Analysis
-
max time kernel
172s -
max time network
276s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2023 01:47
Behavioral task
behavioral1
Sample
Stand.Launchpad.exe
Resource
win7-20230712-en
General
-
Target
Stand.Launchpad.exe
-
Size
95KB
-
MD5
fc067bffd940f4a2745e2374463f4f3d
-
SHA1
cb3b8644a6f0a89d7cb00a21086e24623ed92197
-
SHA256
727be016c2084ef54f591388fcff01ba6368831447bfcd01f7d0c7f94a8bb4a8
-
SHA512
c3cee63b8f03ef71d633b33cebc24199492fef7bc0b37d52d3ddfc88172df3aa5db2c7813bbb44adaee3756423c351cf585ff33887a78c9057c6749face0a710
-
SSDEEP
1536:tl2LaUUEF5c2BQ6InAc1bO5Bt36bOSz04LV:tUuUd5c226zc1bO5/KOSzfV
Malware Config
Extracted
xworm
5.tcp.eu.ngrok.io:12218
-
install_file
USB.exe
Signatures
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exeexplorer.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
ACProtect 1.3x - 1.4x DLL software 5 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule behavioral2/files/0x000200000001e71b-205.dat acprotect behavioral2/files/0x000200000001e7bd-217.dat acprotect behavioral2/files/0x000200000001e794-212.dat acprotect behavioral2/files/0x000300000001e7fa-222.dat acprotect behavioral2/files/0x000300000001e9f2-227.dat acprotect -
Drops startup file 2 IoCs
Processes:
Stand.Launchpad.exedescription ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stand.Launchpad.lnk Stand.Launchpad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stand.Launchpad.lnk Stand.Launchpad.exe -
Executes dropped EXE 4 IoCs
Processes:
Stand.Launchpad.exeAll-In-One.exeStand.Launchpad.exeStand.Launchpad.exepid Process 948 Stand.Launchpad.exe 492 All-In-One.exe 4368 Stand.Launchpad.exe 4656 Stand.Launchpad.exe -
Loads dropped DLL 1 IoCs
Processes:
All-In-One.exepid Process 492 All-In-One.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/files/0x000200000001e71b-205.dat upx behavioral2/files/0x000200000001e7bd-217.dat upx behavioral2/files/0x000200000001e794-212.dat upx behavioral2/files/0x000300000001e7fa-222.dat upx behavioral2/files/0x000300000001e9f2-227.dat upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Stand.Launchpad.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Stand.Launchpad = "C:\\Users\\Admin\\AppData\\Roaming\\Stand.Launchpad.exe" Stand.Launchpad.exe -
Enumerates connected drives 3 TTPs 5 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
explorer.exeStand.Launchpad.exeexplorer.exedescription ioc Process File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: Stand.Launchpad.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 21 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 20 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target Process procid_target 3144 1284 WerFault.exe 130 1832 3440 WerFault.exe 137 2916 4380 WerFault.exe 144 2976 452 WerFault.exe 142 1272 4848 WerFault.exe 152 3844 2152 WerFault.exe 159 5020 3692 WerFault.exe 157 3340 4404 WerFault.exe 168 4592 5000 WerFault.exe 166 4016 644 WerFault.exe 174 3444 2436 WerFault.exe 181 2020 3228 WerFault.exe 179 2456 1872 WerFault.exe 187 4260 3384 WerFault.exe 194 744 4036 WerFault.exe 192 4028 5052 WerFault.exe 202 4728 1912 WerFault.exe 200 1832 2976 WerFault.exe 210 3788 220 WerFault.exe 208 4988 2356 WerFault.exe 216 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid Process 1052 taskkill.exe -
Modifies registry class 23 IoCs
Processes:
explorer.exeexplorer.exeStartMenuExperienceHost.exeexplorer.exeStartMenuExperienceHost.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3195054982-4292022746-1467505928-1000\{EBA90424-BF9C-431D-9C5B-4788D4C6B9B5} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3195054982-4292022746-1467505928-1000\{DB08147A-8DB2-47F5-A6EB-87E3B5857EFE} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
Stand.Launchpad.exepid Process 3224 Stand.Launchpad.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exepowershell.exeStand.Launchpad.exeAll-In-One.exepid Process 2076 powershell.exe 2076 powershell.exe 4428 powershell.exe 4428 powershell.exe 5048 powershell.exe 5048 powershell.exe 3224 Stand.Launchpad.exe 492 All-In-One.exe 492 All-In-One.exe -
Suspicious use of AdjustPrivilegeToken 60 IoCs
Processes:
Stand.Launchpad.exepowershell.exepowershell.exepowershell.exeStand.Launchpad.exeAll-In-One.exeStand.Launchpad.exetaskkill.exeAUDIODG.EXEStand.Launchpad.exeexplorer.exeexplorer.exedescription pid Process Token: SeDebugPrivilege 3224 Stand.Launchpad.exe Token: SeDebugPrivilege 2076 powershell.exe Token: SeDebugPrivilege 4428 powershell.exe Token: SeDebugPrivilege 5048 powershell.exe Token: SeDebugPrivilege 3224 Stand.Launchpad.exe Token: SeDebugPrivilege 948 Stand.Launchpad.exe Token: SeDebugPrivilege 492 All-In-One.exe Token: SeDebugPrivilege 4368 Stand.Launchpad.exe Token: SeDebugPrivilege 1052 taskkill.exe Token: 33 2444 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2444 AUDIODG.EXE Token: SeDebugPrivilege 4656 Stand.Launchpad.exe Token: SeShutdownPrivilege 1284 explorer.exe Token: SeCreatePagefilePrivilege 1284 explorer.exe Token: SeShutdownPrivilege 1284 explorer.exe Token: SeCreatePagefilePrivilege 1284 explorer.exe Token: SeShutdownPrivilege 1284 explorer.exe Token: SeCreatePagefilePrivilege 1284 explorer.exe Token: SeShutdownPrivilege 1284 explorer.exe Token: SeCreatePagefilePrivilege 1284 explorer.exe Token: SeShutdownPrivilege 1284 explorer.exe Token: SeCreatePagefilePrivilege 1284 explorer.exe Token: SeShutdownPrivilege 1284 explorer.exe Token: SeCreatePagefilePrivilege 1284 explorer.exe Token: SeShutdownPrivilege 1284 explorer.exe Token: SeCreatePagefilePrivilege 1284 explorer.exe Token: SeShutdownPrivilege 1284 explorer.exe Token: SeCreatePagefilePrivilege 1284 explorer.exe Token: SeShutdownPrivilege 1284 explorer.exe Token: SeCreatePagefilePrivilege 1284 explorer.exe Token: SeShutdownPrivilege 1284 explorer.exe Token: SeCreatePagefilePrivilege 1284 explorer.exe Token: SeShutdownPrivilege 1284 explorer.exe Token: SeCreatePagefilePrivilege 1284 explorer.exe Token: SeShutdownPrivilege 1284 explorer.exe Token: SeCreatePagefilePrivilege 1284 explorer.exe Token: SeShutdownPrivilege 1284 explorer.exe Token: SeCreatePagefilePrivilege 1284 explorer.exe Token: SeShutdownPrivilege 3440 explorer.exe Token: SeCreatePagefilePrivilege 3440 explorer.exe Token: SeShutdownPrivilege 3440 explorer.exe Token: SeCreatePagefilePrivilege 3440 explorer.exe Token: SeShutdownPrivilege 3440 explorer.exe Token: SeCreatePagefilePrivilege 3440 explorer.exe Token: SeShutdownPrivilege 3440 explorer.exe Token: SeCreatePagefilePrivilege 3440 explorer.exe Token: SeShutdownPrivilege 3440 explorer.exe Token: SeCreatePagefilePrivilege 3440 explorer.exe Token: SeShutdownPrivilege 3440 explorer.exe Token: SeCreatePagefilePrivilege 3440 explorer.exe Token: SeShutdownPrivilege 3440 explorer.exe Token: SeCreatePagefilePrivilege 3440 explorer.exe Token: SeShutdownPrivilege 3440 explorer.exe Token: SeCreatePagefilePrivilege 3440 explorer.exe Token: SeShutdownPrivilege 3440 explorer.exe Token: SeCreatePagefilePrivilege 3440 explorer.exe Token: SeShutdownPrivilege 3440 explorer.exe Token: SeCreatePagefilePrivilege 3440 explorer.exe Token: SeShutdownPrivilege 3440 explorer.exe Token: SeCreatePagefilePrivilege 3440 explorer.exe -
Suspicious use of FindShellTrayWindow 44 IoCs
Processes:
Stand.Launchpad.exeexplorer.exeexplorer.exepid Process 3224 Stand.Launchpad.exe 3224 Stand.Launchpad.exe 3224 Stand.Launchpad.exe 3224 Stand.Launchpad.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
explorer.exeexplorer.exepid Process 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 1284 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe 3440 explorer.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
Stand.Launchpad.exeAll-In-One.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exepid Process 3224 Stand.Launchpad.exe 492 All-In-One.exe 492 All-In-One.exe 2696 StartMenuExperienceHost.exe 4748 StartMenuExperienceHost.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Stand.Launchpad.execmd.exedescription pid Process procid_target PID 3224 wrote to memory of 2076 3224 Stand.Launchpad.exe 90 PID 3224 wrote to memory of 2076 3224 Stand.Launchpad.exe 90 PID 3224 wrote to memory of 4428 3224 Stand.Launchpad.exe 92 PID 3224 wrote to memory of 4428 3224 Stand.Launchpad.exe 92 PID 3224 wrote to memory of 5048 3224 Stand.Launchpad.exe 95 PID 3224 wrote to memory of 5048 3224 Stand.Launchpad.exe 95 PID 3224 wrote to memory of 4300 3224 Stand.Launchpad.exe 99 PID 3224 wrote to memory of 4300 3224 Stand.Launchpad.exe 99 PID 3224 wrote to memory of 1320 3224 Stand.Launchpad.exe 105 PID 3224 wrote to memory of 1320 3224 Stand.Launchpad.exe 105 PID 3224 wrote to memory of 2472 3224 Stand.Launchpad.exe 112 PID 3224 wrote to memory of 2472 3224 Stand.Launchpad.exe 112 PID 2472 wrote to memory of 492 2472 cmd.exe 113 PID 2472 wrote to memory of 492 2472 cmd.exe 113 PID 2472 wrote to memory of 492 2472 cmd.exe 113 PID 3224 wrote to memory of 2304 3224 Stand.Launchpad.exe 123 PID 3224 wrote to memory of 2304 3224 Stand.Launchpad.exe 123 PID 3224 wrote to memory of 1052 3224 Stand.Launchpad.exe 125 PID 3224 wrote to memory of 1052 3224 Stand.Launchpad.exe 125 PID 3224 wrote to memory of 1284 3224 Stand.Launchpad.exe 130 PID 3224 wrote to memory of 1284 3224 Stand.Launchpad.exe 130
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe"C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2076
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Stand.Launchpad.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4428
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Stand.Launchpad.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Stand.Launchpad" /tr "C:\Users\Admin\AppData\Roaming\Stand.Launchpad.exe"2⤵
- Creates scheduled task(s)
PID:4300
-
-
C:\Windows\SYSTEM32\CMD.EXE"CMD.EXE"2⤵PID:1320
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c Cd %temp% && All-In-One.exe OutPut.json2⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\All-In-One.exeAll-In-One.exe OutPut.json3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:492
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies registry class
PID:2304
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1052
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1284 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1284 -s 61203⤵
- Program crash
PID:3144
-
-
-
C:\Users\Admin\AppData\Roaming\Stand.Launchpad.exeC:\Users\Admin\AppData\Roaming\Stand.Launchpad.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:948
-
C:\Users\Admin\AppData\Roaming\Stand.Launchpad.exeC:\Users\Admin\AppData\Roaming\Stand.Launchpad.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4368
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2d8 0x4801⤵
- Suspicious use of AdjustPrivilegeToken
PID:2444
-
C:\Users\Admin\AppData\Roaming\Stand.Launchpad.exeC:\Users\Admin\AppData\Roaming\Stand.Launchpad.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4656
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2696
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 456 -p 1284 -ip 12841⤵PID:4572
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3440 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3440 -s 58402⤵
- Program crash
PID:1832
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4748
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 516 -p 3440 -ip 34401⤵PID:1712
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:452
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 452 -s 56082⤵
- Program crash
PID:2976
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1368
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4380
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4380 -s 36602⤵
- Program crash
PID:2916
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 4380 -ip 43801⤵PID:1272
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 480 -p 452 -ip 4521⤵PID:4524
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4848
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4848 -s 59682⤵
- Program crash
PID:1272
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3324
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 560 -p 4848 -ip 48481⤵PID:3192
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3692
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3692 -s 59002⤵
- Program crash
PID:5020
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3436
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2152
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2152 -s 35882⤵
- Program crash
PID:3844
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 564 -p 2152 -ip 21521⤵PID:220
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 184 -p 3692 -ip 36921⤵PID:3344
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5000
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5000 -s 72722⤵
- Program crash
PID:4592
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:452
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4404
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4404 -s 35762⤵
- Program crash
PID:3340
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 504 -p 4404 -ip 44041⤵PID:560
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 5000 -ip 50001⤵PID:1120
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:644
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 644 -s 58282⤵
- Program crash
PID:4016
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2324
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 536 -p 644 -ip 6441⤵PID:4316
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3228
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3228 -s 59642⤵
- Program crash
PID:2020
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3920
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2436
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2436 -s 35682⤵
- Program crash
PID:3444
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 184 -p 2436 -ip 24361⤵PID:1808
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 424 -p 3228 -ip 32281⤵PID:1932
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1872
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1872 -s 59282⤵
- Program crash
PID:2456
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1372
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 568 -p 1872 -ip 18721⤵PID:4016
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4036
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4036 -s 19722⤵
- Program crash
PID:744
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4212
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3384
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3384 -s 35762⤵
- Program crash
PID:4260
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 424 -p 3384 -ip 33841⤵PID:1640
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 568 -p 4036 -ip 40361⤵PID:2432
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1912
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1912 -s 59642⤵
- Program crash
PID:4728
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4296
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5052
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5052 -s 35362⤵
- Program crash
PID:4028
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 184 -p 5052 -ip 50521⤵PID:4892
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 184 -p 1912 -ip 19121⤵PID:4656
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:220
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 220 -s 59202⤵
- Program crash
PID:3788
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3564
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2976
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2976 -s 35522⤵
- Program crash
PID:1832
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 604 -p 2976 -ip 29761⤵PID:3496
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 556 -p 220 -ip 2201⤵PID:2988
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2356
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2356 -s 59722⤵
- Program crash
PID:4988
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2044
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 576 -p 2356 -ip 23561⤵PID:3280
-
C:\Users\Admin\AppData\Roaming\Stand.Launchpad.exeC:\Users\Admin\AppData\Roaming\Stand.Launchpad.exe1⤵PID:1136
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4548
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
Filesize1KB
MD514ceaf262c9343435f7dc0db00dc0698
SHA164c1f4005d8422fc8fd0adcf2a9f576c40f08242
SHA256ff1e5017c156290e8ccb6285b763ae80448f584b15e5bda543f33ea2710f4a1e
SHA512882d79849b1e0edd364e04d86f7e38ce4c80446df1de5aacc9bc46b444d54e27e1c8f3b97b1330639923341e904ff6bee8274394a1b01ea775052b43830ab340
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
Filesize404B
MD5c6153a44c831147935c9fe2fb3e54735
SHA1c38a60a4d3ea8adde5359e57ec46574cef3c910a
SHA256ab2e68a60676f2499aaaee43b5cd19d1f6fbee8964b29817068a43bb3aebfd68
SHA51271c3503eb409d27366a7deb5ac23b80dce52380f6f1a22b773829fb28e22ea5a90a2f4039628df0dacda1adaebfa57416fb64c33ce3c365063423f3c06f48f54
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD515dde0683cd1ca19785d7262f554ba93
SHA1d039c577e438546d10ac64837b05da480d06bf69
SHA256d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961
SHA51257c0e1b87bc1c136f0d39f3ce64bb8f8274a0491e4ca6e45e5c7f9070aa9d9370c6f590ce37cd600b252df2638d870205249a514c43245ca7ed49017024a4672
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\J9OABNLC\microsoft.windows[1].xml
Filesize97B
MD554cad9840e798ef7844e4c78d3fed195
SHA1adf97c182735b5657366615ed62d86d269e09630
SHA256f940ca20452b05c3cff647feec78aa624509a9ab3d5eb1beb2d814bc367d36ac
SHA512c495efe72289ede85d243e592084fa4d627c689d7fa835a958bca55fda6be6d9a53cc84e4e78e3e72e68af4e7bf9482ec27c1feb1f93b14520a984c8a87482dc
-
Filesize
5.1MB
MD5a48e3197ab0f64c4684f0828f742165c
SHA1f935c3d6f9601c795f2211e34b3778fad14442b4
SHA256baecc747370a4c396ef5403a3a2b286465d8fe4677bf1bfd23b8164ef5c22bbb
SHA512e0b0b73c39850a30aac89f84f721c79f863612f596d6ff3df0860a9faf743a81364656773c99708e9c0656c74b6a278b6bf7e648f7ff1b9080f9a21e10515a59
-
Filesize
5.1MB
MD5a48e3197ab0f64c4684f0828f742165c
SHA1f935c3d6f9601c795f2211e34b3778fad14442b4
SHA256baecc747370a4c396ef5403a3a2b286465d8fe4677bf1bfd23b8164ef5c22bbb
SHA512e0b0b73c39850a30aac89f84f721c79f863612f596d6ff3df0860a9faf743a81364656773c99708e9c0656c74b6a278b6bf7e648f7ff1b9080f9a21e10515a59
-
Filesize
18KB
MD56ea692f862bdeb446e649e4b2893e36f
SHA184fceae03d28ff1907048acee7eae7e45baaf2bd
SHA2569ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2
SHA5129661c135f50000e0018b3e5c119515cfe977b2f5f88b0f5715e29df10517b196c81694d074398c99a572a971ec843b3676d6a831714ab632645ed25959d5e3e7
-
Filesize
21KB
MD572e28c902cd947f9a3425b19ac5a64bd
SHA19b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7
SHA2563cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1
SHA51258ab6fedce2f8ee0970894273886cb20b10d92979b21cda97ae0c41d0676cc0cd90691c58b223bce5f338e0718d1716e6ce59a106901fe9706f85c3acf7855ff
-
Filesize
18KB
MD5ac290dad7cb4ca2d93516580452eda1c
SHA1fa949453557d0049d723f9615e4f390010520eda
SHA256c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382
SHA512b5e2b9f5a9dd8a482169c7fc05f018ad8fe6ae27cb6540e67679272698bfca24b2ca5a377fa61897f328b3deac10237cafbd73bc965bf9055765923aba9478f8
-
Filesize
19KB
MD5aec2268601470050e62cb8066dd41a59
SHA1363ed259905442c4e3b89901bfd8a43b96bf25e4
SHA2567633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2
SHA5120c14d160bfa3ac52c35ff2f2813b85f8212c5f3afbcfe71a60ccc2b9e61e51736f0bf37ca1f9975b28968790ea62ed5924fae4654182f67114bd20d8466c4b8f
-
Filesize
18KB
MD593d3da06bf894f4fa21007bee06b5e7d
SHA11e47230a7ebcfaf643087a1929a385e0d554ad15
SHA256f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d
SHA51272bd6d46a464de74a8dac4c346c52d068116910587b1c7b97978df888925216958ce77be1ae049c3dccf5bf3fffb21bc41a0ac329622bc9bbc190df63abb25c6
-
Filesize
18KB
MD5a2f2258c32e3ba9abf9e9e38ef7da8c9
SHA1116846ca871114b7c54148ab2d968f364da6142f
SHA256565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33
SHA512e98cbc8d958e604effa614a3964b3d66b6fc646bdca9aa679ea5e4eb92ec0497b91485a40742f3471f4ff10de83122331699edc56a50f06ae86f21fad70953fe
-
Filesize
28KB
MD58b0ba750e7b15300482ce6c961a932f0
SHA171a2f5d76d23e48cef8f258eaad63e586cfc0e19
SHA256bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed
SHA512fb646cdcdb462a347ed843312418f037f3212b2481f3897a16c22446824149ee96eb4a4b47a903ca27b1f4d7a352605d4930df73092c380e3d4d77ce4e972c5a
-
Filesize
25KB
MD535fc66bd813d0f126883e695664e7b83
SHA12fd63c18cc5dc4defc7ea82f421050e668f68548
SHA25666abf3a1147751c95689f5bc6a259e55281ec3d06d3332dd0ba464effa716735
SHA51265f8397de5c48d3df8ad79baf46c1d3a0761f727e918ae63612ea37d96adf16cc76d70d454a599f37f9ba9b4e2e38ebc845df4c74fc1e1131720fd0dcb881431
-
Filesize
22KB
MD541a348f9bedc8681fb30fa78e45edb24
SHA166e76c0574a549f293323dd6f863a8a5b54f3f9b
SHA256c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b
SHA5128c2cb53ccf9719de87ee65ed2e1947e266ec7e8343246def6429c6df0dc514079f5171acd1aa637276256c607f1063144494b992d4635b01e09ddea6f5eef204
-
Filesize
23KB
MD5fefb98394cb9ef4368da798deab00e21
SHA1316d86926b558c9f3f6133739c1a8477b9e60740
SHA256b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7
SHA51257476fe9b546e4cafb1ef4fd1cbd757385ba2d445d1785987afb46298acbe4b05266a0c4325868bc4245c2f41e7e2553585bfb5c70910e687f57dac6a8e911e8
-
Filesize
22KB
MD5404604cd100a1e60dfdaf6ecf5ba14c0
SHA158469835ab4b916927b3cabf54aee4f380ff6748
SHA25673cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c
SHA512da024ccb50d4a2a5355b7712ba896df850cee57aa4ada33aad0bae6960bcd1e5e3cee9488371ab6e19a2073508fbb3f0b257382713a31bc0947a4bf1f7a20be4
-
Filesize
20KB
MD5849f2c3ebf1fcba33d16153692d5810f
SHA11f8eda52d31512ebfdd546be60990b95c8e28bfb
SHA25669885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d
SHA51244dc4200a653363c9a1cb2bdd3da5f371f7d1fb644d1ce2ff5fe57d939b35130ac8ae27a3f07b82b3428233f07f974628027b0e6b6f70f7b2a8d259be95222f5
-
Filesize
18KB
MD5b52a0ca52c9c207874639b62b6082242
SHA16fb845d6a82102ff74bd35f42a2844d8c450413b
SHA256a1d1d6b0cb0a8421d7c0d1297c4c389c95514493cd0a386b49dc517ac1b9a2b0
SHA51218834d89376d703bd461edf7738eb723ad8d54cb92acc9b6f10cbb55d63db22c2a0f2f3067fe2cc6feb775db397030606608ff791a46bf048016a1333028d0a4
-
Filesize
324KB
MD504a2ba08eb17206b7426cb941f39250b
SHA1731ac2b533724d9f540759d84b3e36910278edba
SHA2568e5110ce03826f680f30013985be49ebd8fc672de113fc1d9a566eced149b8c4
SHA512e6e90b4becf472b2e8f716dbb962cd7de61676fcce342c735fccdc01268b5a221139bc9be0e0c9722e9978aefaae79c10bc49c43392aa05dd12244b3147aeffc
-
Filesize
135KB
MD5591533ca4655646981f759d95f75ae3d
SHA1b4a02f18e505a1273f7090a9d246bc953a2cb792
SHA2564434f4223d24fb6e2f5840dd6c1eedef2875e11abe24e4b0e9bc1507f8f6fd47
SHA512915b124ad595ee78feab8f3c9be7e80155445e58ed4c88b89665df5fb7e0a04e973374a01f97bb67aaa733a8ce2e91a9f92605ec96251906e0fb2750a719b579
-
Filesize
429KB
MD5109f0f02fd37c84bfc7508d4227d7ed5
SHA1ef7420141bb15ac334d3964082361a460bfdb975
SHA256334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
SHA51246eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
-
Filesize
1.2MB
MD5fc57d044bfd635997415c5f655b5fffa
SHA11b5162443d985648ef64e4aab42089ad4c25f856
SHA25617f8c55eba797bbc80c8c32ca1a3a7588415984386be56f4b4cdefd4176fb4c3
SHA512f5a944230000730bc0aad10e6607e3389d9d82a0a4ab1b72a19d32e94e8572789d46fb4acd75ad48f17e2bbc27389d432086696f2ccc899850ff9177d6823efb
-
Filesize
140KB
MD51b304dad157edc24e397629c0b688a3e
SHA1ae151af384675125dfbdc96147094cff7179b7da
SHA2568f0c9ac7134773d11d402e49daa90958fe00205e83a7389f7a58da03892d20cb
SHA5122dc625dbdf2aae4ade600cca688eb5280200e8d7c2dfc359590435afe0926b3a7446cc56a66023ee834366132a68ae68da51a5079e4f107201e2050f5c5512ad
-
Filesize
81KB
MD57587bf9cb4147022cd5681b015183046
SHA1f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SHA5120b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
-
Filesize
72KB
MD572414dfb0b112c664d2c8d1215674e09
SHA150a1e61309741e92fe3931d8eb606f8ada582c0a
SHA25669e73fea2210adc2ae0837ac98b46980a09fe91c07f181a28fda195e2b9e6b71
SHA51241428624573b4a191b33657ed9ad760b500c5640f3d62b758869a17857edc68f90bc10d7a5e720029519c0d49b5ca0fa8579743e80b200ef331e41efde1dc8c9
-
Filesize
172KB
MD57ddbd64d87c94fd0b5914688093dd5c2
SHA1d49d1f79efae8a5f58e6f713e43360117589efeb
SHA256769703fb1ba6c95fb6c889e8a9baaea309e62d0f3ca444d01cc6b495c0f722d1
SHA51260eaad58c3c4894f1673723eb28ddb42b681ff7aafe7a29ff8bf87a2da6595c16d1f8449096accdb89bd6cda6454eb90470e71dde7c5bd16abd0f80e115cfa2d
-
Filesize
8KB
MD5c73ec58b42e66443fafc03f3a84dcef9
SHA15e91f467fe853da2c437f887162bccc6fd9d9dbe
SHA2562dc0171b83c406db6ec9389b438828246b282862d2b8bdf2f5b75aec932a69f7
SHA5126318e831d8f38525e2e49b5a1661440cd8b1f3d2afc6813bb862c21d88d213c4675a8ec2a413b14fbdca896c63b65a7da6ec9595893b352ade8979e7e86a7fcf
-
Filesize
6KB
MD5ee44d5d780521816c906568a8798ed2f
SHA12da1b06d5de378cbfc7f2614a0f280f59f2b1224
SHA25650b2735318233d6c87b6efccccc23a0e3216d2870c67f2f193cc1c83c7c879fc
SHA512634a1cd2baaef29b4fe7c7583c04406bb2ea3a3c93294b31f621652844541e7c549da1a31619f657207327604c261976e15845571ee1efe5416f1b021d361da8
-
Filesize
155KB
MD5e846285b19405b11c8f19c1ed0a57292
SHA12c20cf37394be48770cd6d396878a3ca70066fd0
SHA256251f0094b6b6537df3d3ce7c2663726616f06cfb9b6de90efabd67de2179a477
SHA512b622ff07ae2f77e886a93987a9a922e80032e9041ed41503f0e38abb8c344eb922d154ade29e52454d0a1ad31596c4085f4bd942e4412af9f0698183acd75db7
-
Filesize
104B
MD5774a9a7b72f7ed97905076523bdfe603
SHA1946355308d2224694e0957f4ebf6cdba58327370
SHA25676e56835b1ac5d7a8409b7333826a2353401cf67f3bd95c733adc6aa8d9fec81
SHA512c5c77c6827c72901494b3a368593cb9a990451664b082761294a845c0cd9441d37e5e9ac0e82155cb4d97f29507ffc8e26d6ff74009666c3075578aa18b28675
-
Filesize
104B
MD5774a9a7b72f7ed97905076523bdfe603
SHA1946355308d2224694e0957f4ebf6cdba58327370
SHA25676e56835b1ac5d7a8409b7333826a2353401cf67f3bd95c733adc6aa8d9fec81
SHA512c5c77c6827c72901494b3a368593cb9a990451664b082761294a845c0cd9441d37e5e9ac0e82155cb4d97f29507ffc8e26d6ff74009666c3075578aa18b28675
-
Filesize
1KB
MD5f6ce70d5466fe074a3b419543ff95d8b
SHA1915d6dc9ca2686d63979e77adc43d71c9678e534
SHA2566a509971a9cc11490946cb7b33864da43cd3af9f25673c130fc3bab5c365ff29
SHA51293e83de5d0a96cd71dcfb8f9ab3b32ed2afaa388a77ac450dd7fdca11dcf2ff0d59db54107c936859d6df3b6d28630b2e9907e0b546e8b27336b684bcbed84f8
-
Filesize
2.0MB
MD57a5c53a889c4bf3f773f90b85af5449e
SHA125b2928c310b3068b629e9dca38c7f10f6adc5b6
SHA256baa9c3a0d0524263c4f848056b3f1da3b4bb913162362cbcabe77ce76a39870c
SHA512f5943687d7e098790581bf56ac6fec3b7e9b83d0e29301077a8bc48768c5a0e9f54f53d926f9847885f6035a2b31e456e4e45ccf1c70be27229c46e79876e2ed
-
Filesize
2.0MB
MD57a5c53a889c4bf3f773f90b85af5449e
SHA125b2928c310b3068b629e9dca38c7f10f6adc5b6
SHA256baa9c3a0d0524263c4f848056b3f1da3b4bb913162362cbcabe77ce76a39870c
SHA512f5943687d7e098790581bf56ac6fec3b7e9b83d0e29301077a8bc48768c5a0e9f54f53d926f9847885f6035a2b31e456e4e45ccf1c70be27229c46e79876e2ed
-
Filesize
2.0MB
MD57a5c53a889c4bf3f773f90b85af5449e
SHA125b2928c310b3068b629e9dca38c7f10f6adc5b6
SHA256baa9c3a0d0524263c4f848056b3f1da3b4bb913162362cbcabe77ce76a39870c
SHA512f5943687d7e098790581bf56ac6fec3b7e9b83d0e29301077a8bc48768c5a0e9f54f53d926f9847885f6035a2b31e456e4e45ccf1c70be27229c46e79876e2ed
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
20KB
MD556b941f65d270f2bf397be196fcf4406
SHA1244f2e964da92f7ef7f809e5ce0b3191aeab084a
SHA25600c020ba1cce022364976f164c575993cb3b811c61b5b4e05a8a0c3d1b560c0c
SHA51252ad8c7ed497a5b8eed565b3abcbf544841f3c8c9ec3ca8f686846a2afd15ac4ac8b16abf1cb14aeca1a2fb31f3086ad17206ec4af28e77bae600dca15e8deab
-
Filesize
20KB
MD556b941f65d270f2bf397be196fcf4406
SHA1244f2e964da92f7ef7f809e5ce0b3191aeab084a
SHA25600c020ba1cce022364976f164c575993cb3b811c61b5b4e05a8a0c3d1b560c0c
SHA51252ad8c7ed497a5b8eed565b3abcbf544841f3c8c9ec3ca8f686846a2afd15ac4ac8b16abf1cb14aeca1a2fb31f3086ad17206ec4af28e77bae600dca15e8deab
-
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_F539236A64E342A9ACA061252CDEA26E.dat
Filesize940B
MD5a46aff2e023a5d9d12fc2a490f45a90f
SHA14110f2efa11561fdf845414cec5966dda946353c
SHA25614b7e4acdae16c9dea65579dd0c886b7732660504350824a5617994327677712
SHA512d3de087b355a3d2949dc182159cd069755e81912e0622931477d107b518a8bb9b88611c74ef6dbe87dc533963ec1f23232d5b6684339dd057574be404e92af46
-
Filesize
95KB
MD5fc067bffd940f4a2745e2374463f4f3d
SHA1cb3b8644a6f0a89d7cb00a21086e24623ed92197
SHA256727be016c2084ef54f591388fcff01ba6368831447bfcd01f7d0c7f94a8bb4a8
SHA512c3cee63b8f03ef71d633b33cebc24199492fef7bc0b37d52d3ddfc88172df3aa5db2c7813bbb44adaee3756423c351cf585ff33887a78c9057c6749face0a710
-
Filesize
95KB
MD5fc067bffd940f4a2745e2374463f4f3d
SHA1cb3b8644a6f0a89d7cb00a21086e24623ed92197
SHA256727be016c2084ef54f591388fcff01ba6368831447bfcd01f7d0c7f94a8bb4a8
SHA512c3cee63b8f03ef71d633b33cebc24199492fef7bc0b37d52d3ddfc88172df3aa5db2c7813bbb44adaee3756423c351cf585ff33887a78c9057c6749face0a710
-
Filesize
95KB
MD5fc067bffd940f4a2745e2374463f4f3d
SHA1cb3b8644a6f0a89d7cb00a21086e24623ed92197
SHA256727be016c2084ef54f591388fcff01ba6368831447bfcd01f7d0c7f94a8bb4a8
SHA512c3cee63b8f03ef71d633b33cebc24199492fef7bc0b37d52d3ddfc88172df3aa5db2c7813bbb44adaee3756423c351cf585ff33887a78c9057c6749face0a710
-
Filesize
95KB
MD5fc067bffd940f4a2745e2374463f4f3d
SHA1cb3b8644a6f0a89d7cb00a21086e24623ed92197
SHA256727be016c2084ef54f591388fcff01ba6368831447bfcd01f7d0c7f94a8bb4a8
SHA512c3cee63b8f03ef71d633b33cebc24199492fef7bc0b37d52d3ddfc88172df3aa5db2c7813bbb44adaee3756423c351cf585ff33887a78c9057c6749face0a710
-
Filesize
95KB
MD5fc067bffd940f4a2745e2374463f4f3d
SHA1cb3b8644a6f0a89d7cb00a21086e24623ed92197
SHA256727be016c2084ef54f591388fcff01ba6368831447bfcd01f7d0c7f94a8bb4a8
SHA512c3cee63b8f03ef71d633b33cebc24199492fef7bc0b37d52d3ddfc88172df3aa5db2c7813bbb44adaee3756423c351cf585ff33887a78c9057c6749face0a710
-
Filesize
95KB
MD5fc067bffd940f4a2745e2374463f4f3d
SHA1cb3b8644a6f0a89d7cb00a21086e24623ed92197
SHA256727be016c2084ef54f591388fcff01ba6368831447bfcd01f7d0c7f94a8bb4a8
SHA512c3cee63b8f03ef71d633b33cebc24199492fef7bc0b37d52d3ddfc88172df3aa5db2c7813bbb44adaee3756423c351cf585ff33887a78c9057c6749face0a710