184	powershell.exe
1508	powershell.exe
1860	powershell.exe
1324	powershell.exe
3956	powershell.exe
4484	powershell.exe
1504	powershell.exe
4684	powershell.exe
3180	powershell.exe
1652	powershell.exe
2944	powershell.exe
2228	powershell.exe
452	powershell.exe
4452	powershell.exe
1604	powershell.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	855deb7775f714f1fc46d29fea8008d7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	dllhost.exe

Executes dropped EXE 14 IoCs

pid	Process
5848	dllhost.exe
5112	dllhost.exe
2920	dllhost.exe
5716	dllhost.exe
5516	dllhost.exe
4604	dllhost.exe
5148	dllhost.exe
5400	dllhost.exe
1836	dllhost.exe
4564	dllhost.exe
5360	dllhost.exe
4376	dllhost.exe
5888	dllhost.exe
4652	dllhost.exe

Drops file in Program Files directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe	855deb7775f714f1fc46d29fea8008d7.exe
File created	C:\Program Files (x86)\Windows Mail\SearchApp.exe	855deb7775f714f1fc46d29fea8008d7.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe	855deb7775f714f1fc46d29fea8008d7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\StartMenuExperienceHost.exe	855deb7775f714f1fc46d29fea8008d7.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\RCX8D1F.tmp	855deb7775f714f1fc46d29fea8008d7.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe	855deb7775f714f1fc46d29fea8008d7.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\7a0fd90576e088	855deb7775f714f1fc46d29fea8008d7.exe
File created	C:\Program Files\Java\jdk-1.8\bin\55b276f4edf653	855deb7775f714f1fc46d29fea8008d7.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCX6BCE.tmp	855deb7775f714f1fc46d29fea8008d7.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCX6BCF.tmp	855deb7775f714f1fc46d29fea8008d7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX72E8.tmp	855deb7775f714f1fc46d29fea8008d7.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCX8390.tmp	855deb7775f714f1fc46d29fea8008d7.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe	855deb7775f714f1fc46d29fea8008d7.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\27d1bcfc3c54e0	855deb7775f714f1fc46d29fea8008d7.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCX6E51.tmp	855deb7775f714f1fc46d29fea8008d7.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RCX7A13.tmp	855deb7775f714f1fc46d29fea8008d7.exe
File created	C:\Program Files\Java\jdk-1.8\bin\StartMenuExperienceHost.exe	855deb7775f714f1fc46d29fea8008d7.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\5940a34987c991	855deb7775f714f1fc46d29fea8008d7.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCX8391.tmp	855deb7775f714f1fc46d29fea8008d7.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\RCX8D1E.tmp	855deb7775f714f1fc46d29fea8008d7.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\sppsvc.exe	855deb7775f714f1fc46d29fea8008d7.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\0a1fd5f707cd16	855deb7775f714f1fc46d29fea8008d7.exe
File created	C:\Program Files (x86)\Windows Mail\38384e6a620884	855deb7775f714f1fc46d29fea8008d7.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\System.exe	855deb7775f714f1fc46d29fea8008d7.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\sppsvc.exe	855deb7775f714f1fc46d29fea8008d7.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\System.exe	855deb7775f714f1fc46d29fea8008d7.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCX6DE3.tmp	855deb7775f714f1fc46d29fea8008d7.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RCX7A03.tmp	855deb7775f714f1fc46d29fea8008d7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX72E9.tmp	855deb7775f714f1fc46d29fea8008d7.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\SearchApp.exe	855deb7775f714f1fc46d29fea8008d7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	855deb7775f714f1fc46d29fea8008d7.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	dllhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3516	schtasks.exe
4988	schtasks.exe
4428	schtasks.exe
2012	schtasks.exe
3196	schtasks.exe
1064	schtasks.exe
1244	schtasks.exe
4916	schtasks.exe
4412	schtasks.exe
5072	schtasks.exe
368	schtasks.exe
1296	schtasks.exe
4660	schtasks.exe
320	schtasks.exe
4868	schtasks.exe
5056	schtasks.exe
4132	schtasks.exe
2884	schtasks.exe
3920	schtasks.exe
1636	schtasks.exe
2468	schtasks.exe
2768	schtasks.exe
3184	schtasks.exe
2020	schtasks.exe
1652	schtasks.exe
4684	schtasks.exe
3956	schtasks.exe
432	schtasks.exe
4004	schtasks.exe
3668	schtasks.exe
4056	schtasks.exe
4016	schtasks.exe
2440	schtasks.exe
2044	schtasks.exe
2944	schtasks.exe
4452	schtasks.exe
2112	schtasks.exe
4608	schtasks.exe
2532	schtasks.exe
2784	schtasks.exe
1860	schtasks.exe
2284	schtasks.exe
2692	schtasks.exe
4948	schtasks.exe
664	schtasks.exe
1604	schtasks.exe
4084	schtasks.exe
5048	schtasks.exe
3692	schtasks.exe
1552	schtasks.exe
1172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4320	855deb7775f714f1fc46d29fea8008d7.exe
4320	855deb7775f714f1fc46d29fea8008d7.exe
4320	855deb7775f714f1fc46d29fea8008d7.exe
4320	855deb7775f714f1fc46d29fea8008d7.exe
4320	855deb7775f714f1fc46d29fea8008d7.exe
4320	855deb7775f714f1fc46d29fea8008d7.exe
4320	855deb7775f714f1fc46d29fea8008d7.exe
4320	855deb7775f714f1fc46d29fea8008d7.exe
1504	powershell.exe
1504	powershell.exe
3180	powershell.exe
3180	powershell.exe
1508	powershell.exe
1508	powershell.exe
3184	powershell.exe
3184	powershell.exe
1324	powershell.exe
1324	powershell.exe
1860	powershell.exe
1860	powershell.exe
2944	powershell.exe
4484	powershell.exe
4484	powershell.exe
2944	powershell.exe
3956	powershell.exe
3956	powershell.exe
1604	powershell.exe
1604	powershell.exe
2228	powershell.exe
2228	powershell.exe
2020	powershell.exe
2020	powershell.exe
2712	powershell.exe
2712	powershell.exe
2188	powershell.exe
2188	powershell.exe
4452	powershell.exe
4452	powershell.exe
4684	powershell.exe
4684	powershell.exe
452	powershell.exe
452	powershell.exe
1652	powershell.exe
1652	powershell.exe
1324	powershell.exe
1652	powershell.exe
3184	powershell.exe
3180	powershell.exe
3180	powershell.exe
1508	powershell.exe
1504	powershell.exe
1508	powershell.exe
1504	powershell.exe
2228	powershell.exe
2188	powershell.exe
2944	powershell.exe
1604	powershell.exe
452	powershell.exe
4452	powershell.exe
1860	powershell.exe
1860	powershell.exe
2020	powershell.exe
2712	powershell.exe
4684	powershell.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	4320	855deb7775f714f1fc46d29fea8008d7.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	3180	powershell.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	3184	powershell.exe
Token: SeDebugPrivilege	1324	powershell.exe
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	452	powershell.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeDebugPrivilege	4684	powershell.exe
Token: SeDebugPrivilege	1652	powershell.exe
Token: SeDebugPrivilege	5848	dllhost.exe
Token: SeDebugPrivilege	5112	dllhost.exe
Token: SeDebugPrivilege	2920	dllhost.exe
Token: SeDebugPrivilege	5716	dllhost.exe
Token: SeDebugPrivilege	5516	dllhost.exe
Token: SeDebugPrivilege	4604	dllhost.exe
Token: SeDebugPrivilege	5148	dllhost.exe
Token: SeDebugPrivilege	5400	dllhost.exe
Token: SeDebugPrivilege	1836	dllhost.exe
Token: SeDebugPrivilege	4564	dllhost.exe
Token: SeDebugPrivilege	5360	dllhost.exe
Token: SeDebugPrivilege	4376	dllhost.exe
Token: SeDebugPrivilege	5888	dllhost.exe
Token: SeDebugPrivilege	4652	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 1652	4320	855deb7775f714f1fc46d29fea8008d7.exe	144
PID 4320 wrote to memory of 1652	4320	855deb7775f714f1fc46d29fea8008d7.exe	144
PID 4320 wrote to memory of 1860	4320	855deb7775f714f1fc46d29fea8008d7.exe	145
PID 4320 wrote to memory of 1860	4320	855deb7775f714f1fc46d29fea8008d7.exe	145
PID 4320 wrote to memory of 3180	4320	855deb7775f714f1fc46d29fea8008d7.exe	146
PID 4320 wrote to memory of 3180	4320	855deb7775f714f1fc46d29fea8008d7.exe	146
PID 4320 wrote to memory of 4684	4320	855deb7775f714f1fc46d29fea8008d7.exe	148
PID 4320 wrote to memory of 4684	4320	855deb7775f714f1fc46d29fea8008d7.exe	148
PID 4320 wrote to memory of 1504	4320	855deb7775f714f1fc46d29fea8008d7.exe	149
PID 4320 wrote to memory of 1504	4320	855deb7775f714f1fc46d29fea8008d7.exe	149
PID 4320 wrote to memory of 2944	4320	855deb7775f714f1fc46d29fea8008d7.exe	150
PID 4320 wrote to memory of 2944	4320	855deb7775f714f1fc46d29fea8008d7.exe	150
PID 4320 wrote to memory of 2712	4320	855deb7775f714f1fc46d29fea8008d7.exe	151
PID 4320 wrote to memory of 2712	4320	855deb7775f714f1fc46d29fea8008d7.exe	151
PID 4320 wrote to memory of 1604	4320	855deb7775f714f1fc46d29fea8008d7.exe	152
PID 4320 wrote to memory of 1604	4320	855deb7775f714f1fc46d29fea8008d7.exe	152
PID 4320 wrote to memory of 1508	4320	855deb7775f714f1fc46d29fea8008d7.exe	153
PID 4320 wrote to memory of 1508	4320	855deb7775f714f1fc46d29fea8008d7.exe	153
PID 4320 wrote to memory of 3184	4320	855deb7775f714f1fc46d29fea8008d7.exe	154
PID 4320 wrote to memory of 3184	4320	855deb7775f714f1fc46d29fea8008d7.exe	154
PID 4320 wrote to memory of 2188	4320	855deb7775f714f1fc46d29fea8008d7.exe	155
PID 4320 wrote to memory of 2188	4320	855deb7775f714f1fc46d29fea8008d7.exe	155
PID 4320 wrote to memory of 4484	4320	855deb7775f714f1fc46d29fea8008d7.exe	156
PID 4320 wrote to memory of 4484	4320	855deb7775f714f1fc46d29fea8008d7.exe	156
PID 4320 wrote to memory of 3956	4320	855deb7775f714f1fc46d29fea8008d7.exe	157
PID 4320 wrote to memory of 3956	4320	855deb7775f714f1fc46d29fea8008d7.exe	157
PID 4320 wrote to memory of 1324	4320	855deb7775f714f1fc46d29fea8008d7.exe	158
PID 4320 wrote to memory of 1324	4320	855deb7775f714f1fc46d29fea8008d7.exe	158
PID 4320 wrote to memory of 4452	4320	855deb7775f714f1fc46d29fea8008d7.exe	159
PID 4320 wrote to memory of 4452	4320	855deb7775f714f1fc46d29fea8008d7.exe	159
PID 4320 wrote to memory of 452	4320	855deb7775f714f1fc46d29fea8008d7.exe	160
PID 4320 wrote to memory of 452	4320	855deb7775f714f1fc46d29fea8008d7.exe	160
PID 4320 wrote to memory of 2020	4320	855deb7775f714f1fc46d29fea8008d7.exe	161
PID 4320 wrote to memory of 2020	4320	855deb7775f714f1fc46d29fea8008d7.exe	161
PID 4320 wrote to memory of 2228	4320	855deb7775f714f1fc46d29fea8008d7.exe	162
PID 4320 wrote to memory of 2228	4320	855deb7775f714f1fc46d29fea8008d7.exe	162
PID 4320 wrote to memory of 4604	4320	855deb7775f714f1fc46d29fea8008d7.exe	180
PID 4320 wrote to memory of 4604	4320	855deb7775f714f1fc46d29fea8008d7.exe	180
PID 4604 wrote to memory of 5960	4604	cmd.exe	182
PID 4604 wrote to memory of 5960	4604	cmd.exe	182
PID 4604 wrote to memory of 5848	4604	cmd.exe	184
PID 4604 wrote to memory of 5848	4604	cmd.exe	184
PID 5848 wrote to memory of 5928	5848	dllhost.exe	185
PID 5848 wrote to memory of 5928	5848	dllhost.exe	185
PID 5848 wrote to memory of 5432	5848	dllhost.exe	186
PID 5848 wrote to memory of 5432	5848	dllhost.exe	186
PID 5928 wrote to memory of 5112	5928	WScript.exe	188
PID 5928 wrote to memory of 5112	5928	WScript.exe	188
PID 5112 wrote to memory of 5116	5112	dllhost.exe	190
PID 5112 wrote to memory of 5116	5112	dllhost.exe	190
PID 5112 wrote to memory of 2464	5112	dllhost.exe	191
PID 5112 wrote to memory of 2464	5112	dllhost.exe	191
PID 5116 wrote to memory of 2920	5116	WScript.exe	195
PID 5116 wrote to memory of 2920	5116	WScript.exe	195
PID 2920 wrote to memory of 5996	2920	dllhost.exe	196
PID 2920 wrote to memory of 5996	2920	dllhost.exe	196
PID 2920 wrote to memory of 2952	2920	dllhost.exe	197
PID 2920 wrote to memory of 2952	2920	dllhost.exe	197
PID 5996 wrote to memory of 5716	5996	WScript.exe	202
PID 5996 wrote to memory of 5716	5996	WScript.exe	202
PID 5716 wrote to memory of 1344	5716	dllhost.exe	203
PID 5716 wrote to memory of 1344	5716	dllhost.exe	203
PID 5716 wrote to memory of 3092	5716	dllhost.exe	204
PID 5716 wrote to memory of 3092	5716	dllhost.exe	204

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\855deb7775f714f1fc46d29fea8008d7.exe
"C:\Users\Admin\AppData\Local\Temp\855deb7775f714f1fc46d29fea8008d7.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\855deb7775f714f1fc46d29fea8008d7.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Templates\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Oracle\Java\javapath\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\dfe2e59cddd00040f555dab607351a1d\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jdk-1.8\bin\StartMenuExperienceHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\d9c22b4eaa3c0b9c12c7\sysmon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\dfe2e59cddd00040f555dab607351a1d\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\d9c22b4eaa3c0b9c12c7\upfc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\dfe2e59cddd00040f555dab607351a1d\OfficeClickToRun.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\SearchApp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\d9c22b4eaa3c0b9c12c7\backgroundTaskHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\dfe2e59cddd00040f555dab607351a1d\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YGXBwQcNNN.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:5960
- - C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
    "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5848
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\249b6445-d9d3-4c6f-b0f4-81a0b3d68bc1.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5928
    - - C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5112
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f3d08163-93d6-4d41-924f-ab0bf7bdda79.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2920
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31405113-4fea-4cd0-a67e-7e25a4764fcd.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5996
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5716
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e0890e8b-709d-45ae-9af4-b3520d5b2096.vbs"
        10⤵
        
        PID:1344
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5516
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ec3c489d-e578-4661-9236-242a54b4245e.vbs"
        12⤵
        
        PID:2852
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4604
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\08a79e30-b6bb-42d6-b88b-6883dfbc316d.vbs"
        14⤵
        
        PID:5880
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5148
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48224483-4190-4189-9c7d-56dc9ac946a6.vbs"
        16⤵
        
        PID:5436
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5400
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fafec8d3-a27e-4649-83d5-59f2acc8e4e5.vbs"
        18⤵
        
        PID:4300
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1836
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a2518299-e856-49d8-9528-feb297486c5b.vbs"
        20⤵
        
        PID:6064
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4564
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\96dcb0b1-2868-493a-a0d3-627040df2c28.vbs"
        22⤵
        
        PID:1972
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5360
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1a1cd58f-3f12-4152-8a68-679e227f2b47.vbs"
        24⤵
        
        PID:1384
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4376
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a463b1af-1950-4516-8933-017a478e69a2.vbs"
        26⤵
        
        PID:5516
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5888
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4d27e26c-f04e-49bb-819c-2d3bb08db808.vbs"
        28⤵
        
        PID:5588
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4652
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\17ce8fe4-793b-462d-b602-dbf227fc84e6.vbs"
        28⤵
        
        PID:3224
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0b20b248-0a09-4b73-a73e-f98f4989fa26.vbs"
        26⤵
        
        PID:2340
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\23e8d58f-f983-43b4-8b0a-4016eddc3e88.vbs"
        24⤵
        
        PID:5296
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a4dc8639-d369-4ea1-8452-61c8c6a730f9.vbs"
        22⤵
        
        PID:6000
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\abc6e133-acdf-4129-8798-0f606aa2ca76.vbs"
        20⤵
        
        PID:1392
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\94602f1a-7eca-4235-914b-f8ebfb4d1e76.vbs"
        18⤵
        
        PID:6072
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9784eaa4-7b35-4a32-9d3e-2fde483fc0fd.vbs"
        16⤵
        
        PID:4008
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\91de019b-3c18-46db-9389-4efcf10a256b.vbs"
        14⤵
        
        PID:5680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fe30acf9-2d4a-4b85-9955-e6604a6d6388.vbs"
        12⤵
        
        PID:2416
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7720ad24-c416-4899-8254-93ce4dcbe89a.vbs"
        10⤵
        
        PID:3092
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80e95816-7104-4834-9e6a-5ec65536e09f.vbs"
        8⤵
        
        PID:2952
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\16558f45-ad1f-4f54-819e-a905a125e4f2.vbs"
        6⤵
        
        PID:2464
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dea7f5cd-8338-4183-a2ff-cec644b69b72.vbs"
      4⤵
      PID:5432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Templates\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\Templates\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Templates\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\dfe2e59cddd00040f555dab607351a1d\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\dfe2e59cddd00040f555dab607351a1d\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\dfe2e59cddd00040f555dab607351a1d\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Java\jdk-1.8\bin\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\bin\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jdk-1.8\bin\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\d9c22b4eaa3c0b9c12c7\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\d9c22b4eaa3c0b9c12c7\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\d9c22b4eaa3c0b9c12c7\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\dfe2e59cddd00040f555dab607351a1d\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\dfe2e59cddd00040f555dab607351a1d\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\dfe2e59cddd00040f555dab607351a1d\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\d9c22b4eaa3c0b9c12c7\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\d9c22b4eaa3c0b9c12c7\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\d9c22b4eaa3c0b9c12c7\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\dfe2e59cddd00040f555dab607351a1d\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\dfe2e59cddd00040f555dab607351a1d\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\dfe2e59cddd00040f555dab607351a1d\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\d9c22b4eaa3c0b9c12c7\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\d9c22b4eaa3c0b9c12c7\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\d9c22b4eaa3c0b9c12c7\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\dfe2e59cddd00040f555dab607351a1d\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\dfe2e59cddd00040f555dab607351a1d\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\dfe2e59cddd00040f555dab607351a1d\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sppsvc.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_90156\sppsvc.exe
Size 1.6MB
SHA256 88a845d3ccf944eed6a0637204e4a5d4ce5579db83538aae24dd1983c0a861bc
MD5 248ffa277d16bed2d34dc1fdb4ab62f5
SHA1 6f19735d673e6d6dc161ee1fc9b968ba550f743d
SHA512 7f0cabe449a088225cb37e37a80ff4f6fcc3af04cd861d70649d1813c421b3365954e996eb00249b0dd29baa96a42612e4d353cdabced40f06cfef5936fac16a
SSDEEP 24576:Ksm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:KD8Jijt+xpS/ekYmLGdhEAf7bCcjE
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartMenuExperienceHost.exe

Path C:\Program Files\Java\jdk-1.8\bin\StartMenuExperienceHost.exe
Size 1.6MB
SHA256 795cdb953a299acec277e31a6c97b38acdc44dfca7a2ce6bda2785a48bdfafdf
MD5 855deb7775f714f1fc46d29fea8008d7
SHA1 421d56096458fc456190f7c8d13fa3435c051264
SHA512 7fd5597d07dd4597262a6122c3b165b0624d99ee9d222f448e2161c07bcef791a08be95bf52eb4cf37c8105e53855bf96d1bf026d887cb3ef85d132c07b40d99
SSDEEP 24576:Ksm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:KD8Jijt+xpS/ekYmLGdhEAf7bCcjE
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Recovery\WindowsRE\lsass.exe
Size 1.6MB
SHA256 5ded1a824e99f8ffdd759ce2748e99f45a3ffc478789d4dc4d86e6cf330e313e
MD5 f13a51dfa0a7ce8c99c3cebb1d4f7dd2
SHA1 cc9f607d4607a170ef8725a85ebde8135a479ef3
SHA512 eea66d0e76b4f21fa5e71750c3d689a646d7f19d2216754092c4976afe4d9dcb43c8c17a580e92b15fb39d3c111660fd0c1ff0c1e18e2e591359a1d944be8b04
SSDEEP 24576:6sm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:6D8Jijt+xpS/ekYmLGdhEAf7bCcjE
MD5 SHA1 SHA512 SSDEEP

Submit Download

dllhost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log
Size 1KB
SHA256 2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73
MD5 3690a1c3b695227a38625dcf27bd6dac
SHA1 c2ed91e98b120681182904fa2c7cd504e5c4b2f5
SHA512 15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download